Windows Analysis Report
SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.7507

Multi AV Scanner detection for dropped file

Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.720700.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.271102181.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252637221.0000000000721000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272602277.0000000000720000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271200281.000000000071F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271579326.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252535333.0000000000725000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252587569.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265818960.0000000002D24000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252517733.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.523109048.0000000002CF4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Program Files\Microsoft DN1\sqlmap.dll	Virustotal: Detection: 49%	Perma Link
Source: C:\Program Files\Microsoft DN1\sqlmap.dll	Metadefender: Detection: 20%	Perma Link
Source: C:\Program Files\Microsoft DN1\sqlmap.dll	ReversingLabs: Detection: 50%
Source: C:\ProgramData:ApplicationData	ReversingLabs: Detection: 24%
Source: C:\ProgramData\images.exe	ReversingLabs: Detection: 24%

Machine Learning detection for sample

Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\ProgramData:ApplicationData	Joe Sandbox ML: detected
Source: C:\ProgramData\images.exe	Joe Sandbox ML: detected

Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.732e68.2.unpack	Avira: Label: TR/Patched.Ren.Gen3
Source: 4.3.images.exe.732cb8.3.unpack	Avira: Label: TR/Patched.Ren.Gen3
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack	Avira: Label: TR/Patched.Ren.Gen3
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.732e68.6.unpack	Avira: Label: TR/Patched.Ren.Gen3
Source: 4.3.images.exe.732cb8.7.unpack	Avira: Label: TR/Patched.Ren.Gen3
Source: 4.2.images.exe.22e053f.3.unpack	Avira: Label: TR/Patched.Ren.Gen3
Source: 4.2.images.exe.2ce0000.4.unpack	Avira: Label: TR/Redcap.ghjpt

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D1CAFC CryptUnprotectData,LocalAlloc,LocalFree,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D1B15E lstrlenA,CryptStringToBinaryA,lstrcpyA,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D1A632 RegQueryValueExW,GlobalAlloc,CryptUnprotectData,lstrcpyW,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D1CF58 LocalAlloc,BCryptDecrypt,LocalFree,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D1CCB4 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D1CC54 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,

Exploits

Yara detected UACMe UAC Bypass tool

Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.23289af.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.75db48.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.75db48.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.75ed00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.75ed00.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22f89af.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.271102181.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.523218052.0000000002E2F000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252571359.0000000000721000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.266002119.0000000002E5F000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271200281.000000000071F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271579326.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252587569.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252517733.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe PID: 6324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: images.exe PID: 6516, type: MEMORYSTR

Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Directory created: C:\Program Files\Microsoft DN1	Jump to behavior
Source: C:\ProgramData\images.exe	Directory created: C:\Program Files\Microsoft DN1\sqlmap.dll	Jump to behavior
Source: C:\ProgramData\images.exe	Directory created: C:\Program Files\Microsoft DN1\rdpwrap.ini	Jump to behavior

Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: images.exe, images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422022458.0000000004B56000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdb source: images.exe, images.exe, 00000004.00000002.524034966.00000000043EE000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.524593557.00000000047F0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdbUGP source: images.exe, 00000004.00000002.524034966.00000000043EE000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.524593557.00000000047F0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422022458.0000000004B56000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D2002B GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW,

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0040FD34 FindFirstFileExA,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0040FE55 FindFirstFileExA,FindClose,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D1FF27 FindFirstFileW,FindNextFileW,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D19DF6 GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA,

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2841903 ETPRO TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound) 23.227.202.157:8080 -> 192.168.2.3:49740
Source: Traffic	Snort IDS: 2834979 ETPRO TROJAN Ave Maria/Warzone RAT Encrypted CnC Checkin 192.168.2.3:49740 -> 23.227.202.157:8080

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 23.227.202.157

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D127D3 URLDownloadToFileW,ShellExecuteW,

Source: Joe Sandbox View

ASN Name: HVC-ASUS HVC-ASUS

Source: global traffic

TCP traffic: 192.168.2.3:49740 -> 23.227.202.157:8080

Source: powershell.exe, 00000006.00000003.407047557.00000000076DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000001.00000003.377239509.00000000075FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000003.384190535.00000000075FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsof
Source: powershell.exe, 00000006.00000002.409620051.0000000004601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000006.00000002.409298369.00000000044C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.409620051.0000000004601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: sqlmap.dll.4.dr	String found in binary or memory: http://stascorp.comDVarFileInfo$
Source: powershell.exe, 00000001.00000003.342861149.0000000008D06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeper
Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.265818960.0000000002D24000.00000002.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.523109048.0000000002CF4000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeperC:
Source: images.exe, 00000004.00000002.525619079.0000000004AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: images.exe, 00000004.00000002.525619079.0000000004AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D1F23D recv,recv,

Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.227.202.157

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\ProgramData\images.exe

Windows user hook set: 0 keyboard low level C:\ProgramData\images.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D189D5 GetAsyncKeyState,wsprintfW,GetAsyncKeyState,wsprintfW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyNameTextW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,CallNextHookEx,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D1902E DefWindowProcA,GetRawInputData,GetRawInputData,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrcpyW,CreateFileW,WriteFile,lstrlenW,WriteFile,lstrlenW,WriteFile,WriteFile,lstrlenW,WriteFile,lstrlenW,WriteFile,lstrlenW,WriteFile,CloseHandle,PostQuitMessage,RegisterRawInputDevices,

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.720700.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.271102181.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252637221.0000000000721000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272602277.0000000000720000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271200281.000000000071F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271579326.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252535333.0000000000725000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252587569.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265818960.0000000002D24000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252517733.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.523109048.0000000002CF4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.23289af.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 4.3.images.exe.75db48.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 4.3.images.exe.75db48.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.75ed00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.75ed00.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 4.2.images.exe.22f89af.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 4.3.images.exe.720700.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown

Contains functionality to create processes via WMI

Source: WMIC.exe, 0000000D.00000002.288337503.000001B74FE00000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C:\Windows\System32\Wbem\WMIC.exewmic process call create '"C:\ProgramData:ApplicationData"'wmic process call create '"C:\ProgramData:ApplicationData"'Winsta0\Default

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_00415808
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_00412922
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_00412480
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_00416D23
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_004156DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0040B784
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D21BF8
Source: C:\ProgramData\images.exe	Code function: 4_3_02F542D0
Source: C:\ProgramData\images.exe	Code function: 4_3_02F91AA0
Source: C:\ProgramData\images.exe	Code function: 4_3_02F86B50
Source: C:\ProgramData\images.exe	Code function: 4_3_02F45AB0

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Section loaded: wmi.dll

Source: unknown

Driver loaded: C:\Windows\System32\drivers\rdpvideominiport.sys

Source: Joe Sandbox View

Dropped File: C:\Program Files\Microsoft DN1\sqlmap.dll 798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4

Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.23289af.1.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.23289af.1.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.3.images.exe.75db48.1.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.3.images.exe.75db48.1.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.3.images.exe.75db48.5.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.3.images.exe.75db48.5.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.75ed00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.75ed00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.75ed00.5.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.75ed00.5.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.images.exe.22f89af.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.2.images.exe.22f89af.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.3.images.exe.720700.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000004.00000003.271102181.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000004.00000002.523218052.0000000002E2F000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000000.00000003.252571359.0000000000721000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000000.00000002.266002119.0000000002E5F000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000004.00000003.271200281.000000000071F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000004.00000003.271579326.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000000.00000003.252587569.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000000.00000003.252517733.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: String function: 00407FC0 appears 33 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: String function: 02D20969 appears 47 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: String function: 02D135E5 appears 40 times

Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000000.242916125.0000000000554000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameATLDUCK.DLL> vs SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe
Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.264379372.0000000000554000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameATLDUCK.DLL> vs SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe
Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Binary or memory string: OriginalFilenameATLDUCK.DLL> vs SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

File created: C:\Users\user\AppData\Local\Microsoft Vision\

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winEXE@18/18@0/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D1D49C OpenSCManagerW,OpenServiceW,CloseServiceHandle,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_00406750 LoadResource,LockResource,SizeofResource,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

File created: C:\Program Files\Microsoft DN1

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat" "

Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

ReversingLabs: Detection: 24%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe "C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe
Source: C:\ProgramData\images.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat" "
Source: C:\ProgramData\images.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic process call create '"C:\ProgramData:ApplicationData"'
Source: unknown	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe
Source: C:\ProgramData\images.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\ProgramData\images.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic process call create '"C:\ProgramData:ApplicationData"'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\InprocServer32

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D1F619 OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_caqnsxdv.wy2.ps1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D2290F CoInitialize,CoCreateInstance,VariantInit,CoUninitialize,

Source: C:\ProgramData\images.exe

Code function: 4_3_02F494E0 GetVersionExW,MultiByteToWideChar,MultiByteToWideChar,_malloc,MultiByteToWideChar,_free,GetVersionExW,GetDiskFreeSpaceW,GetDiskFreeSpaceA,_free,

