Analysis Report

Overview

General Information

Joe Sandbox Version:	20.0.0
Analysis ID:	33888
Start time:	17:48:16
Joe Sandbox Product:	CloudBasic
Start date:	10.10.2017
Overall analysis duration:	0h 6m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	mzN17oSU6p (renamed file extension from none to js)
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 SP1 (with Office 2010 SP2, IE 11, FF 54, Chrome 60, Acrobat Reader DC 17, Flash 26, Java 8.0.1440.1)
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled HDC enabled
Detection:	MAL
Classification:	mal72.evad.expl.winJS@31/21@1/1
HCA Information:	Successful, ratio: 100% Number of executed functions: 20 Number of non-executed functions: 67
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 96%) Quality average: 86.3% Quality standard deviation: 24.4%
Warnings:	Show All Exclude process from analysis (whitelisted): conhost.exe, dllhost.exe Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: powershell.exe, powershell.exe, csc.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	72	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for submitted file

Show sources

Source: mzN17oSU6p.js

virustotal: Detection: 8%

Perma Link

Networking:

Found strings which match to known social media urls

Show sources

Source: powershell.exe	String found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: powershell.exe	String found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: powershell.exe	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: chocolatey.org

Urls found in memory or binary data

Show sources

Source: powershell.exe	String found in binary or memory: file://
Source: powershell.exe	String found in binary or memory: file:///
Source: powershell.exe	String found in binary or memory: file:///c:/programdata/hc5ip.ps1
Source: powershell.exe	String found in binary or memory: file:///c:/programdata/hc5ip.ps1x
Source: powershell.exe	String found in binary or memory: file:///c:/users/herb%20blackburn/appdata/local/temp/iafs4i6h.ps1
Source: powershell.exe	String found in binary or memory: file:///c:/windows/as
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assem:
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_32/system.transactions/2.0.0.0__b77a5c561934e089/system.transactions
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.jscript/8.0.0.0__b03f5f7f11d50a3a/microsoft.jscript.d
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.powershell.commands.diagnostics/1.0.0.0__31bf3856ad36
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.powershell.commands.management/1.0.0.0__31bf3856ad364
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.powershell.commands.utility/1.0.0.0__31bf3856ad364e35
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.powershell.consolehost/1.0.0.0__31bf3856ad364e35/micr
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.powershell.security/1.0.0.0__31bf3856ad364e35/microso
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/microsoft.wsman.management/1.0.0.0__31bf3856ad364e35/microsoft.
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/system.configuration.install/2.0.0.0__b03f5f7f11d50a3a/system.c
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/system.core/3.5.0.0__b77a5c561934e089/system.core.dll
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/system.directoryservices/2.0.0.0__b03f5f7f11d50a3a/system.direc
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/system.management.automation/1.0.0.0__31bf3856ad364e35/system.m
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/system.management/2.0.0.0__b03f5f7f11d50a3a/system.management.d
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/system.xml/2.0.0.0__b77a5c561934e089/system.xml.dll
Source: powershell.exe	String found in binary or memory: file:///c:/windows/assembly/gac_msil/system/2.0.0.0__b77a5c561934e089/system.dll
Source: powershell.exe	String found in binary or memory: file:///c:/windows/microsoft.net/framework/v2.0.50727/
Source: powershell.exe	String found in binary or memory: file:///c:/windows/microsoft.net/framework/v2.0.50727/mscorlib.dll
Source: powershell.exe	String found in binary or memory: file:///c:/windows/system32/windowspowershell/v1.0/
Source: powershell.exe	String found in binary or memory: file:///c:/windows/system32/windowspowershell/v1.0/1j
Source: powershell.exe	String found in binary or memory: file:///c:/windows/system32/windowspowershell/v1.0/cj
Source: powershell.exe	String found in binary or memory: file:///c:/windows/system32/windowspowershell/v1.0/en-us/microsoft.powershell.commands.management.re
Source: powershell.exe	String found in binary or memory: file:///c:s
Source: powershell.exe	String found in binary or memory: http://
Source: wscript.exe, powershell.exe, mzN17oSU6p.js, Hc5Ip.ps1.1.dr	String found in binary or memory: http://127.0.0.1:5555/
