Windows Analysis Report
Omics_Journal.one

Overview

General Information

Sample Name: Omics_Journal.one
Analysis ID: 828489
MD5: 5e5f9e4e0a1fa534737476dacbe48348
SHA1: 3554b122b5796893b8cd05b2dce61733a2ec5f81
SHA256: 2b8a0bac5cb3d9991acf3b66fdbb60cf0fcfe7fc4bc783ad011315bed88c1221
Tags: one
Infos:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Malicious OneNote
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Sigma detected: Run temp file via regsvr32
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Stores files to the Windows start menu directory
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Connects to several IPs in different countries
Creates a start menu entry (Start Menu\Programs\Startup)
Registers a DLL
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Omics_Journal.one ReversingLabs: Detection: 30%
Source: Omics_Journal.one Virustotal: Detection: 38% Perma Link
Antivirus detection for URL or domain
Source: https://163.44.196.120:8080/icy Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/252 Avira URL Cloud: Label: malware
Source: https://159.89.202.34/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/j Avira URL Cloud: Label: malware
Source: https://182.162.143.56/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/ Avira URL Cloud: Label: malware
Source: https://159.89.202.34/ Avira URL Cloud: Label: malware
Source: http://softwareulike.com/cWIYxWMPkK/ Avira URL Cloud: Label: malware
Source: https://164.90.222.65/V Avira URL Cloud: Label: malware
Source: https://163.44.196.120:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/ Avira URL Cloud: Label: malware
Source: https://www.gomespontes.com.br/logs/pd/w39558 Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/ Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/ Avira URL Cloud: Label: malware
Source: https://163.44.196.120:8080/ Avira URL Cloud: Label: malware
Source: https://182.162.143.56/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/- Avira URL Cloud: Label: malware
Source: https://163.44.196.120:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/W Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/ Avira URL Cloud: Label: malware
Source: https://www.gomespontes.com.br/logs/pd/vM Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/ Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/.dll Avira URL Cloud: Label: malware
Source: https://163.44.196.120:8080/l Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/ocal Avira URL Cloud: Label: malware
Source: http://ozmeydan.com/cekici/9/ Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/Y Avira URL Cloud: Label: malware
Source: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/wM Avira URL Cloud: Label: malware
Source: https://www.gomespontes.com.br/logs/pd/ Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/ Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/tM Avira URL Cloud: Label: malware
Source: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/t( Avira URL Cloud: Label: malware
Source: http://softwareulike.com/cWIYxWMPkK/# Avira URL Cloud: Label: malware
Source: https://159.89.202.34/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/ Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/uM Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/ Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/8j~ Avira URL Cloud: Label: malware
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/ Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/# Avira URL Cloud: Label: malware
Source: https://187.63.160.88:80/ Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/ Avira URL Cloud: Label: malware
Source: http://softwareulike.com/cWIYxWMPkK/yM Avira URL Cloud: Label: malware
Source: https://163.44.196.120:8080/d/ Avira URL Cloud: Label: malware
Source: https://164.90.222.65/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/ Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6H Avira URL Cloud: Label: malware
Source: http://ozmeydan.com/cekici/9/xM Avira URL Cloud: Label: malware
Source: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/ Avira URL Cloud: Label: malware
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/zM Avira URL Cloud: Label: malware
Source: https://penshorn.org:443/admin/Ses8712iGR8du/ Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd//W Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: penshorn.org Virustotal: Detection: 10% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\radDBEC2.tmp.dll ReversingLabs: Detection: 58%
Source: C:\Windows\System32\BPVAiawSvOgA\ayfcXidefIAOQYvB.dll (copy) ReversingLabs: Detection: 58%
Source: 0000000D.00000002.575109480.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Emotet {"C2 list": ["91.121.146.47:8080", "66.228.32.31:7080", "182.162.143.56:443", "187.63.160.88:80", "167.172.199.165:8080", "164.90.222.65:443", "104.168.155.143:8080", "163.44.196.120:8080", "160.16.142.56:8080", "159.89.202.34:443", "159.65.88.10:8080", "186.194.240.217:443", "149.56.131.28:8080", "72.15.201.15:8080", "1.234.2.232:8080", "82.223.21.224:8080", "206.189.28.199:8080", "169.57.156.166:8080", "107.170.39.149:8080", "103.43.75.120:443", "91.207.28.33:8080", "213.239.212.5:443", "45.235.8.30:8080", "119.59.103.152:8080", "164.68.99.3:8080", "95.217.221.146:8080", "153.126.146.25:7080", "197.242.150.244:8080", "202.129.205.3:8080", "103.132.242.26:8080", "139.59.126.41:443", "110.232.117.186:8080", "183.111.227.137:8080", "5.135.159.50:443", "201.94.166.162:443", "103.75.201.2:443", "79.137.35.198:8080", "172.105.226.75:8080", "94.23.45.86:4143", "115.68.227.76:8080", "153.92.5.27:8080", "167.172.253.162:8080", "188.44.20.25:443", "147.139.166.154:8080", "129.232.188.93:443", "173.212.193.249:8080", "185.4.135.165:8080", "45.176.232.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5N2pBrwAGAIg=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2BGpSrwAJAIg="]}
Source: unknown HTTPS traffic detected: 203.26.41.131:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180008D28 FindFirstFileExW, 12_2_0000000180008D28

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Windows\SysWOW64\wscript.exe

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.65.88.10 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 164.90.222.65 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 203.26.41.131 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Domain query: penshorn.org
Source: C:\Windows\System32\regsvr32.exe Network Connect: 66.228.32.31 7080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 187.63.160.88 80 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 104.168.155.143 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.89.202.34 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 91.121.146.47 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 160.16.142.56 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 182.162.143.56 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 167.172.199.165 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 163.44.196.120 8080 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2404312 ET CNC Feodo Tracker Reported CnC Server TCP group 7 192.168.2.7:49705 -> 182.162.143.56:443
Source: Traffic Snort IDS: 2404344 ET CNC Feodo Tracker Reported CnC Server TCP group 23 192.168.2.7:49702 -> 91.121.146.47:8080
Source: Traffic Snort IDS: 2404330 ET CNC Feodo Tracker Reported CnC Server TCP group 16 192.168.2.7:49704 -> 66.228.32.31:7080
Source: Traffic Snort IDS: 2404308 ET CNC Feodo Tracker Reported CnC Server TCP group 5 192.168.2.7:49707 -> 167.172.199.165:8080
Source: Traffic Snort IDS: 2404302 ET CNC Feodo Tracker Reported CnC Server TCP group 2 192.168.2.7:49712 -> 104.168.155.143:8080
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 91.121.146.47:8080
Source: Malware configuration extractor IPs: 66.228.32.31:7080
Source: Malware configuration extractor IPs: 182.162.143.56:443
Source: Malware configuration extractor IPs: 187.63.160.88:80
Source: Malware configuration extractor IPs: 167.172.199.165:8080
Source: Malware configuration extractor IPs: 164.90.222.65:443
Source: Malware configuration extractor IPs: 104.168.155.143:8080