Source: images.exe, images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422022458.0000000004B56000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: images.exe, images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422022458.0000000004B56000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422022458.0000000004B56000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: images.exe, images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422022458.0000000004B56000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: images.exe, images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: images.exe, images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422022458.0000000004B56000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: images.exe, images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422022458.0000000004B56000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D220B8 RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6992:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6376:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6860:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6848:120:WilError_01

Source: C:\ProgramData\images.exe

File written: C:\Program Files\Microsoft DN1\rdpwrap.ini

Creates processes via WMI

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\ProgramData\images.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Directory created: C:\Program Files\Microsoft DN1	Jump to behavior
Source: C:\ProgramData\images.exe	Directory created: C:\Program Files\Microsoft DN1\sqlmap.dll	Jump to behavior
Source: C:\ProgramData\images.exe	Directory created: C:\Program Files\Microsoft DN1\rdpwrap.ini	Jump to behavior

Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: images.exe, images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422022458.0000000004B56000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdb source: images.exe, images.exe, 00000004.00000002.524034966.00000000043EE000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.524593557.00000000047F0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wuser32.pdbUGP source: images.exe, 00000004.00000002.524034966.00000000043EE000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.524593557.00000000047F0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: images.exe, 00000004.00000003.426226423.0000000002F40000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522256093.0000000000987000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.521736326.00000000008F2000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.525479497.000000000498B000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422022458.0000000004B56000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422705804.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000003.422349023.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_00408010 push ecx; ret
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0041C352 pushad ; retf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0041D355 push esi; ret
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0041C33A push esp; retf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D11190 push eax; ret
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D11190 push eax; ret

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_00553B50 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : Win32_Process::Create

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D1D418 NetUserAdd,NetLocalGroupAddMembers,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	File created: C:\ProgramData\images.exe			Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	File created: C:\ProgramData:ApplicationData			Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

File created: C:\ProgramData:ApplicationData

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	File created: C:\ProgramData\images.exe	Jump to dropped file
Source: C:\ProgramData\images.exe	File created: C:\Program Files\Microsoft DN1\sqlmap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	File created: C:\ProgramData:ApplicationData	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D127D3 URLDownloadToFileW,ShellExecuteW,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D1A6C8 GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D1AC0A lstrcatW,GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW,

Boot Survival

Drops script or batch files to the startup folder

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat

Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start			Jump to behavior

Source: C:\ProgramData\images.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat

Source: C:\Windows\System32\drivers\tsusbhub.sys

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tsusbhub\Parameters\Wdf

Contains functionality to hide user accounts

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D1D508 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,GetLastError,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

Hooking and other Techniques for Hiding and Protection

Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.265818960.0000000002D24000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.265818960.0000000002D24000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: images.exe, 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: images.exe, 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: images.exe, 00000004.00000002.523109048.0000000002CF4000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: images.exe, 00000004.00000002.523109048.0000000002CF4000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType

Hides user accounts

Source: C:\ProgramData\images.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList GEAzbtF

Creates files in alternative data streams (ADS)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start

Found evasive API chain checking for user administrative privileges

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Check user administrative privileges: IsUserAndAdmin, DecisionNode

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe TID: 6364	Thread sleep count: 59 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6688	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6672	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\images.exe TID: 6520	Thread sleep count: 94 > 30
Source: C:\ProgramData\images.exe TID: 6520	Thread sleep time: -75200s >= -30000s
Source: C:\ProgramData\images.exe TID: 6704	Thread sleep count: 59 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6380	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2492	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\cmd.exe TID: 7112	Thread sleep count: 853 > 30
Source: C:\Windows\SysWOW64\cmd.exe TID: 7112	Thread sleep time: -10236000s >= -30000s

Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: OpenSCManagerW,EnumServicesStatusExW,EnumServicesStatusExW,GetLastError,CloseServiceHandle,OpenSCManagerW,lstrcmpW,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4887
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1233
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4936
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 702
Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 853

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\ProgramData\images.exe

Dropped PE file which has not been started: C:\Program Files\Microsoft DN1\sqlmap.dll

Jump to dropped file

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

File opened / queried: scsi#disk&ven_vmware&prod_virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

File opened: PHYSICALDRIVE0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D2002B GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\