Source: powershell.exe	String found in binary or memory: http://127.0.0.1:5555/l
Source: powershell.exe	String found in binary or memory: http://127.0.0.1:5555/z2ew6duf.asp?ts&ip=
Source: powershell.exe, mzN17oSU6p.js, Hc5Ip.ps1.1.dr	String found in binary or memory: http://api.ipify.org/
Source: powershell.exe	String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: powershell.exe	String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
Source: powershell.exe	String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: powershell.exe	String found in binary or memory: http://crl.comodo.net/utn-userfirst-hardware.crl0q
Source: powershell.exe	String found in binary or memory: http://crl.comodoca.com/utn-userfirst-hardware.crl06
Source: powershell.exe	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe	String found in binary or memory: http://crl.godaddy.com/gdig2s1-499.crl0
Source: powershell.exe	String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0f
Source: powershell.exe	String found in binary or memory: http://crl.godaddy.com/gdroot.crl0f
Source: powershell.exe	String found in binary or memory: http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0
Source: powershell.exe	String found in binary or memory: http://crl.pkioverheid.nl/domovlatestcrl.crl0
Source: powershell.exe	String found in binary or memory: http://crl.usertru
Source: powershell.exe	String found in binary or memory: http://crl.usertrust.com/utn-userfirst-object.crl0)
Source: powershell.exe	String found in binary or memory: http://crt.comodoca.com/utnaddtrustserverca.crt0$
Source: powershell.exe	String found in binary or memory: http://cybertrust.omniroot.com/repository.cfm0
Source: wscript.exe, mzN17oSU6p.js	String found in binary or memory: http://icanhazip.com/
Source: powershell.exe	String found in binary or memory: http://java.com/
Source: powershell.exe	String found in binary or memory: http://java.com/help
Source: powershell.exe	String found in binary or memory: http://java.com/http://java.com/
Source: powershell.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe	String found in binary or memory: http://ocsp.entrust.net0d
Source: powershell.exe	String found in binary or memory: http://ocsp.godaddy.com/0
Source: powershell.exe	String found in binary or memory: http://ocsp.godaddy.com/02
Source: powershell.exe	String found in binary or memory: http://ocsp.godaddy.com/05
Source: powershell.exe	String found in binary or memory: http://schemas.dmtf.org/wbem/wsman/1/cimbinding/associationfilter
Source: powershell.exe	String found in binary or memory: http://schemas.dmtf.org/wbem/wsman/1/wsman/selectorfilter
Source: powershell.exe	String found in binary or memory: http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd#identifyresponse
Source: powershell.exe	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe	String found in binary or memory: http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0
Source: powershell.exe	String found in binary or memory: http://www.public-trust.com/cps/omniroot.html0
Source: powershell.exe	String found in binary or memory: http://www.us
Source: powershell.exe	String found in binary or memory: http://www.usertrust.com
Source: powershell.exe	String found in binary or memory: http://www.usertrust.com1
Source: powershell.exe	String found in binary or memory: https://certs.godaddy.com/repository/0
Source: powershell.exe	String found in binary or memory: https://chocolatey.org
Source: powershell.exe, Hc5Ip.ps1.1.dr	String found in binary or memory: https://chocolatey.org/7za.exe
Source: powershell.exe	String found in binary or memory: https://chocolatey.org/7za.exet
Source: powershell.exe	String found in binary or memory: https://secure.comodo.com/cps0

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	File created: C:\Users\user\AppData\Local\Temp\d25je5re.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\7za.exe

Installs new ROOT certificates

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Data Obfuscation:

Compiles C# or VB.Net code

Show sources

Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\d25je5re.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\d25je5re.cmdline'

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe

Code function: 6_2_00471C24 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00471C24

PE file contains sections with non-standard names

Show sources

Source: 7za.exe.4.dr

Static PE information: section name: .sxdata

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: 6_2_0046B890 push eax; ret	6_2_0046B8AE
Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: 6_2_00459590 push ecx; mov dword ptr [esp], ecx	6_2_00459591
Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: 6_2_0046CC80 push eax; ret	6_2_0046CCAE