Source: Malware configuration extractor IPs: 163.44.196.120:8080
Source: Malware configuration extractor IPs: 160.16.142.56:8080
Source: Malware configuration extractor IPs: 159.89.202.34:443
Source: Malware configuration extractor IPs: 159.65.88.10:8080
Source: Malware configuration extractor IPs: 186.194.240.217:443
Source: Malware configuration extractor IPs: 149.56.131.28:8080
Source: Malware configuration extractor IPs: 72.15.201.15:8080
Source: Malware configuration extractor IPs: 1.234.2.232:8080
Source: Malware configuration extractor IPs: 82.223.21.224:8080
Source: Malware configuration extractor IPs: 206.189.28.199:8080
Source: Malware configuration extractor IPs: 169.57.156.166:8080
Source: Malware configuration extractor IPs: 107.170.39.149:8080
Source: Malware configuration extractor IPs: 103.43.75.120:443
Source: Malware configuration extractor IPs: 91.207.28.33:8080
Source: Malware configuration extractor IPs: 213.239.212.5:443
Source: Malware configuration extractor IPs: 45.235.8.30:8080
Source: Malware configuration extractor IPs: 119.59.103.152:8080
Source: Malware configuration extractor IPs: 164.68.99.3:8080
Source: Malware configuration extractor IPs: 95.217.221.146:8080
Source: Malware configuration extractor IPs: 153.126.146.25:7080
Source: Malware configuration extractor IPs: 197.242.150.244:8080
Source: Malware configuration extractor IPs: 202.129.205.3:8080
Source: Malware configuration extractor IPs: 103.132.242.26:8080
Source: Malware configuration extractor IPs: 139.59.126.41:443
Source: Malware configuration extractor IPs: 110.232.117.186:8080
Source: Malware configuration extractor IPs: 183.111.227.137:8080
Source: Malware configuration extractor IPs: 5.135.159.50:443
Source: Malware configuration extractor IPs: 201.94.166.162:443
Source: Malware configuration extractor IPs: 103.75.201.2:443
Source: Malware configuration extractor IPs: 79.137.35.198:8080
Source: Malware configuration extractor IPs: 172.105.226.75:8080
Source: Malware configuration extractor IPs: 94.23.45.86:4143
Source: Malware configuration extractor IPs: 115.68.227.76:8080
Source: Malware configuration extractor IPs: 153.92.5.27:8080
Source: Malware configuration extractor IPs: 167.172.253.162:8080
Source: Malware configuration extractor IPs: 188.44.20.25:443
Source: Malware configuration extractor IPs: 147.139.166.154:8080
Source: Malware configuration extractor IPs: 129.232.188.93:443
Source: Malware configuration extractor IPs: 173.212.193.249:8080
Source: Malware configuration extractor IPs: 185.4.135.165:8080
Source: Malware configuration extractor IPs: 45.176.232.124:443
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: RACKCORP-APRackCorpAU RACKCORP-APRackCorpAU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /rrjjbae/nhkurfvvppt/cnws/lotgiwvd/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 182.162.143.56
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 110.232.117.186 110.232.117.186
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /admin/Ses8712iGR8du/ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: penshorn.org
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49702 -> 91.121.146.47:8080
Source: global traffic TCP traffic: 192.168.2.7:49704 -> 66.228.32.31:7080
Source: global traffic TCP traffic: 192.168.2.7:49707 -> 167.172.199.165:8080
Source: global traffic TCP traffic: 192.168.2.7:49712 -> 104.168.155.143:8080
Source: global traffic TCP traffic: 192.168.2.7:49713 -> 163.44.196.120:8080
Source: global traffic TCP traffic: 192.168.2.7:49714 -> 160.16.142.56:8080
Source: global traffic TCP traffic: 192.168.2.7:49719 -> 159.65.88.10:8080
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 18
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: wscript.exe, 0000000A.00000003.356861744.0000000005377000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355424100.0000000005375000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.0000000005373000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359815791.0000000005378000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.418481837.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.551101008.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.547991280.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000D77000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 0000000D.00000002.575459710.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.418409086.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.417628495.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.547991280.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.550924036.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 0000000D.00000003.418481837.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.418225796.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.551101008.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.547991280.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.13.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 0000000D.00000003.413703684.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b9b440af02a2a
Source: wscript.exe, wscript.exe, 0000000A.00000003.347190593.000000000502C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.000000000532E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350575373.000000000509F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339320074.0000000004E6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343897480.0000000004FA4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343274627.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352934278.00000000052A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359696646.0000000005319000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338988190.0000000004E63000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004E9E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352849452.00000000052BE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344462453.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352675846.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.356687723.00000000051B3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339307814.0000000004E75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349138569.0000000004FFE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352578097.0000000005285000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337736071.0000000004E34000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.336058236.00000000029F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ozmeydan.com/cekici/9/
Source: wscript.exe, 0000000A.00000003.354752854.0000000004B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ozmeydan.com/cekici/9/xM
Source: wscript.exe, wscript.exe, 0000000A.00000003.347190593.000000000502C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.000000000532E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350575373.000000000509F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339320074.0000000004E6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343897480.0000000004FA4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343274627.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352934278.00000000052A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359696646.0000000005319000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338988190.0000000004E63000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004E9E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352849452.00000000052BE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344462453.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352675846.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.356687723.00000000051B3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339307814.0000000004E75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349138569.0000000004FFE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352578097.0000000005285000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337736071.0000000004E34000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.336058236.00000000029F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://softwareulike.com/cWIYxWMPkK/
Source: wscript.exe, 0000000A.00000003.356737849.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359464472.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.351655555.00000000051E3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.357187163.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352375138.0000000005230000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352221230.0000000005222000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.351807181.000000000520B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://softwareulike.com/cWIYxWMPkK/#
Source: wscript.exe, 0000000A.00000003.354752854.0000000004B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://softwareulike.com/cWIYxWMPkK/yM
Source: wscript.exe, wscript.exe, 0000000A.00000003.347190593.000000000502C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.000000000532E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350575373.000000000509F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339320074.0000000004E6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343897480.0000000004FA4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343274627.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352934278.00000000052A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359696646.0000000005319000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338988190.0000000004E63000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004E9E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352849452.00000000052BE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344462453.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352675846.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.356687723.00000000051B3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339307814.0000000004E75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349138569.0000000004FFE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352578097.0000000005285000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337736071.0000000004E34000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.336058236.00000000029F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/
Source: wscript.exe, 0000000A.00000003.354752854.0000000004B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/zM
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.
Source: regsvr32.exe, 0000000D.00000002.575459710.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.547991280.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.550924036.0000000000D3B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://103.44.196.120:8080/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://104.168.155.143:8080/
Source: regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/
Source: regsvr32.exe, 0000000D.00000002.575459710.0000000000D71000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/
Source: regsvr32.exe, 0000000D.00000002.575459710.0000000000D77000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/#
Source: regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd//W
Source: regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.89.202.34/
Source: regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.89.202.34/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/
Source: regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.89.202.34/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/j
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.142.56:8080/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.142.56:8080/8
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000D71000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.551101008.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.547991280.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.142.56:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/d/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/icy
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/l
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/W
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://164.90.222.65/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://164.90.222.65/V
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://164.90.222.65/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://167.172.199.165:8080/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://167.172.199.165:8080/Y
Source: regsvr32.exe, 0000000D.00000002.576555848.0000000002E0B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://169.65.88.10:8080/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/-
Source: regsvr32.exe, 0000000D.00000003.551101008.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000DC1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://187.63.160.88:80/
Source: regsvr32.exe, 0000000D.00000002.575109480.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://91.121.146.47:8080/
Source: regsvr32.exe, 0000000D.00000003.418225796.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575109480.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://91.121.146.47:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/
Source: regsvr32.exe, 0000000D.00000002.575109480.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://91.121.146.47:8080/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/8j~
Source: wscript.exe, 0000000A.00000002.359523734.000000000525F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6H
Source: wscript.exe, wscript.exe, 0000000A.00000003.347190593.000000000502C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.000000000532E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350575373.000000000509F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339320074.0000000004E6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343897480.0000000004FA4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343274627.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352934278.00000000052A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359696646.0000000005319000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338988190.0000000004E63000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004E9E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352849452.00000000052BE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344462453.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352675846.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.356687723.00000000051B3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339307814.0000000004E75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349138569.0000000004FFE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352578097.0000000005285000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337736071.0000000004E34000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.336058236.00000000029F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/
Source: wscript.exe, 0000000A.00000003.335995742.00000000050EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/.dll
Source: wscript.exe, 0000000A.00000003.354752854.0000000004B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/uM
Source: wscript.exe, 0000000A.00000003.357036755.0000000005363000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.0000000005344000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.0000000005363000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359782022.0000000005363000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355577672.000000000534F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359765538.0000000005350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/
Source: wscript.exe, wscript.exe, 0000000A.00000003.347190593.000000000502C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.000000000532E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350575373.000000000509F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339320074.0000000004E6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343897480.0000000004FA4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343274627.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352934278.00000000052A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359696646.0000000005319000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338988190.0000000004E63000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004E9E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352849452.00000000052BE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344462453.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352675846.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.356687723.00000000051B3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.356214229.0000000004B04000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339307814.0000000004E75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349138569.0000000004FFE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352578097.0000000005285000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337736071.0000000004E34000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/
Source: wscript.exe, 0000000A.00000003.354031092.00000000052F8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353626691.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355411882.000000000531B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359708281.0000000005323000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.354147169.000000000530A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/252
Source: wscript.exe, 0000000A.00000003.355096801.0000000005344000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359716807.0000000005344000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/ocal
Source: wscript.exe, 0000000A.00000003.354752854.0000000004B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/tM
Source: wscript.exe, 0000000A.00000003.355096801.0000000005344000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359716807.0000000005344000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org:443/admin/Ses8712iGR8du/
Source: wscript.exe, wscript.exe, 0000000A.00000003.347190593.000000000502C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.000000000532E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350575373.000000000509F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339320074.0000000004E6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343897480.0000000004FA4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343274627.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352934278.00000000052A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359696646.0000000005319000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338988190.0000000004E63000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004E9E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352849452.00000000052BE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344462453.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352675846.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.356687723.00000000051B3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339307814.0000000004E75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349138569.0000000004FFE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352578097.0000000005285000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337736071.0000000004E34000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.336058236.00000000029F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/
Source: wscript.exe, 0000000A.00000003.353626691.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.354592807.00000000052EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/t(
Source: wscript.exe, 0000000A.00000003.354752854.0000000004B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/wM
Source: wscript.exe, wscript.exe, 0000000A.00000003.347190593.000000000502C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.000000000532E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350575373.000000000509F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339320074.0000000004E6F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343897480.0000000004FA4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.343274627.0000000004EDD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352934278.00000000052A3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359696646.0000000005319000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338988190.0000000004E63000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340504481.0000000004E9E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352849452.00000000052BE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.344462453.0000000004F51000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352675846.00000000052A2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.356687723.00000000051B3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.339307814.0000000004E75000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349138569.0000000004FFE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352578097.0000000005285000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337736071.0000000004E34000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.336058236.00000000029F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gomespontes.com.br/logs/pd/
Source: wscript.exe, 0000000A.00000003.354752854.0000000004B24000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gomespontes.com.br/logs/pd/vM
Source: wscript.exe, 0000000A.00000003.354031092.00000000052F8000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353626691.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355411882.000000000531B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359708281.0000000005323000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.354147169.000000000530A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gomespontes.com.br/logs/pd/w39558
Source: unknown HTTP traffic detected: POST /rrjjbae/nhkurfvvppt/cnws/lotgiwvd/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 182.162.143.56
Source: unknown DNS traffic detected: queries for: penshorn.org
Source: global traffic HTTP traffic detected: GET /admin/Ses8712iGR8du/ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: penshorn.org
Source: unknown HTTPS traffic detected: 203.26.41.131:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.7:49705 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected Emotet
Source: Yara match File source: 0000000D.00000002.575109480.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 13.2.regsvr32.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.regsvr32.exe.de0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.9a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.333419245.00000000009D1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.576245215.0000000000DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.333370577.00000000009A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.576339106.0000000000E21000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Yara signature match
Source: 0000000A.00000003.352934278.00000000052A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000002.359372345.00000000050EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000002.359372345.00000000050EB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.352578097.0000000005274000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.335995742.00000000050EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.335995742.00000000050EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000002.359559386.000000000527C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Creates files inside the system directory
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\system32\BPVAiawSvOgA\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180006818 12_2_0000000180006818
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_000000018000B878 12_2_000000018000B878
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180007110 12_2_0000000180007110
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180008D28 12_2_0000000180008D28
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180014555 12_2_0000000180014555
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00990000 12_2_00990000
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E709C 12_2_009E709C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DCC14 12_2_009DCC14
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EA000 12_2_009EA000
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D7D6C 12_2_009D7D6C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D263C 12_2_009D263C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D8BC8 12_2_009D8BC8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E8FC8 12_2_009E8FC8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DAC94 12_2_009DAC94
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D4C84 12_2_009D4C84
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009ECC84 12_2_009ECC84
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E5880 12_2_009E5880
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009F94BC 12_2_009F94BC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DDCB8 12_2_009DDCB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EA8B0 12_2_009EA8B0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D98AC 12_2_009D98AC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D18DC 12_2_009D18DC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D14D4 12_2_009D14D4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E3CD4 12_2_009E3CD4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D80CC 12_2_009D80CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E08CC 12_2_009E08CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DF8C4 12_2_009DF8C4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E5CC4 12_2_009E5CC4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D48FC 12_2_009D48FC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D90F8 12_2_009D90F8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D3CF4 12_2_009D3CF4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E20E0 12_2_009E20E0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009F181C 12_2_009F181C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D9408 12_2_009D9408
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D7C08 12_2_009D7C08
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D1000 12_2_009D1000
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DB83C 12_2_009DB83C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E1030 12_2_009E1030
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EEC30 12_2_009EEC30
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EC058 12_2_009EC058
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009F5450 12_2_009F5450
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EC44C 12_2_009EC44C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D7840 12_2_009D7840
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DB07C 12_2_009DB07C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D2C78 12_2_009D2C78
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DC078 12_2_009DC078
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DD474 12_2_009DD474
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E6C70 12_2_009E6C70
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EB460 12_2_009EB460
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D95BC 12_2_009D95BC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EBDA0 12_2_009EBDA0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E15C8 12_2_009E15C8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009ED5F0 12_2_009ED5F0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E7518 12_2_009E7518
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009F9910 12_2_009F9910
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E610C 12_2_009E610C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009F8500 12_2_009F8500
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D6138 12_2_009D6138
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D7530 12_2_009D7530
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EB130 12_2_009EB130
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EAD28 12_2_009EAD28
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E1924 12_2_009E1924
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E4D20 12_2_009E4D20
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DBE90 12_2_009DBE90
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E4A90 12_2_009E4A90
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D8A8C 12_2_009D8A8C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009F4E8C 12_2_009F4E8C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D3ABC 12_2_009D3ABC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EA6BC 12_2_009EA6BC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DAAB8 12_2_009DAAB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D4EB8 12_2_009D4EB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E96D4 12_2_009E96D4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DD6CC 12_2_009DD6CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EEAC0 12_2_009EEAC0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D92F0 12_2_009D92F0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D461C 12_2_009D461C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D4214 12_2_009D4214
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D3E0C 12_2_009D3E0C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E020C 12_2_009E020C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E8E08 12_2_009E8E08
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E5A00 12_2_009E5A00
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009F8A00 12_2_009F8A00
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DBA2C 12_2_009DBA2C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E8A2C 12_2_009E8A2C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E0E2C 12_2_009E0E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E662C 12_2_009E662C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DF65C 12_2_009DF65C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DB258 12_2_009DB258
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EA244 12_2_009EA244
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D3274 12_2_009D3274
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E0A70 12_2_009E0A70
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DA660 12_2_009DA660
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D1B94 12_2_009D1B94
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E5384 12_2_009E5384
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DFFB8 12_2_009DFFB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E8BB8 12_2_009E8BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D8FB0 12_2_009D8FB0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DDBA0 12_2_009DDBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D2FD4 12_2_009D2FD4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D33D4 12_2_009D33D4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E3FD0 12_2_009E3FD0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E97CC 12_2_009E97CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DA7F0 12_2_009DA7F0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009F27EC 12_2_009F27EC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E4F18 12_2_009E4F18
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DEF14 12_2_009DEF14
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E3B14 12_2_009E3B14
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EE310 12_2_009EE310
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DD33C 12_2_009DD33C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D975C 12_2_009D975C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D4758 12_2_009D4758
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EE750 12_2_009EE750
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DF77C 12_2_009DF77C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D8378 12_2_009D8378
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009ED770 12_2_009ED770
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009ECF70 12_2_009ECF70
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_009F0000 13_2_009F0000
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E308CC 13_2_00E308CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2640A 13_2_00E2640A
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2CC14 13_2_00E2CC14
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E27D6C 13_2_00E27D6C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E26E42 13_2_00E26E42
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E40618 13_2_00E40618
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E263F4 13_2_00E263F4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E28BC8 13_2_00E28BC8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E38FC8 13_2_00E38FC8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E33FD0 13_2_00E33FD0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E473A4 13_2_00E473A4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E29B79 13_2_00E29B79
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E320E0 13_2_00E320E0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E23CF4 13_2_00E23CF4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E290F8 13_2_00E290F8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E248FC 13_2_00E248FC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2F8C4 13_2_00E2F8C4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E35CC4 13_2_00E35CC4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E280CC 13_2_00E280CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E41CD4 13_2_00E41CD4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E214D4 13_2_00E214D4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E33CD4 13_2_00E33CD4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E218DC 13_2_00E218DC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E444A8 13_2_00E444A8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E298AC 13_2_00E298AC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3A8B0 13_2_00E3A8B0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E494BC 13_2_00E494BC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2DCB8 13_2_00E2DCB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E35880 13_2_00E35880
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E24C84 13_2_00E24C84
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3CC84 13_2_00E3CC84
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E4488C 13_2_00E4488C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E41494 13_2_00E41494
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2AC94 13_2_00E2AC94
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3709C 13_2_00E3709C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3B460 13_2_00E3B460
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E45868 13_2_00E45868
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E36C70 13_2_00E36C70
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2D474 13_2_00E2D474
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E22C78 13_2_00E22C78
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2C078 13_2_00E2C078
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2B07C 13_2_00E2B07C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E27840 13_2_00E27840
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3C44C 13_2_00E3C44C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E45450 13_2_00E45450
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3C058 13_2_00E3C058
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E31030 13_2_00E31030
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3EC30 13_2_00E3EC30
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2B83C 13_2_00E2B83C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E21000 13_2_00E21000
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3A000 13_2_00E3A000
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E29408 13_2_00E29408
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E27C08 13_2_00E27C08
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E27410 13_2_00E27410
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E4181C 13_2_00E4181C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3D5F0 13_2_00E3D5F0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E315C8 13_2_00E315C8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3BDA0 13_2_00E3BDA0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E295BC 13_2_00E295BC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E44D64 13_2_00E44D64
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E34D20 13_2_00E34D20
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E31924 13_2_00E31924
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3AD28 13_2_00E3AD28
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3B130 13_2_00E3B130
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E26138 13_2_00E26138
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E48500 13_2_00E48500
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E42100 13_2_00E42100
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3610C 13_2_00E3610C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E49910 13_2_00E49910
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E37518 13_2_00E37518
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E292F0 13_2_00E292F0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E436FC 13_2_00E436FC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3EAC0 13_2_00E3EAC0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2D6CC 13_2_00E2D6CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E396D4 13_2_00E396D4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E42AB0 13_2_00E42AB0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2AAB8 13_2_00E2AAB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E24EB8 13_2_00E24EB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E37EBE 13_2_00E37EBE
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E23ABC 13_2_00E23ABC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3A6BC 13_2_00E3A6BC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E42E84 13_2_00E42E84
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E44E8C 13_2_00E44E8C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E28A8C 13_2_00E28A8C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2BE90 13_2_00E2BE90
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E34A90 13_2_00E34A90
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2A660 13_2_00E2A660
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E30A70 13_2_00E30A70
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E23274 13_2_00E23274
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3A244 13_2_00E3A244
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E46E48 13_2_00E46E48
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2B258 13_2_00E2B258
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2F65C 13_2_00E2F65C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2BA2C 13_2_00E2BA2C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E38A2C 13_2_00E38A2C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E30E2C 13_2_00E30E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3662C 13_2_00E3662C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2263C 13_2_00E2263C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E35A00 13_2_00E35A00
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E48A00 13_2_00E48A00
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E38E08 13_2_00E38E08
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E23E0C 13_2_00E23E0C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3020C 13_2_00E3020C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E24214 13_2_00E24214
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2461C 13_2_00E2461C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E427EC 13_2_00E427EC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2A7F0 13_2_00E2A7F0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3FFFC 13_2_00E3FFFC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E397CC 13_2_00E397CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E22FD4 13_2_00E22FD4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E233D4 13_2_00E233D4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2DBA0 13_2_00E2DBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E447A8 13_2_00E447A8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E28FB0 13_2_00E28FB0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2FFB8 13_2_00E2FFB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E38BB8 13_2_00E38BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E35384 13_2_00E35384
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E21B94 13_2_00E21B94
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3779A 13_2_00E3779A
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E48B68 13_2_00E48B68
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3D770 13_2_00E3D770
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3CF70 13_2_00E3CF70
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E28378 13_2_00E28378
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2F77C 13_2_00E2F77C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3E750 13_2_00E3E750
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E24758 13_2_00E24758
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2975C 13_2_00E2975C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2D33C 13_2_00E2D33C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3E310 13_2_00E3E310
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E48310 13_2_00E48310
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E2EF14 13_2_00E2EF14
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E33B14 13_2_00E33B14
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E45B1C 13_2_00E45B1C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E34F18 13_2_00E34F18
Contains functionality to call native functions
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory, 12_2_0000000180010C10
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010AC0 ExitProcess,RtlQueueApcWow64Thread,NtTestAlert, 12_2_0000000180010AC0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010DB0 ZwOpenSymbolicLinkObject,ZwOpenSymbolicLinkObject, 12_2_0000000180010DB0
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\radDBEC2.tmp.dll 2F39C2879989DDD7F9ECF52B6232598E5595F8BF367846FF188C9DFBF1251253
Source: Omics_Journal.one ReversingLabs: Detection: 30%
Source: Omics_Journal.one Virustotal: Detection: 38%
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE" "C:\Users\user\Desktop\Omics_Journal.one
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\radDBEC2.tmp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Users\user\AppData\Local\Temp\radDBEC2.tmp.dll"
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BPVAiawSvOgA\ayfcXidefIAOQYvB.dll"
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE /tsr
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE "C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE" /tsr
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf" Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE /tsr Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\radDBEC2.tmp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Users\user\AppData\Local\Temp\radDBEC2.tmp.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BPVAiawSvOgA\ayfcXidefIAOQYvB.dll" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32 Jump to behavior
Source: Send to OneNote.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user\Documents\{D9851E0B-2C85-4572-9AE5-F7072819B6A0} Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user~1\AppData\Local\Temp\{CB386D8B-5AD0-4126-AEE0-ECF7F4D76FDA} - OProcSessId.dat Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winONE@12/693@1/50
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File read: C:\Program Files (x86)\desktop.ini Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D8BC8 Process32NextW,Process32FirstW,CreateToolhelp32Snapshot,FindCloseChangeNotification, 12_2_009D8BC8
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE Mutant created: \Sessions\1\BaseNamedObjects\OneNoteM:AppShared
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180005C69 push rdi; ret 12_2_0000000180005C72
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800056DD push rdi; ret 12_2_00000001800056E4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D6C9F pushad ; ret 12_2_009D6CAA
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D6CDE push esi; iretd 12_2_009D6CDF
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E80D7 push ebp; retf 12_2_009E80D8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DA0FC push ebp; iretd 12_2_009DA0FD
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E7987 push ebp; iretd 12_2_009E798F
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DA1D2 push ebp; iretd 12_2_009DA1D3
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E7D3C push ebp; retf 12_2_009E7D3D
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E7D25 push 4D8BFFFFh; retf 12_2_009E7D2A
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E8157 push ebp; retf 12_2_009E8158
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D9D51 push ebp; retf 12_2_009D9D5A
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E7D4E push ebp; iretd 12_2_009E7D4F
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009D9E8B push eax; retf 12_2_009D9E8E
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009E7EAF push 458BCC5Ah; retf 12_2_009E7EBC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009DA26E push ebp; ret 12_2_009DA26F
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_009EC731 push esi; iretd 12_2_009EC732
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E26CDE push esi; iretd 13_2_00E26CDF
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E26C9F pushad ; ret 13_2_00E26CAA
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E37D4E push ebp; iretd 13_2_00E37D4F
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E37D25 push 4D8BFFFFh; retf 13_2_00E37D2A
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E46D34 push edi; ret 13_2_00E46D36
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E37D3C push ebp; retf 13_2_00E37D3D
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E37EAF push 458BCC5Ah; retf 13_2_00E37EBC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_00E3C731 push esi; iretd 13_2_00E3C732
PE file contains sections with non-standard names
Source: radDBEC2.tmp.dll.10.dr Static PE information: section name: _RDATA
Registers a DLL
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\radDBEC2.tmp.dll
Drops PE files
Source: C:\Windows\SysWOW64\wscript.exe File created: C:\Users\user\AppData\Local\Temp\radDBEC2.tmp.dll Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\BPVAiawSvOgA\ayfcXidefIAOQYvB.dll (copy) Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\BPVAiawSvOgA\ayfcXidefIAOQYvB.dll (copy) Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk Jump to behavior
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\BPVAiawSvOgA\ayfcXidefIAOQYvB.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\wscript.exe TID: 5796 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1836 Thread sleep time: -270000s >= -30000s Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\System32\regsvr32.exe API coverage: 9.3 %
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180008D28 FindFirstFileExW, 12_2_0000000180008D28
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: wscript.exe, 0000000A.00000003.355096801.0000000005344000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355577672.000000000534F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359765538.0000000005350000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWX
Source: wscript.exe, 0000000A.00000003.356861744.0000000005377000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355424100.0000000005375000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.355096801.0000000005373000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.359815791.0000000005378000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.418481837.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.551101008.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.547991280.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000D77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 0000000D.00000003.417628495.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.547991280.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.575459710.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0000000180001C48