Source: powershell.exe, 00000001.00000003.378873631.0000000004BFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V
Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.264261048.000000000054A000.00000040.00000001.01000000.00000003.sdmp, images.exe, 00000004.00000002.520447296.000000000054A000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: .?AVCRegistryVirtualMachine@ATL@@
Source: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.264261048.000000000054A000.00000040.00000001.01000000.00000003.sdmp, images.exe, 00000004.00000002.520447296.000000000054A000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: A.?AVCRegistryVirtualMachine@ATL@@l
Source: powershell.exe, 00000001.00000003.378873631.0000000004BFF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_0040AAE3 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0040FD34 FindFirstFileExA,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0040FE55 FindFirstFileExA,FindClose,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D1FF27 FindFirstFileW,FindNextFileW,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D19DF6 GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA,

Source: C:\Windows\System32\drivers\tsusbhub.sys

System information queried: ModuleInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_00553B50 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0040FB09 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0040C40E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D2094E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D20619 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D20620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 8_2_0326001A mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_00407269 IsDebuggerPresent,OutputDebugStringW,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_0040AAE3 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_00410931 GetProcessHeap,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\ProgramData\images.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_00407F52 SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_004079AA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_00407DBF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_0040A7A3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\ProgramData\images.exe	Memory allocated: C:\Windows\SysWOW64\cmd.exe base: 3260000 protect: page execute and read and write
Source: C:\ProgramData\images.exe	Memory allocated: C:\Windows\SysWOW64\cmd.exe base: 3280000 protect: page read and write

Creates a thread in another existing process (thread injection)

Source: C:\ProgramData\images.exe

Thread created: C:\Windows\SysWOW64\cmd.exe EIP: 326010E

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\ProgramData\images.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\ProgramData\images.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\

Writes to foreign memory regions

Source: C:\ProgramData\images.exe	Memory written: C:\Windows\SysWOW64\cmd.exe base: 3260000
Source: C:\ProgramData\images.exe	Memory written: C:\Windows\SysWOW64\cmd.exe base: 3280000

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D179E8 OpenProcess,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: 0_2_02D21FD8 RegSetValueExA,OpenProcess,GetCurrentProcessId,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, explorer.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\wbem\WMIC.exe wmic process call create '"C:\ProgramData:ApplicationData"'

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D1F56D AllocateAndInitializeSid,LookupAccountSidW,GetLastError,FreeSid,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_02D218BA InitializeSecurityDescriptor,SetSecurityDescriptorDacl,RegCreateKeyExA,RegCloseKey,SetLastError,

Source: images.exe, 00000004.00000002.524034966.00000000043EE000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.524593557.00000000047F0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: images.exe, 00000004.00000002.524034966.00000000043EE000.00000004.00000800.00020000.00000000.sdmp, images.exe, 00000004.00000002.524593557.00000000047F0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_00408024 cpuid

Source: C:\ProgramData\images.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Code function: 0_2_0040826B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: C:\ProgramData\images.exe

Code function: 4_3_02F494E0 GetVersionExW,MultiByteToWideChar,MultiByteToWideChar,_malloc,MultiByteToWideChar,_free,GetVersionExW,GetDiskFreeSpaceW,GetDiskFreeSpaceA,_free,

Lowering of HIPS / PFW / Operating System Security Settings

Increases the number of concurrent connection per server for Internet Explorer

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe

Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings MaxConnectionsPerServer 10

Stealing of Sensitive Information

Tries to steal Mail credentials (via file / registry access)

Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.720700.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.271102181.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252637221.0000000000721000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272602277.0000000000720000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271200281.000000000071F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271579326.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252535333.0000000000725000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252587569.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265818960.0000000002D24000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252517733.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.523109048.0000000002CF4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\ProgramData\images.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\images.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Contains functionality to steal e-mail passwords

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: POP3 Password
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: SMTP Password
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: IMAP Password

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: \Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	Code function: \Chromium\User Data\Default\Login Data

Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.271102181.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252637221.0000000000721000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271200281.000000000071F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271579326.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252535333.0000000000725000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252587569.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265818960.0000000002D24000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252517733.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.523109048.0000000002CF4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe PID: 6324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: images.exe PID: 6516, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.22e053f.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.720700.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.images.exe.720700.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.images.exe.2ce0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.721d18.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.271102181.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252637221.0000000000721000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.272602277.0000000000720000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271200281.000000000071F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.271579326.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252535333.0000000000725000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252587569.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.265818960.0000000002D24000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.252517733.0000000000747000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.523109048.0000000002CF4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\ProgramData\images.exe

Code function: 4_3_02F652D0 sqlite3_transfer_bindings,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	21 Windows Management Instrumentation	1 LSASS Driver	1 LSASS Driver	11 Disable or Modify Tools	3 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	21 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Endpoint Denial of Service
Default Accounts	11 Scripting	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	12 Native API	1 Create Account	1 Access Token Manipulation	11 Scripting	1 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 Service Execution	21 Windows Service	21 Windows Service	21 Obfuscated Files or Information	NTDS	4 File and Directory Discovery	Distributed Component Object Model	121 Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	2 Registry Run Keys / Startup Folder	422 Process Injection	11 Software Packing	LSA Secrets	39 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	2 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	13 Masquerading	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Application Window Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	422 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	2 Hidden Users	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 NTFS File Attributes	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	24%	ReversingLabs	Win32.Trojan.Streamer
SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files\Microsoft DN1\sqlmap.dll	100%	Avira	PUA/Remoteadmin.AR
C:\ProgramData:ApplicationData	100%	Joe Sandbox ML
C:\ProgramData\images.exe	100%	Joe Sandbox ML
C:\Program Files\Microsoft DN1\sqlmap.dll	49%	Virustotal		Browse
C:\Program Files\Microsoft DN1\sqlmap.dll	20%	Metadefender		Browse
C:\Program Files\Microsoft DN1\sqlmap.dll	50%	ReversingLabs	Win64.PUA.Presenoker
C:\ProgramData:ApplicationData	24%	ReversingLabs	Win32.Trojan.Streamer
C:\ProgramData\images.exe	24%	ReversingLabs	Win32.Trojan.Streamer

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.2d10000.3.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.732e68.2.unpack	100%	Avira	TR/Patched.Ren.Gen3	Download File
4.3.images.exe.732cb8.3.unpack	100%	Avira	TR/Patched.Ren.Gen3	Download File
0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.231053f.2.unpack	100%	Avira	TR/Patched.Ren.Gen3	Download File
4.0.images.exe.400000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.images.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.3.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.732e68.6.unpack	100%	Avira	TR/Patched.Ren.Gen3	Download File
0.0.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.images.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.3.images.exe.732cb8.7.unpack	100%	Avira	TR/Patched.Ren.Gen3	Download File
4.2.images.exe.22e053f.3.unpack	100%	Avira	TR/Patched.Ren.Gen3	Download File
4.2.images.exe.2ce0000.4.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
4.0.images.exe.400000.3.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.images.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://stascorp.comDVarFileInfo$	0%	Avira URL Cloud	safe
http://www.microsoft.	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
http://crl.microsof	0%	URL Reputation	safe
23.227.202.157	2%	Virustotal		Browse
23.227.202.157	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
23.227.202.157	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.google.com/chrome/?p=plugin_flash	images.exe, 00000004.00000002.525619079.0000000004AE0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://stascorp.comDVarFileInfo$	sqlmap.dll.4.dr	false	Avira URL Cloud: safe	low
http://www.microsoft.	powershell.exe, 00000001.00000003.342861149.0000000008D06000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.micro	powershell.exe, 00000006.00000003.407047557.00000000076DF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/syohex/java-simple-mine-sweeperC:	SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.265319225.0000000002310000.00000040.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe, 00000000.00000002.265818960.0000000002D24000.00000002.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.522785265.00000000022E0000.00000040.00001000.00020000.00000000.sdmp, images.exe, 00000004.00000002.523109048.0000000002CF4000.00000002.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000006.00000002.409620051.0000000004601000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.409298369.00000000044C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsof	powershell.exe, 00000001.00000003.377239509.00000000075FB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000003.384190535.00000000075FB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/answer/6258784	images.exe, 00000004.00000002.525619079.0000000004AE0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/syohex/java-simple-mine-sweeper	SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000006.00000002.409620051.0000000004601000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.227.202.157	unknown	United States		29802	HVC-ASUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	631792
Start date and time: 22/05/202212:32:06	2022-05-22 12:32:06 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 9s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.7507 (renamed file extension from 7507 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winEXE@18/18@0/1
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 44.8% (good quality ratio 44.4%) Quality average: 86.8% Quality standard deviation: 21.1%
HCA Information:	Successful, ratio: 94% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
TCP Packets have been reduced to 100
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target images.exe, PID 6516 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:33:15	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat
12:33:27	API Interceptor	1x Sleep call for process: WMIC.exe modified
12:33:28	API Interceptor	854x Sleep call for process: cmd.exe modified
12:33:44	API Interceptor	50x Sleep call for process: powershell.exe modified

Process:	C:\ProgramData\images.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	253693
Entropy (8bit):	5.4435816594509685
Encrypted:	false
SSDEEP:	768:NUiQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb5x8Rr/d6gl/+f8jZ0ftlFi4x7Qc:WJ33L+MoIiG4IvREWddadl/FY
MD5:	4997128EF0ECA4C4696BF4177FF3AFF5
SHA1:	7DD50F7BE34F25D580378A84B8F11A08F7EE8D1F
SHA-256:	C59A7CF7B08FA7F79C51CA9126300B32FCEECE6972A9E8837D384804FD613E24
SHA-512:	70DABDCDAE178CFB3D22EE2B00EBB747D17504864E68550256C5EE74B8D17506F88C0F057C8B91E666146B6E758C6C10EEDC123C871E2203C2BF5F67BD05EC66
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2022-02-06..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\Program Files\Microsoft DN1\sqlmap.dll

Process:	C:\ProgramData\images.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	116736
Entropy (8bit):	5.884975745255681
Encrypted:	false
SSDEEP:	3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5:	461ADE40B800AE80A40985594E1AC236
SHA1:	B3892EEF846C044A2B0785D54A432B3E93A968C8
SHA-256:	798AF20DB39280F90A1D35F2AC2C1D62124D1F5218A2A0FA29D87A13340BD3E4
SHA-512:	421F9060C4B61FA6F4074508602A2639209032FD5DF5BFC702A159E3BAD5479684CCB3F6E02F3E38FB8DB53839CF3F41FE58A3ACAD6EC1199A48DC333B2D8A26
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Virustotal, Detection: 49%, Browse Antivirus: Metadefender, Detection: 20%, Browse Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.rB/.!B/.!B/.!.~.!j/.!.~.!&/.!.~3!H/.!..'!G/.!B/.!./.!O}.!F/.!O}0!C/.!O}7!C/.!O}2!C/.!RichB/.!................PE..d...Z..T.........." .................Q....................................... ............`.........................................0...l.......<...................................................................`...p............ ...............................text............................... ..`.rdata..<.... ......................@..@.data....=..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\ProgramData:ApplicationData

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	modified
Size (bytes):	222720
Entropy (8bit):	7.862505245807072
Encrypted:	false
SSDEEP:	6144:DcsB/VWq2pmz2WGO3LPJRWE/4F0xXKk7ETkFI49Poih:DciKMoO3LDn4uxXKk7FI4d
MD5:	DABC6F0C75C134E5310BA3526ADBA833
SHA1:	854EC103A64182C97E8F25E45DA04889DBBBF3FF
SHA-256:	9F9BAE001065A649A78CE6DE997F160EF32D03A2C28F4633A8386F75C938CADF
SHA-512:	C596890BF6062890483E9EE276C890B04396C8C6C758B318AB0D218C506AE362DB32E13FAF9691B2B96D5A4EDE03EE107C5B01714AB06C86C465EBD23326E877
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Y.........................................................................................1.......Y.............Rich............PE..L...3..b.................P... ......P;.......@....@..........................`............@.................................\N.......@..\....................P..(...........................L=......l=..............................................UPX0....................................UPX1.....P.......P..................@....rsrc.... ...@.......T..............@......................................................................................................................................................................................................................................................................................................................................................................3.95.UPX!....

C:\ProgramData\images.exe

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	7.862505245807072
Encrypted:	false
SSDEEP:	6144:DcsB/VWq2pmz2WGO3LPJRWE/4F0xXKk7ETkFI49Poih:DciKMoO3LDn4uxXKk7FI4d
MD5:	DABC6F0C75C134E5310BA3526ADBA833
SHA1:	854EC103A64182C97E8F25E45DA04889DBBBF3FF
SHA-256:	9F9BAE001065A649A78CE6DE997F160EF32D03A2C28F4633A8386F75C938CADF
SHA-512:	C596890BF6062890483E9EE276C890B04396C8C6C758B318AB0D218C506AE362DB32E13FAF9691B2B96D5A4EDE03EE107C5B01714AB06C86C465EBD23326E877
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Y.........................................................................................1.......Y.............Rich............PE..L...3..b.................P... ......P;.......@....@..........................`............@.................................\N.......@..\....................P..(...........................L=......l=..............................................UPX0....................................UPX1.....P.......P..................@....rsrc.... ...@.......T..............@......................................................................................................................................................................................................................................................................................................................................................................3.95.UPX!....

C:\ProgramData\images.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	14734
Entropy (8bit):	4.993014478972177
Encrypted:	false
SSDEEP:	384:wZvOdB8Ypib4JNXp59HopbjvwRjdvRlAYotiQ0HzAF8:UvOdB8YNNZjHopbjoRjdvRlAYotinHzr
MD5:	C5A56B913DEEDCF5AE01A2D4F8AA69CE
SHA1:	C91D19BFD666FDD02B0739893833D4E1C0316511
SHA-256:	1C5C865E5A98F33E277A81FCDADFBAB1367176BA14F8590022F7E5880161C00D
SHA-512:	1058802FCD54817359F84977DD26AD4399C572910E67114F70B024EBADDF4E35E6AFF6461F90356205228B4B860E69392ABC27D38E284176C699916039CFA5ED
Malicious:	false
Preview:	PSMODULECACHE......#y;...Q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer\BitsTransfer.psd1........Start-BitsTransfer........Set-BitsTransfer........Get-BitsTransfer........Resume-BitsTransfer........Add-BitsFile........Suspend-BitsTransfer........Complete-BitsTransfer........Remove-BitsTransfer........-.^(...[...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\AppBackgroundTask\AppBackgroundTask.psd1....#...Set-AppBackgroundTaskResourcePolicy........Unregister-AppBackgroundTask........Get-AppBackgroundTask........tid........pfn........iru....%...Enable-AppBackgroundTaskDiagnosticLog........Start-AppBackgroundTask....&...Disable-AppBackgroundTaskDiagnosticLog.........w.e...a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Unregister-PackageSource........Save-Package........Install-PackageProvider........Find-PackageProvider........Install-Package........Get-PackageProvider........Get-Package........Unins

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	21524
Entropy (8bit):	5.603674470472126
Encrypted:	false
SSDEEP:	384:itL6k0H6SVTDJ0Nr+RnYSBKnaul6GspE93G1u16zx5mHKHVY37bHjqIvUI++j/:r6gJlY4KaulKwG3xU+u7Lmly
MD5:	1492AC13C2B1E111C5C1164CAC260A7A
SHA1:	E674BAB629FFA7437600288ADA10F76C318C8BE4
SHA-256:	7093EAF8B4AEF9C1537F6D8E33993183D70CB3E90820901A7253C8DC2BFF12FF
SHA-512:	910A51D461442A23171DAA166446024609123C1521FDDDAE80966295FBAA04C6564404D9BDDC9A313E8E4F26B057315A709248F5B8621039B787EDE11C826FD3
Malicious:	false
Preview:	@...e.....................K.....N....................@..........H...............<@.^.L."My...::..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)P.......System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP...............-K..s.F...]`.,j.....(.Microsoft.PowerShell.Commands.ManagementT................7.,.fiD...............Microsoft.Management.Inf

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1iuid1f.5zn.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_caqnsxdv.wy2.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oeqxrick.g20.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ujlz1kts.jjg.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\GmCssxF.tmp

Process:	C:\ProgramData\images.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	140
Entropy (8bit):	4.86129651314522
Encrypted:	false
SSDEEP:	3:QwZ2vOUrKaM6eNGRjDWXp5cViEaKC5SufyM1K/RFofD6tRQLRWLyLRHgn:QElPhxuWXp+NaZ5SuH1MUmt2FWLyS
MD5:	C2E52EDB9BA6919C7D9F3CF0B88221E2
SHA1:	9972112AF86B48E937E589E262D21BAD251A6010
SHA-256:	FAE189421B6E7CC977F1D2A69D712C97B22E810B0AE3F2F4E258E1112694C560
SHA-512:	FDDEDA3E5D597D086B9C4412621078B3D14B6624DF2B003CA3238E3BD03DE35AAF3E16F04339AC54B04A723F98E76F17D74263F7D1CCBCA92B6FD2C325014B3B
Malicious:	true
Preview:	for /F "usebackq tokens=*" %%A in ("C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start") do %%A

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Gen.Variant.Lazy.175154.8129.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.2659637614761765
Encrypted:	false
SSDEEP:	3:eGAjGJwbZkREfcjMGERMQhM:ZuGJwi8cwGj
MD5:	579E29CEC6BDE04C5C074D8311D6B884
SHA1:	2FDFD4C6B8EB43A4C6F4C0D3998E4A5364221DFF
SHA-256:	65138897F467ADF9FE20594326D724D2CD5B437D9AACF5F83721AF340F70CE3C
SHA-512:	4011A9FD58C1DC8AA3ED79589D7232BBD06EB3FB32513D3C5B59B740ED89FDC9CCC9F3291812AFFF2CD679820BCD940AE3A49E41EBCBE20413821ACAD7C5191D
Malicious:	true
Preview:	wmic process call create '"C:\ProgramData:ApplicationData"'

C:\Users\user\AppData\Roaming\pBlACIg.tmp

Process:	C:\ProgramData\images.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	87165
Entropy (8bit):	6.102565506017432
Encrypted:	false
SSDEEP:	1536:S9sfGRcZdJiXrXafIyYOetKdapZsyTwL3cDGOLN0nTwY/A3iuR+:SsfFcbXafIB0u1GOJmA3iuR+
MD5:	CC02ABB348037609ED09EC9157D55234
SHA1:	32411A59960ECF4D7434232194A5B3DB55817647
SHA-256:	62E0236494260F5C9FFF1C4DBF1A57C66B28A5ABE1ACF21B26D08235C735C7D8
SHA-512:	AC95705ED369D82B65200354E10875F6AD5EBC4E0F9FFC61AE6C45C32410B6F55D4C47B219BA4722B6E15C34AC57F91270581DB0A391711D70AF376170DE2A35
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.601478090199719e+12,"network":1.601453434e+12,"ticks":826153657.0,"uncertainty":4457158.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABL95WKt94zTZq03WydzHLcAAAAAAIAAAAAABBmAAAAAQAAIAAAABAL2tyan+lsWtxhoUVdUYrYiwg8iJkppNr2ZbBFie9UAAAAAA6AAAAAAgAAIAAAABDv4gjLq1dOS7lkRG21YVXojnHhsRhNbP8/D1zs78mXMAAAAB045Od5v4BxiFP4bdRYJjDXn4W2fxYqQj2xfYeAnS1vCL4JXAsdfljw4oXIE4R7l0AAAABlt36FqChftM9b7EtaPw98XRX5Y944rq1WsGWcOPFyXOajfBL3GXBUhMXghJbDGb5WCu+JEdxaxLLxaYPp4zeP"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245951016607996"},"plugins":{"metadata":{"adobe-flash-player":{"disp

C:\Users\user\Documents\20220522\PowerShell_transcript.301389.NKMfFw_y.20220522123330.txt

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5048
Entropy (8bit):	5.391537877355324
Encrypted:	false
SSDEEP:	96:BZEh2N58qDo1ZiZDh2N58qDo1ZgM6UjZ1h2N58qDo1ZVFEEdZW:N8vd
MD5:	6845E5380ACF1B628551D90AE54909EF
SHA1:	B9C3A195360C41016D305960471481CA9DA3E94C
SHA-256:	3DEDBC9EE9E3D116C54885B6DBA56C67ACB7442EDD6DEFE55C5FF1B497D33E0C
SHA-512:	D9D9828E9A3426342ECAA3F9D2E4938DFC939B66BE9FDF358C4D5B0083AAFCE00729CE5160C9839E06F071C8DC459F01E14F5EFD01218A57EDA917CD9CB4DF5F
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220522123355..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 301389 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell Add-MpPreference -ExclusionPath C:\..Process ID: 6732..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220522123356..******************..PS>Add-MpPreference -ExclusionPath C:\..********************..Windows PowerShell transcript start..Start time: 20220522123738..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 301389 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell Add-MpPreference -Exclus

C:\Users\user\Documents\20220522\PowerShell_transcript.301389.c9F2HF06.20220522123314.txt

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5048
Entropy (8bit):	5.393687137718255
Encrypted:	false
SSDEEP:	96:BZ9h2N5dqDo1ZEZ6h2N5dqDo1ZQM6UjZoh2N5dqDo1ZFFEERZo:OINQ
MD5:	CD40D7F27D7F40B312A0A16DBE7ACE72
SHA1:	A66F76313958430BF10322D8428A43ACE8DDBF4E
SHA-256:	C0A23C24DF8C9D780BD4D84A63AA4AD9AB61C416349B1E4A8F76087EE294A06A
SHA-512:	A3920F40E3708648D47162DD70C400F2990150E68B4DBD7BFBCFAF95FDFC89D378FB479982EFBBAC9BE02E3E16D7C689569F831AC04F7E970FB64933C4DA7BF2
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220522123336..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 301389 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell Add-MpPreference -ExclusionPath C:\..Process ID: 6368..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220522123336..******************..PS>Add-MpPreference -ExclusionPath C:\..********************..Windows PowerShell transcript start..Start time: 20220522123656..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 301389 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell Add-MpPreference -Exclus

\Device\ConDrv