Powershell starts a process from the temp directory

Show sources

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1'

Suspicious powershell command line found

Show sources

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\Hc5Ip.ps1'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\Hc5Ip.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1'

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: 6_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,		6_2_0040B174
Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: 6_2_0040B6E9 __EH_prolog,FindFirstFileW,GetCurrentDirectoryW,		6_2_0040B6E9

Enumerates the file system

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

System Summary:

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Uses new MSVCR Dlls

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll

Binary contains paths to debug symbols

Show sources

Source:	Binary string: wscript.pdb source: wscript.exe
Source:	Binary string: mscorlib.pdb source: powershell.exe
Source:	Binary string: xnc:\Users\user\AppData\Local\Temp\d25je5re.pdb source: csc.exe
Source:	Binary string: Display this usage messageSSpecify debug information file name (default: output file name with .pdb extension)5### Visual C# 2005 Compiler Defect Report, created %s source: csc.exe
Source:	Binary string: mscorrc.pdb source: powershell.exe
Source:	Binary string: i87C:\Users\user\AppData\Local\Temp\d25je5re.pdb source: powershell.exe
Source:	Binary string: c:\Users\user\AppData\Local\Temp\d25je5re.pdb source: powershell.exe, d25je5re.dll.19.dr
Source:	Binary string: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe
Source:	Binary string: msado15.pdb source: wscript.exe
Source:	Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe
Source:	Binary string: msado15.pdb`Cr source: wscript.exe
Source:	Binary string: scrrun.pdb source: wscript.exe
Source:	Binary string: C:\Windows\mscorlib.pdb' source: powershell.exe
Source:	Binary string: wwnc:\Users\user\AppData\Local\Temp\d25je5re.pdb source: csc.exe
Source:	Binary string: C:\Windows\dll\mscorlib.pdb source: powershell.exe
Source:	Binary string: indows\mscorlib.pdbpdblib.pdb source: powershell.exe
Source:	Binary string: c:\Users\user\AppData\Local\Temp\d25je5re.pdb7 source: powershell.exe, d25je5re.dll.19.dr
Source:	Binary string: wscript.pdbN source: wscript.exe

Classification label

Show sources

Source: classification engine

Classification label: mal72.evad.expl.winJS@31/21@1/1

Creates files inside the user directory

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

Creates temporary files

Show sources

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1

Found command line output

Show sources

Source: C:\Windows\System32\taskkill.exe	Console Write: ...........w..0.............P....>............................X...........&.e.........&.n.....&.B.......Z...........(...
Source: C:\Windows\System32\taskkill.exe	Console Write: ...........w..0.....(...H.......\|?............................!.........D...d...........n...D...B.......X...........4...
Source: C:\Windows\System32\taskkill.exe	Console Write: ...........w..0.....@...p........?..................................$...D...c...........n...D...B.......V...............

Parts of this applications are using the .NET runtime (Probably coded in C#)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll

Queries process information (via WMI, Win32_Process)

Show sources

Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - Select * from Win32_Process where Name='cscript.exe' or Name='wscript.exe'
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "iexplore.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "firefox.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

Reads ini files

Show sources

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Reads software policies

Show sources

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Sample is known by Antivirus (Virustotal or Metascan)