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_000000018000A878 GetProcessHeap, 12_2_000000018000A878
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory, 12_2_0000000180010C10
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0000000180001C48
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800082EC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_00000001800082EC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800017DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_00000001800017DC

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.65.88.10 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 164.90.222.65 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 203.26.41.131 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Domain query: penshorn.org
Source: C:\Windows\System32\regsvr32.exe Network Connect: 66.228.32.31 7080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 187.63.160.88 80 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 104.168.155.143 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.89.202.34 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 91.121.146.47 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 160.16.142.56 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 182.162.143.56 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 167.172.199.165 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 163.44.196.120 8080 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\radDBEC2.tmp.dll Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800070A0 cpuid 12_2_00000001800070A0
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180001D98 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 12_2_0000000180001D98

Stealing of Sensitive Information
barindex
Yara detected Malicious OneNote
Source: Yara match File source: Omics_Journal.one, type: SAMPLE
Source: Yara match File source: C:\Users\user\Desktop\Omics_Journal.one, type: DROPPED
Yara detected Emotet
Source: Yara match File source: 0000000D.00000002.575109480.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 13.2.regsvr32.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.regsvr32.exe.de0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.9a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.333419245.00000000009D1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.576245215.0000000000DE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.333370577.00000000009A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.576339106.0000000000E21000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Malicious OneNote
Source: Yara match File source: Omics_Journal.one, type: SAMPLE
Source: Yara match File source: C:\Users\user\Desktop\Omics_Journal.one, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 828489 Sample: Omics_Journal.one Startdate: 17/03/2023 Architecture: WINDOWS Score: 100 43 129.232.188.93 xneeloZA South Africa 2->43 45 45.235.8.30 WIKINETTELECOMUNICACOESBR Brazil 2->45 47 35 other IPs or domains 2->47 59 Snort IDS alert for network traffic 2->59 61 Multi AV Scanner detection for domain / URL 2->61 63 Antivirus detection for URL or domain 2->63 65 7 other signatures 2->65 10 ONENOTE.EXE 50 501 2->10         started        14 ONENOTEM.EXE 2->14         started        signatures3 process4 dnsIp5 49 192.168.2.1 unknown unknown 10->49 39 C:\Users\user\Desktop\Omics_Journal.one, data 10->39 dropped 16 wscript.exe 2 10->16         started        21 ONENOTEM.EXE 1 10->21         started        file6 process7 dnsIp8 41 penshorn.org 203.26.41.131, 443, 49700 DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU Australia 16->41 33 C:\Users\user\AppData\...\radDBEC2.tmp.dll, PE32+ 16->33 dropped 35 C:\Users\user\AppData\Local\Temp\click.wsf, ASCII 16->35 dropped 57 System process connects to network (likely due to code injection or exploit) 16->57 23 regsvr32.exe 16->23         started        file9 signatures10 process11 process12 25 regsvr32.exe 2 23->25         started        file13 37 C:\Windows\...\ayfcXidefIAOQYvB.dll (copy), PE32+ 25->37 dropped 67 Hides that the sample has been downloaded from the Internet (zone.identifier) 25->67 29 regsvr32.exe 25->29         started        signatures14 process15 dnsIp16 51 160.16.142.56, 8080 SAKURA-BSAKURAInternetIncJP Japan 29->51 53 91.121.146.47, 49702, 8080 OVHFR France 29->53 55 9 other IPs or domains 29->55 69 System process connects to network (likely due to code injection or exploit) 29->69 signatures17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
110.232.117.186
 unknown Australia
56038 RACKCORP-APRackCorpAU true
103.132.242.26
 unknown India
45117 INPL-IN-APIshansNetworkIN true
104.168.155.143
 unknown United States
54290 HOSTWINDSUS true
79.137.35.198
 unknown France
16276 OVHFR true
115.68.227.76
 unknown Korea Republic of
38700 SMILESERV-AS-KRSMILESERVKR true
163.44.196.120
 unknown Singapore
135161 GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG true
206.189.28.199
 unknown United States
14061 DIGITALOCEAN-ASNUS true
203.26.41.131
 penshorn.org Australia
38719 DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU true
107.170.39.149
 unknown United States
14061 DIGITALOCEAN-ASNUS true
66.228.32.31
 unknown United States
63949 LINODE-APLinodeLLCUS true
197.242.150.244
 unknown South Africa
37611 AfrihostZA true
185.4.135.165
 unknown Greece
199246 TOPHOSTGR true
183.111.227.137
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR true
45.176.232.124
 unknown Colombia
267869 CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC true
169.57.156.166
 unknown United States
36351 SOFTLAYERUS true
164.68.99.3
 unknown Germany
51167 CONTABODE true
139.59.126.41
 unknown Singapore
14061 DIGITALOCEAN-ASNUS true
167.172.253.162
 unknown United States
14061 DIGITALOCEAN-ASNUS true
167.172.199.165
 unknown United States
14061 DIGITALOCEAN-ASNUS true
202.129.205.3
 unknown Thailand
45328 NIPA-AS-THNIPATECHNOLOGYCOLTDTH true
147.139.166.154
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC true
153.92.5.27
 unknown Germany
47583 AS-HOSTINGERLT true
159.65.88.10
 unknown United States
14061 DIGITALOCEAN-ASNUS true
172.105.226.75
 unknown United States
63949 LINODE-APLinodeLLCUS true
164.90.222.65
 unknown United States
14061 DIGITALOCEAN-ASNUS true
213.239.212.5
 unknown Germany
24940 HETZNER-ASDE true
5.135.159.50
 unknown France
16276 OVHFR true
186.194.240.217
 unknown Brazil
262733 NetceteraTelecomunicacoesLtdaBR true
119.59.103.152
 unknown Thailand
56067 METRABYTE-TH453LadplacoutJorakhaebuaTH true
159.89.202.34
 unknown United States
14061 DIGITALOCEAN-ASNUS true
91.121.146.47
 unknown France
16276 OVHFR true
160.16.142.56
 unknown Japan 9370 SAKURA-BSAKURAInternetIncJP true
201.94.166.162
 unknown Brazil
28573 CLAROSABR true
91.207.28.33
 unknown Kyrgyzstan
39819 PROHOSTKG true
103.75.201.2
 unknown Thailand
133496 CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH true
103.43.75.120
 unknown Japan 20473 AS-CHOOPAUS true
188.44.20.25
 unknown Macedonia
57374 GIV-ASMK true
45.235.8.30
 unknown Brazil
267405 WIKINETTELECOMUNICACOESBR true
153.126.146.25
 unknown Japan 7684 SAKURA-ASAKURAInternetIncJP true
72.15.201.15
 unknown United States
13649 ASN-VINSUS true
187.63.160.88
 unknown Brazil
28169 BITCOMPROVEDORDESERVICOSDEINTERNETLTDABR true
82.223.21.224
 unknown Spain
8560 ONEANDONE-ASBrauerstrasse48DE true
173.212.193.249
 unknown Germany
51167 CONTABODE true
95.217.221.146
 unknown Germany
24940 HETZNER-ASDE true
149.56.131.28
 unknown Canada
16276 OVHFR true
182.162.143.56
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR true
1.234.2.232
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR true
129.232.188.93
 unknown South Africa
37153 xneeloZA true
94.23.45.86
 unknown France
16276 OVHFR true

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
c-0001.c-msedge.net 13.107.4.50 true
penshorn.org 203.26.41.131 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://182.162.143.56/rrjjbae/nhkurfvvppt/cnws/lotgiwvd/ true
  • Avira URL Cloud: malware
 unknown
https://penshorn.org/admin/Ses8712iGR8du/ true
  • Avira URL Cloud: malware
 unknown