Show sources

Source: mzN17oSU6p.js

Virustotal: hash found

Spawns processes

Show sources

Source: unknown	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\mzN17oSU6p.js'
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\ProgramData\Hc5Ip.ps1' \| find /v '' >> 'C:\Users\HERBBL~1\AppData\Local\Temp\computer.log'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\Hc5Ip.ps1'
Source: unknown	Process created: C:\Windows\System32\find.exe find /v ''
Source: unknown	Process created: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe 'C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe' x -o'C:\Users\HERBBL~1\AppData\Local\Temp\E6lu3ZvtrsVM' -y 'C:\Users\HERBBL~1\AppData\Local\Temp\ts.zip'
Source: unknown	Process created: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe 'C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe' x -o'C:\Users\user\AppData\Roaming\d3yfUaI97' -y 'C:\Users\HERBBL~1\AppData\Local\Temp\t.zip'
Source: unknown	Process created: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe 'C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe' x -o'C:\Users\user\AppData\Roaming\d3yfUaI97' -y 'C:\Users\HERBBL~1\AppData\Local\Temp\s.zip'
Source: unknown	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im iexplore.exe
Source: unknown	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im firefox.exe
Source: unknown	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im chrome.exe
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1' \| find /v '' >> 'C:\Users\HERBBL~1\AppData\Local\Temp\computer.log'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1'
Source: unknown	Process created: C:\Windows\System32\find.exe find /v ''
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\d25je5re.cmdline'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\HERBBL~1\AppData\Local\Temp\RES6963.tmp' 'c:\Users\user\AppData\Local\Temp\CSC6944.tmp'
Source: unknown	Process created: C:\Windows\System32\wermgr.exe 'C:\Windows\system32\wermgr.exe' '-outproc' '3496' '1472'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\ProgramData\Hc5Ip.ps1' \| find /v '' >> 'C:\Users\HERBBL~1\AppData\Local\Temp\computer.log'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im iexplore.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im firefox.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im chrome.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1' \| find /v '' >> 'C:\Users\HERBBL~1\AppData\Local\Temp\computer.log'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\Hc5Ip.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /v ''
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe 'C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe' x -o'C:\Users\HERBBL~1\AppData\Local\Temp\E6lu3ZvtrsVM' -y 'C:\Users\HERBBL~1\AppData\Local\Temp\ts.zip'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe 'C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe' x -o'C:\Users\user\AppData\Roaming\d3yfUaI97' -y 'C:\Users\HERBBL~1\AppData\Local\Temp\t.zip'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe 'C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe' x -o'C:\Users\user\AppData\Roaming\d3yfUaI97' -y 'C:\Users\HERBBL~1\AppData\Local\Temp\s.zip'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /v ''
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\d25je5re.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe 'C:\Windows\system32\wermgr.exe' '-outproc' '3496' '1472'
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\HERBBL~1\AppData\Local\Temp\RES6963.tmp' 'c:\Users\user\AppData\Local\Temp\CSC6944.tmp'

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Contains functionality to communicate with device drivers

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe

Code function: 6_2_0040BACB: DeviceIoControl,DeviceIoControl,DeviceIoControl,DeviceIoControl,

6_2_0040BACB

Creates mutexes

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Found potential string decryption / allocating functions

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: String function: 00407A18 appears 152 times
Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: String function: 0046B890 appears 623 times

Java / VBScript file with very long strings (likely obfuscated code)

Show sources

Source: mzN17oSU6p.js

Initial sample: Strings found which are bigger than 50

PE file does not import any functions

Show sources

Source: d25je5re.dll.19.dr

Static PE information: No import functions for PE file found

Reads the hosts file

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Windows\System32\drivers\etc\hosts

Wscript starts Powershell (via cmd or directly)

Show sources

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\ProgramData\Hc5Ip.ps1' \| find /v '' >> 'C:\Users\HERBBL~1\AppData\Local\Temp\computer.log'
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c powershell -ep Unrestricted -f 'C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1' \| find /v '' >> 'C:\Users\HERBBL~1\AppData\Local\Temp\computer.log'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\ProgramData\Hc5Ip.ps1'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ep Unrestricted -f 'C:\Users\HERBBL~1\AppData\Local\Temp\IAFS4I6h.ps1'

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: wscript.exe, cmd.exe, powershell.exe, find.exe, wermgr.exe	Binary or memory string: Progman
Source: wscript.exe, cmd.exe, powershell.exe, find.exe, wermgr.exe	Binary or memory string: Program Manager
Source: powershell.exe	Binary or memory string: Shell_TrayWndX
Source: wscript.exe, cmd.exe, powershell.exe, find.exe, wermgr.exe	Binary or memory string: Shell_TrayWnd

Uses taskkill to terminate processes

Show sources

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im iexplore.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im firefox.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\taskkill.exe 'C:\Windows\System32\taskkill.exe' /F /im chrome.exe

Found C# or VB.Net code to silently install a certificate (surpess security dialog)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\d25je5re.0.cs

Anti Debugging:

Contains functionality to register its own exception handler

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: 6_2_0046E6AA SetUnhandledExceptionFilter,		6_2_0046E6AA
Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: 6_2_0046E6BC SetUnhandledExceptionFilter,		6_2_0046E6BC

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory allocated: page read and write and page guard

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Windows\System32\wscript.exe

System information queried: KernelDebuggerInformation

Checks if the current process is being debugged

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process queried: DebugPort

Contains functionality to dynamically determine API calls

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe

Code function: 6_2_00471C24 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00471C24

Enables debug privileges

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Malware Analysis System Evasion:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: 6_2_0040B174 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,AreFileApisANSI,FindFirstFileA,		6_2_0040B174
Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	Code function: 6_2_0040B6E9 __EH_prolog,FindFirstFileW,GetCurrentDirectoryW,		6_2_0040B6E9

Contains functionality to query system information

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe

Code function: 6_2_0040C5F4 GetSystemInfo,

6_2_0040C5F4

Program exit points

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	API call chain: ExitProcess graph end node			graph_6-54587
Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe	API call chain: ExitProcess graph end node			graph_6-54586

Queries a list of all running processes

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Contains long sleeps (>= 3 min)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 500
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 500
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 500

Enumerates the file system

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch

Found WSH timer for Javascript or VBS script (likely evasive script)

Show sources

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\d25je5re.dll

Found large amount of non-executed APIs

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe

API coverage: 6.0 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Windows\System32\wscript.exe TID: 3136	Thread sleep time: -360000s >= -60s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3276	Thread sleep time: -4611686018427385s >= -60s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3280	Thread sleep time: -500s >= -60s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3280	Thread sleep time: -3000s >= -60s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3280	Thread sleep time: -500s >= -60s
Source: C:\Windows\System32\taskkill.exe TID: 3388	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\taskkill.exe TID: 3436	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\taskkill.exe TID: 3460	Thread sleep time: -60000s >= -60s

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key monitored for changes: HKEY_USERS\Software\Microsoft\SystemCertificates\Root

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Network Connect: 104.20.74.28 443

Lowering of HIPS / PFW / Operating System Security Settings:

Adds / modifies Windows certificates

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4 Blob

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe

Code function: 6_2_0040C756 GetSystemTime,SystemTimeToFileTime,

6_2_0040C756

Contains functionality to query windows version

Show sources

Source: C:\Users\HERBBL~1\AppData\Local\Temp\7za.exe

Code function: 6_2_0046CF4C EntryPoint,GetVersion,

6_2_0046CF4C

Queries the cryptographic machine GUID

Show sources

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Queries the installation date of Windows

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
17:48:12	API Interceptor	227x Sleep call for process: wscript.exe modified from: 60000ms to: 500ms
17:48:32	API Interceptor	3x Sleep call for process: taskkill.exe modified from: 60000ms to: 500ms

Antivirus Detection

Initial Sample

Source	Detection	Cloud	Link
mzN17oSU6p.js	9%	virustotal	Browse

Dropped Files

Source	Detection	Cloud	Link
C:\Users\user\AppData\Local\Temp\7za.exe	0%	virustotal	Browse
C:\Users\user\AppData\Local\Temp\7za.exe	0%	metadefender	Browse

Domains

Source	Detection	Cloud	Link
chocolatey.org	0%	virustotal	Browse

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Local\Temp\7za.exe	Planilha-Nova.vbs	1d77b09519f616e6fe6ae3b61f2b71dc1a9ed67e807809a5c3b212472527a697	malicious	Browse
C:\Users\user\AppData\Local\Temp\7za.exe	092016.js	6d9308a954a5dbd5cd2de6af9b16e7571468b98b8ebdf349b14e2a86ee5206c2	malicious	Browse

Screenshot

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

AV Detection:

Networking:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshot