Windows Analysis Report
Insight_Medical_Publishing_4.one

Overview

General Information

Sample Name: Insight_Medical_Publishing_4.one
Analysis ID: 828494
MD5: 0c521381f0d5fe36e9dbf63e9012067d
SHA1: 29d169b2eca785dc579651b7e1ed2cb9ad854f37
SHA256: 332107452ecfb3cab8af719978c4c2acc8325219b57eceb77fc2ea77529ff92d
Tags: one
Infos:

Detection

Emotet
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Malicious OneNote
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Sigma detected: Run temp file via regsvr32
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Stores files to the Windows start menu directory
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Detected TCP or UDP traffic on non-standard ports
Connects to several IPs in different countries
Creates a start menu entry (Start Menu\Programs\Startup)
Registers a DLL
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Insight_Medical_Publishing_4.one ReversingLabs: Detection: 33%
Source: Insight_Medical_Publishing_4.one Virustotal: Detection: 40% Perma Link
Antivirus detection for URL or domain
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/i Avira URL Cloud: Label: malware
Source: https://www.gomespontes.com.br/logs/pd/windic2 Avira URL Cloud: Label: malware
Source: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/w11798 Avira URL Cloud: Label: malware
Source: https://66.228.32.31:7080/f Avira URL Cloud: Label: malware
Source: https://104.168.155.143:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/ Avira URL Cloud: Label: malware
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/s Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8 Avira URL Cloud: Label: malware
Source: https://159.89.202.34/wviitvvypaw/exnwmeb/fqgitydelxiavmv/ Avira URL Cloud: Label: malware
Source: http://ozmeydan.com/cekici/9/jn7 Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv// Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/xJ Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/Y Avira URL Cloud: Label: malware
Source: https://104.168.155.143:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/A4 Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/= Avira URL Cloud: Label: malware
Source: https://66.228.32.31:7080/ Avira URL Cloud: Label: malware
Source: https://www.gomespontes.com.br/logs/pd/vM Avira URL Cloud: Label: malware
Source: http://softwareulike.com/cWIYxWMPkK/ Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/ Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/ocal Avira URL Cloud: Label: malware
Source: http://ozmeydan.com/cekici/9/ Avira URL Cloud: Label: malware
Source: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/wM Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/tM Avira URL Cloud: Label: malware
Source: https://www.gomespontes.com.br/logs/pd/ Avira URL Cloud: Label: malware
Source: https://159.89.202.34/cH Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/uM Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/ Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/%4 Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/ Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/ Avira URL Cloud: Label: malware
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/0 Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/ Avira URL Cloud: Label: malware
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/ Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/hJ Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/= Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/R Avira URL Cloud: Label: malware
Source: http://softwareulike.com/cWIYxWMPkK/yM Avira URL Cloud: Label: malware
Source: https://182.162.143.56/wviitvvypaw/exnwmeb/fqgitydelxiavmv/ Avira URL Cloud: Label: malware
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/j2 Avira URL Cloud: Label: malware
Source: https://163.44.196.120:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/H Avira URL Cloud: Label: malware
Source: http://ozmeydan.com/cekici/9/xM Avira URL Cloud: Label: malware
Source: https://163.44.196.120:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/ Avira URL Cloud: Label: malware
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/zM Avira URL Cloud: Label: malware
Source: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/ Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/o Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/Xa4 Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/temobj Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\rad16F69.tmp.dll ReversingLabs: Detection: 58%
Source: C:\Windows\System32\BqnZyHskpeTuo\PjkJxfQvhUP.dll (copy) ReversingLabs: Detection: 58%
Source: 0000000D.00000002.572082302.000000000107B000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Emotet {"C2 list": ["91.121.146.47:8080", "66.228.32.31:7080", "182.162.143.56:443", "187.63.160.88:80", "167.172.199.165:8080", "164.90.222.65:443", "104.168.155.143:8080", "163.44.196.120:8080", "160.16.142.56:8080", "159.89.202.34:443", "159.65.88.10:8080", "186.194.240.217:443", "149.56.131.28:8080", "72.15.201.15:8080", "1.234.2.232:8080", "82.223.21.224:8080", "206.189.28.199:8080", "169.57.156.166:8080", "107.170.39.149:8080", "103.43.75.120:443", "91.207.28.33:8080", "213.239.212.5:443", "45.235.8.30:8080", "119.59.103.152:8080", "164.68.99.3:8080", "95.217.221.146:8080", "153.126.146.25:7080", "197.242.150.244:8080", "202.129.205.3:8080", "103.132.242.26:8080", "139.59.126.41:443", "110.232.117.186:8080", "183.111.227.137:8080", "5.135.159.50:443", "201.94.166.162:443", "103.75.201.2:443", "79.137.35.198:8080", "172.105.226.75:8080", "94.23.45.86:4143", "115.68.227.76:8080", "153.92.5.27:8080", "167.172.253.162:8080", "188.44.20.25:443", "147.139.166.154:8080", "129.232.188.93:443", "173.212.193.249:8080", "185.4.135.165:8080", "45.176.232.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5KJfivQAlAJQ=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2QJe6vQAtAJA="]}
Source: unknown HTTPS traffic detected: 203.26.41.131:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180008D28 FindFirstFileExW, 12_2_0000000180008D28

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Windows\SysWOW64\wscript.exe

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.65.88.10 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 164.90.222.65 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 203.26.41.131 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Domain query: penshorn.org
Source: C:\Windows\System32\regsvr32.exe Network Connect: 66.228.32.31 7080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 187.63.160.88 80 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 104.168.155.143 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.89.202.34 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 91.121.146.47 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 160.16.142.56 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 182.162.143.56 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 167.172.199.165 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 163.44.196.120 8080 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2404312 ET CNC Feodo Tracker Reported CnC Server TCP group 7 192.168.2.7:49708 -> 182.162.143.56:443
Source: Traffic Snort IDS: 2404344 ET CNC Feodo Tracker Reported CnC Server TCP group 23 192.168.2.7:49705 -> 91.121.146.47:8080
Source: Traffic Snort IDS: 2404330 ET CNC Feodo Tracker Reported CnC Server TCP group 16 192.168.2.7:49707 -> 66.228.32.31:7080
Source: Traffic Snort IDS: 2404308 ET CNC Feodo Tracker Reported CnC Server TCP group 5 192.168.2.7:49710 -> 167.172.199.165:8080
Source: Traffic Snort IDS: 2404302 ET CNC Feodo Tracker Reported CnC Server TCP group 2 192.168.2.7:49715 -> 104.168.155.143:8080
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor IPs: 91.121.146.47:8080
Source: Malware configuration extractor IPs: 66.228.32.31:7080
Source: Malware configuration extractor IPs: 182.162.143.56:443
Source: Malware configuration extractor IPs: 187.63.160.88:80
Source: Malware configuration extractor IPs: 167.172.199.165:8080
Source: Malware configuration extractor IPs: 164.90.222.65:443
Source: Malware configuration extractor IPs: 104.168.155.143:8080
Source: Malware configuration extractor IPs: 163.44.196.120:8080
Source: Malware configuration extractor IPs: 160.16.142.56:8080
Source: Malware configuration extractor IPs: 159.89.202.34:443
Source: Malware configuration extractor IPs: 159.65.88.10:8080
Source: Malware configuration extractor IPs: 186.194.240.217:443
Source: Malware configuration extractor IPs: 149.56.131.28:8080
Source: Malware configuration extractor IPs: 72.15.201.15:8080
Source: Malware configuration extractor IPs: 1.234.2.232:8080
Source: Malware configuration extractor IPs: 82.223.21.224:8080
Source: Malware configuration extractor IPs: 206.189.28.199:8080
Source: Malware configuration extractor IPs: 169.57.156.166:8080
Source: Malware configuration extractor IPs: 107.170.39.149:8080
Source: Malware configuration extractor IPs: 103.43.75.120:443
Source: Malware configuration extractor IPs: 91.207.28.33:8080
Source: Malware configuration extractor IPs: 213.239.212.5:443
Source: Malware configuration extractor IPs: 45.235.8.30:8080
Source: Malware configuration extractor IPs: 119.59.103.152:8080
Source: Malware configuration extractor IPs: 164.68.99.3:8080
Source: Malware configuration extractor IPs: 95.217.221.146:8080
Source: Malware configuration extractor IPs: 153.126.146.25:7080
Source: Malware configuration extractor IPs: 197.242.150.244:8080
Source: Malware configuration extractor IPs: 202.129.205.3:8080
Source: Malware configuration extractor IPs: 103.132.242.26:8080
Source: Malware configuration extractor IPs: 139.59.126.41:443
Source: Malware configuration extractor IPs: 110.232.117.186:8080
Source: Malware configuration extractor IPs: 183.111.227.137:8080
Source: Malware configuration extractor IPs: 5.135.159.50:443
Source: Malware configuration extractor IPs: 201.94.166.162:443
Source: Malware configuration extractor IPs: 103.75.201.2:443
Source: Malware configuration extractor IPs: 79.137.35.198:8080
Source: Malware configuration extractor IPs: 172.105.226.75:8080
Source: Malware configuration extractor IPs: 94.23.45.86:4143
Source: Malware configuration extractor IPs: 115.68.227.76:8080
Source: Malware configuration extractor IPs: 153.92.5.27:8080
Source: Malware configuration extractor IPs: 167.172.253.162:8080
Source: Malware configuration extractor IPs: 188.44.20.25:443
Source: Malware configuration extractor IPs: 147.139.166.154:8080
Source: Malware configuration extractor IPs: 129.232.188.93:443
Source: Malware configuration extractor IPs: 173.212.193.249:8080
Source: Malware configuration extractor IPs: 185.4.135.165:8080
Source: Malware configuration extractor IPs: 45.176.232.124:443
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: RACKCORP-APRackCorpAU RACKCORP-APRackCorpAU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: ce5f3254611a8c095a3d821d44539877
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /wviitvvypaw/exnwmeb/fqgitydelxiavmv/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 182.162.143.56
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 110.232.117.186 110.232.117.186
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /admin/Ses8712iGR8du/ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: penshorn.org
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49705 -> 91.121.146.47:8080
Source: global traffic TCP traffic: 192.168.2.7:49707 -> 66.228.32.31:7080
Source: global traffic TCP traffic: 192.168.2.7:49710 -> 167.172.199.165:8080
Source: global traffic TCP traffic: 192.168.2.7:49715 -> 104.168.155.143:8080
Source: global traffic TCP traffic: 192.168.2.7:49716 -> 163.44.196.120:8080
Source: global traffic TCP traffic: 192.168.2.7:49717 -> 160.16.142.56:8080
Source: global traffic TCP traffic: 192.168.2.7:49722 -> 159.65.88.10:8080
Connects to several IPs in different countries
Source: unknown Network traffic detected: IP country count 17
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: wscript.exe, 0000000A.00000003.351129018.0000000005957000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329298977.0000000005955000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354489899.000000000595B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.0000000005955000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353306127.0000000005959000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.434013590.0000000001114000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.410330799.0000000001109000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 0000000D.00000003.434013590.00000000010DA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.410330799.00000000010DA000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.572469448.00000000010CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 0000000D.00000003.434013590.0000000001114000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.410330799.0000000001109000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.13.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 0000000D.00000003.434013590.0000000001114000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.410330799.0000000001109000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab0C
Source: wscript.exe, 0000000A.00000002.354280215.0000000005862000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349730028.000000000585B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ozmeydan.com/cekici
Source: wscript.exe, wscript.exe, 0000000A.00000003.344517254.000000000571B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329234815.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330874377.0000000003109000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338612910.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353199405.00000000058CF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349921274.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354171415.00000000054D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338364395.000000000557B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333126963.0000000005483000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338711188.0000000005646000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340959551.0000000005747000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329158898.000000000310E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333630424.00000000054AF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337986785.0000000005567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.334232531.0000000005535000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340425681.000000000561C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.000000000591E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349970561.0000000005899000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.331782249.00000000053E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340425681.0000000005685000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ozmeydan.com/cekici/9/
Source: wscript.exe, 0000000A.00000002.353883825.000000000307D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353398614.000000000307C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ozmeydan.com/cekici/9/jn7
Source: wscript.exe, 0000000A.00000003.350604005.0000000005120000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ozmeydan.com/cekici/9/xM
Source: wscript.exe, wscript.exe, 0000000A.00000003.344517254.000000000571B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329234815.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330874377.0000000003109000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338612910.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353199405.00000000058CF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349921274.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354171415.00000000054D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338364395.000000000557B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333126963.0000000005483000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338711188.0000000005646000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340959551.0000000005747000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329158898.000000000310E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333630424.00000000054AF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337986785.0000000005567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.334232531.0000000005535000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340425681.000000000561C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.000000000591E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349970561.0000000005899000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.331782249.00000000053E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340425681.0000000005685000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://softwareulike.com/cWIYxWMPkK/
Source: wscript.exe, 0000000A.00000003.350604005.0000000005120000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://softwareulike.com/cWIYxWMPkK/yM
Source: wscript.exe, 0000000A.00000003.332245855.0000000003119000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330874377.0000000003119000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com
Source: wscript.exe, 0000000A.00000003.338584714.0000000005567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352714501.0000000005568000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-
Source: wscript.exe, wscript.exe, 0000000A.00000003.344517254.000000000571B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329234815.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330874377.0000000003109000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338612910.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353199405.00000000058CF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349921274.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354171415.00000000054D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338364395.000000000557B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333126963.0000000005483000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338711188.0000000005646000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340959551.0000000005747000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329158898.000000000310E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333630424.00000000054AF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337986785.0000000005567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.334232531.0000000005535000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340425681.000000000561C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.000000000591E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349970561.0000000005899000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.331782249.00000000053E2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340425681.0000000005685000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/
Source: wscript.exe, 0000000A.00000003.350604005.000000000511B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/0
Source: wscript.exe, 0000000A.00000003.349340106.000000000587E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/i
Source: wscript.exe, 0000000A.00000003.346976631.000000000584E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349194761.000000000586D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/j2
Source: wscript.exe, 0000000A.00000003.349970561.0000000005899000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350018876.00000000058A4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349899661.000000000588F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/s
Source: wscript.exe, 0000000A.00000003.350604005.0000000005120000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/zM
Source: regsvr32.exe, 0000000D.00000002.572469448.00000000010C5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://100.16.142.56:8080/
Source: regsvr32.exe, 0000000D.00000002.573121126.000000000315C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://104.168.155.143:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/
Source: regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://104.168.155.143:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/A4
Source: regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/
Source: regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/hJ
Source: regsvr32.exe, 0000000D.00000002.573121126.000000000315C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/
Source: regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/%4
Source: regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv//
Source: regsvr32.exe, 0000000D.00000002.572469448.00000000010F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/=
Source: regsvr32.exe, 0000000D.00000002.572469448.000000000115C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/Xa4
Source: regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.65.88.10:8080/xJ
Source: regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.89.202.34/cH
Source: regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.573121126.000000000315C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://159.89.202.34/wviitvvypaw/exnwmeb/fqgitydelxiavmv/
Source: regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.142.56:8080/
Source: regsvr32.exe, 0000000D.00000002.572469448.000000000115C000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://160.16.142.56:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/
Source: regsvr32.exe, 0000000D.00000002.572469448.00000000010C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.573121126.000000000315C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/
Source: regsvr32.exe, 0000000D.00000002.573121126.000000000315C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://163.44.196.120:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/H
Source: regsvr32.exe, 0000000D.00000002.572469448.00000000010CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://169.65.88.10:8080/
Source: regsvr32.exe, 0000000D.00000003.434013590.0000000001114000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/
Source: regsvr32.exe, 0000000D.00000003.434013590.00000000010C5000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.573121126.000000000315C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://182.162.143.56/wviitvvypaw/exnwmeb/fqgitydelxiavmv/
Source: regsvr32.exe, 0000000D.00000003.434013590.0000000001114000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.572469448.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://66.228.32.31:7080/
Source: regsvr32.exe, 0000000D.00000003.434013590.0000000001114000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://66.228.32.31:7080/f
Source: regsvr32.exe, 0000000D.00000002.572082302.000000000107B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://91.121.146.47:8080/Y
Source: regsvr32.exe, 0000000D.00000002.572082302.000000000107B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://91.121.146.47:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/
Source: regsvr32.exe, 0000000D.00000003.410626582.00000000010F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://91.121.146.47:8080/wviitvvypaw/exnwmeb/fqgitydelxiavmv/=
Source: wscript.exe, wscript.exe, 0000000A.00000003.344517254.000000000571B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329234815.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330874377.0000000003109000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338612910.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353199405.00000000058CF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349921274.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354171415.00000000054D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338364395.000000000557B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333126963.0000000005483000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338711188.0000000005646000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340959551.0000000005747000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329158898.000000000310E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333630424.00000000054AF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337986785.0000000005567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354280215.0000000005862000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.334232531.0000000005535000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340425681.000000000561C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.000000000591E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349970561.0000000005899000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.331782249.00000000053E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/
Source: wscript.exe, 0000000A.00000003.353391125.0000000003093000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.353921759.0000000003094000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/temobj
Source: wscript.exe, 0000000A.00000003.350604005.0000000005120000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/uM
Source: wscript.exe, 0000000A.00000003.351377227.0000000005931000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329298977.000000000591F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354439210.0000000005932000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.0000000005928000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/
Source: wscript.exe, 0000000A.00000002.354455582.0000000005947000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.351226281.0000000005947000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329298977.0000000005947000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/V
Source: wscript.exe, 0000000A.00000003.353412277.000000000574F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8
Source: wscript.exe, wscript.exe, 0000000A.00000003.344517254.000000000571B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329234815.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330874377.0000000003109000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338612910.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353199405.00000000058CF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349921274.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354171415.00000000054D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338364395.000000000557B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333126963.0000000005483000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338711188.0000000005646000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340959551.0000000005747000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329158898.000000000310E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333630424.00000000054AF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350748133.0000000003004000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337986785.0000000005567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354280215.0000000005862000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.334232531.0000000005535000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340425681.000000000561C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352989899.00000000030BB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.000000000591E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/
Source: wscript.exe, 0000000A.00000002.354161417.00000000054CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333487031.00000000054C9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.332982152.00000000054C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.334262935.00000000054CC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/R
Source: wscript.exe, 0000000A.00000002.353943277.00000000030C6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329874156.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353230721.00000000030C6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.328965636.00000000030AA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/o
Source: wscript.exe, 0000000A.00000003.337986785.0000000005567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.334135815.0000000005548000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338584714.0000000005567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.352714501.0000000005568000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333720815.000000000552F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337774489.000000000555B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337632623.0000000005554000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/ocal
Source: wscript.exe, 0000000A.00000003.350604005.0000000005120000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/tM
Source: wscript.exe, wscript.exe, 0000000A.00000003.344517254.000000000571B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329234815.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330874377.0000000003109000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338612910.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353199405.00000000058CF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349921274.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354171415.00000000054D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338364395.000000000557B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333126963.0000000005483000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338711188.0000000005646000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340959551.0000000005747000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329158898.000000000310E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333630424.00000000054AF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337986785.0000000005567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354280215.0000000005862000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.334232531.0000000005535000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340425681.000000000561C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.000000000591E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349970561.0000000005899000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.331782249.00000000053E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/
Source: wscript.exe, 0000000A.00000003.353391125.0000000003093000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.353921759.0000000003094000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/w11798
Source: wscript.exe, 0000000A.00000003.350604005.0000000005120000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/wM
Source: wscript.exe, wscript.exe, 0000000A.00000003.344517254.000000000571B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329234815.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.330874377.0000000003109000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338612910.00000000055C3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353199405.00000000058CF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349921274.00000000058C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354171415.00000000054D0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338364395.000000000557B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333126963.0000000005483000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.338711188.0000000005646000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340959551.0000000005747000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329158898.000000000310E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.333630424.00000000054AF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.337986785.0000000005567000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354280215.0000000005862000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.334232531.0000000005535000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.340425681.000000000561C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.000000000591E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349970561.0000000005899000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.331782249.00000000053E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gomespontes.com.br/logs/pd/
Source: wscript.exe, 0000000A.00000003.350604005.0000000005120000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gomespontes.com.br/logs/pd/vM
Source: wscript.exe, 0000000A.00000002.353779744.0000000003060000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gomespontes.com.br/logs/pd/windic2
Source: unknown HTTP traffic detected: POST /wviitvvypaw/exnwmeb/fqgitydelxiavmv/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 182.162.143.56
Source: unknown DNS traffic detected: queries for: penshorn.org
Source: global traffic HTTP traffic detected: GET /admin/Ses8712iGR8du/ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: penshorn.org
Source: unknown HTTPS traffic detected: 203.26.41.131:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.7:49708 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected Emotet
Source: Yara match File source: 0000000D.00000002.572082302.000000000107B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 13.2.regsvr32.exe.1010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.regsvr32.exe.1010000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.571771558.0000000001041000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.327461788.0000000000590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.571413418.0000000001010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.327486572.00000000005C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Yara signature match
Source: 0000000A.00000003.350591261.00000000056C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.350591261.00000000056C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.340162075.00000000056C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.340162075.00000000056C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.339776726.00000000056BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.339776726.00000000056BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000002.354227381.00000000056C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.341613942.00000000056C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.341613942.00000000056C4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 0000000A.00000003.349899661.000000000588F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Creates files inside the system directory
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\system32\BqnZyHskpeTuo\ Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180006818 12_2_0000000180006818
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_000000018000B878 12_2_000000018000B878
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180007110 12_2_0000000180007110
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180008D28 12_2_0000000180008D28
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180014555 12_2_0000000180014555
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00580000 12_2_00580000
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CCC14 12_2_005CCC14
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DA000 12_2_005DA000
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D709C 12_2_005D709C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C7D6C 12_2_005C7D6C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C263C 12_2_005C263C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C8BC8 12_2_005C8BC8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D8FC8 12_2_005D8FC8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DC058 12_2_005DC058
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005E5450 12_2_005E5450
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DC44C 12_2_005DC44C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C7840 12_2_005C7840
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CB07C 12_2_005CB07C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C2C78 12_2_005C2C78
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CC078 12_2_005CC078
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CD474 12_2_005CD474
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D6C70 12_2_005D6C70
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DB460 12_2_005DB460
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005E181C 12_2_005E181C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C9408 12_2_005C9408
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C7C08 12_2_005C7C08
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C1000 12_2_005C1000
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CB83C 12_2_005CB83C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D1030 12_2_005D1030
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DEC30 12_2_005DEC30
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C18DC 12_2_005C18DC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C14D4 12_2_005C14D4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D3CD4 12_2_005D3CD4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C80CC 12_2_005C80CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D08CC 12_2_005D08CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CF8C4 12_2_005CF8C4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D5CC4 12_2_005D5CC4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C48FC 12_2_005C48FC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C90F8 12_2_005C90F8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C3CF4 12_2_005C3CF4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D20E0 12_2_005D20E0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CAC94 12_2_005CAC94
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C4C84 12_2_005C4C84
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DCC84 12_2_005DCC84
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D5880 12_2_005D5880
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005E94BC 12_2_005E94BC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CDCB8 12_2_005CDCB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DA8B0 12_2_005DA8B0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C98AC 12_2_005C98AC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D7518 12_2_005D7518
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005E9910 12_2_005E9910
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D610C 12_2_005D610C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005E8500 12_2_005E8500
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C6138 12_2_005C6138
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C7530 12_2_005C7530
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DB130 12_2_005DB130
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DAD28 12_2_005DAD28
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D1924 12_2_005D1924
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D4D20 12_2_005D4D20
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D15C8 12_2_005D15C8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DD5F0 12_2_005DD5F0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C95BC 12_2_005C95BC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DBDA0 12_2_005DBDA0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CF65C 12_2_005CF65C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CB258 12_2_005CB258
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DA244 12_2_005DA244
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C3274 12_2_005C3274
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D0A70 12_2_005D0A70
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CA660 12_2_005CA660
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C461C 12_2_005C461C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C4214 12_2_005C4214
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C3E0C 12_2_005C3E0C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D020C 12_2_005D020C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D8E08 12_2_005D8E08
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D5A00 12_2_005D5A00
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005E8A00 12_2_005E8A00
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CBA2C 12_2_005CBA2C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D8A2C 12_2_005D8A2C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D0E2C 12_2_005D0E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D662C 12_2_005D662C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D96D4 12_2_005D96D4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CD6CC 12_2_005CD6CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DEAC0 12_2_005DEAC0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C92F0 12_2_005C92F0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CBE90 12_2_005CBE90
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D4A90 12_2_005D4A90
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C8A8C 12_2_005C8A8C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005E4E8C 12_2_005E4E8C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C3ABC 12_2_005C3ABC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DA6BC 12_2_005DA6BC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CAAB8 12_2_005CAAB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C4EB8 12_2_005C4EB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C975C 12_2_005C975C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C4758 12_2_005C4758
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DE750 12_2_005DE750
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CF77C 12_2_005CF77C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C8378 12_2_005C8378
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DD770 12_2_005DD770
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DCF70 12_2_005DCF70
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D4F18 12_2_005D4F18
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CEF14 12_2_005CEF14
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D3B14 12_2_005D3B14
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DE310 12_2_005DE310
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CD33C 12_2_005CD33C
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C2FD4 12_2_005C2FD4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C33D4 12_2_005C33D4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D3FD0 12_2_005D3FD0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D97CC 12_2_005D97CC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CA7F0 12_2_005CA7F0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005E27EC 12_2_005E27EC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C1B94 12_2_005C1B94
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D5384 12_2_005D5384
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CFFB8 12_2_005CFFB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D8BB8 12_2_005D8BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C8FB0 12_2_005C8FB0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CDBA0 12_2_005CDBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01000000 13_2_01000000
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01047D6C 13_2_01047D6C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104CC14 13_2_0104CC14
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010508CC 13_2_010508CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01049B79 13_2_01049B79
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010463A4 13_2_010463A4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010673A4 13_2_010673A4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01048BC8 13_2_01048BC8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01058FC8 13_2_01058FC8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01053FD0 13_2_01053FD0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01060618 13_2_01060618
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010576A8 13_2_010576A8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01068500 13_2_01068500
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01062100 13_2_01062100
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105610C 13_2_0105610C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01069910 13_2_01069910
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01057518 13_2_01057518
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01051924 13_2_01051924
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01054D20 13_2_01054D20
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105AD28 13_2_0105AD28
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105B130 13_2_0105B130
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01046138 13_2_01046138
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01064D64 13_2_01064D64
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105BDA0 13_2_0105BDA0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010495BC 13_2_010495BC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010515C8 13_2_010515C8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105D5F0 13_2_0105D5F0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01041000 13_2_01041000
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105A000 13_2_0105A000
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01049408 13_2_01049408
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01047C08 13_2_01047C08
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01047410 13_2_01047410
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0106181C 13_2_0106181C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01051030 13_2_01051030
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105EC30 13_2_0105EC30
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104B83C 13_2_0104B83C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01047840 13_2_01047840
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105C44C 13_2_0105C44C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01065450 13_2_01065450
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105C058 13_2_0105C058
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105B460 13_2_0105B460
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01065868 13_2_01065868
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104D474 13_2_0104D474
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01056C70 13_2_01056C70
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104B07C 13_2_0104B07C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01042C78 13_2_01042C78
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104C078 13_2_0104C078
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01044C84 13_2_01044C84
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105CC84 13_2_0105CC84
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01055880 13_2_01055880
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0106488C 13_2_0106488C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104AC94 13_2_0104AC94
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01061494 13_2_01061494
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105709C 13_2_0105709C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010498AC 13_2_010498AC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010644A8 13_2_010644A8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105A8B0 13_2_0105A8B0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010694BC 13_2_010694BC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104DCB8 13_2_0104DCB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104F8C4 13_2_0104F8C4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01055CC4 13_2_01055CC4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010480CC 13_2_010480CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010414D4 13_2_010414D4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01053CD4 13_2_01053CD4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01061CD4 13_2_01061CD4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010418DC 13_2_010418DC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010520E0 13_2_010520E0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01043CF4 13_2_01043CF4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010448FC 13_2_010448FC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010490F8 13_2_010490F8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104EF14 13_2_0104EF14
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01053B14 13_2_01053B14
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105E310 13_2_0105E310
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01068310 13_2_01068310
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01065B1C 13_2_01065B1C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01054F18 13_2_01054F18
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104D33C 13_2_0104D33C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105E750 13_2_0105E750
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104975C 13_2_0104975C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01044758 13_2_01044758
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01068B68 13_2_01068B68
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105D770 13_2_0105D770
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105CF70 13_2_0105CF70
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104F77C 13_2_0104F77C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01048378 13_2_01048378
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01055384 13_2_01055384
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01041B94 13_2_01041B94
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104DBA0 13_2_0104DBA0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010647A8 13_2_010647A8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01048FB0 13_2_01048FB0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104FFB8 13_2_0104FFB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01058BB8 13_2_01058BB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010597CC 13_2_010597CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01042FD4 13_2_01042FD4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010433D4 13_2_010433D4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010627EC 13_2_010627EC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104A7F0 13_2_0104A7F0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105FFFC 13_2_0105FFFC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01055A00 13_2_01055A00
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01068A00 13_2_01068A00
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01043E0C 13_2_01043E0C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105020C 13_2_0105020C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01058E08 13_2_01058E08
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01044214 13_2_01044214
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104461C 13_2_0104461C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104BA2C 13_2_0104BA2C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01058A2C 13_2_01058A2C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01050E2C 13_2_01050E2C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105662C 13_2_0105662C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104263C 13_2_0104263C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105A244 13_2_0105A244
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01066E48 13_2_01066E48
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104F65C 13_2_0104F65C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104B258 13_2_0104B258
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104A660 13_2_0104A660
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01043274 13_2_01043274
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01050A70 13_2_01050A70
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01062E84 13_2_01062E84
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01048A8C 13_2_01048A8C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01064E8C 13_2_01064E8C
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104BE90 13_2_0104BE90
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01054A90 13_2_01054A90
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01062AB0 13_2_01062AB0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01043ABC 13_2_01043ABC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105A6BC 13_2_0105A6BC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104AAB8 13_2_0104AAB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01044EB8 13_2_01044EB8
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105EAC0 13_2_0105EAC0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0104D6CC 13_2_0104D6CC
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010596D4 13_2_010596D4
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010492F0 13_2_010492F0
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_010636FC 13_2_010636FC
Contains functionality to call native functions
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory, 12_2_0000000180010C10
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010AC0 ExitProcess,RtlQueueApcWow64Thread,NtTestAlert, 12_2_0000000180010AC0
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010DB0 ZwOpenSymbolicLinkObject,ZwOpenSymbolicLinkObject, 12_2_0000000180010DB0
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Section loaded: sfc.dll Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\rad16F69.tmp.dll 2F39C2879989DDD7F9ECF52B6232598E5595F8BF367846FF188C9DFBF1251253
Source: Insight_Medical_Publishing_4.one ReversingLabs: Detection: 33%
Source: Insight_Medical_Publishing_4.one Virustotal: Detection: 40%
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE" "C:\Users\user\Desktop\Insight_Medical_Publishing_4.one
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad16F69.tmp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Users\user\AppData\Local\Temp\rad16F69.tmp.dll"
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BqnZyHskpeTuo\PjkJxfQvhUP.dll"
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE /tsr
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE "C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE" /tsr
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf" Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE /tsr Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad16F69.tmp.dll Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe "C:\Users\user\AppData\Local\Temp\rad16F69.tmp.dll" Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BqnZyHskpeTuo\PjkJxfQvhUP.dll" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32 Jump to behavior
Source: Send to OneNote.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user\Documents\{4F9D4FA7-F550-4E9A-B744-8AA5F9719A19} Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user~1\AppData\Local\Temp\{86590038-9E33-45B4-A336-008325B4A44C} - OProcSessId.dat Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winONE@12/695@1/49
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File read: C:\Program Files (x86)\desktop.ini Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C8BC8 Process32FirstW,CreateToolhelp32Snapshot,FindCloseChangeNotification, 12_2_005C8BC8
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE Mutant created: \Sessions\1\BaseNamedObjects\OneNoteM:AppShared
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180005C69 push rdi; ret 12_2_0000000180005C72
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800056DD push rdi; ret 12_2_00000001800056E4
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C6CDE push esi; iretd 12_2_005C6CDF
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D80D7 push ebp; retf 12_2_005D80D8
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CA0FC push ebp; iretd 12_2_005CA0FD
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C6C9F pushad ; ret 12_2_005C6CAA
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D8157 push ebp; retf 12_2_005D8158
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C9D51 push ebp; retf 12_2_005C9D5A
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D7D4E push ebp; iretd 12_2_005D7D4F
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D7D3C push ebp; retf 12_2_005D7D3D
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D7D25 push 4D8BFFFFh; retf 12_2_005D7D2A
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CA1D2 push ebp; iretd 12_2_005CA1D3
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D7987 push ebp; iretd 12_2_005D798F
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005CA26E push ebp; ret 12_2_005CA26F
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005C9E8B push eax; retf 12_2_005C9E8E
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005D7EAF push 458BCC5Ah; retf 12_2_005D7EBC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_005DC731 push esi; iretd 12_2_005DC732
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_01066D34 push edi; ret 13_2_01066D36
Source: C:\Windows\System32\regsvr32.exe Code function: 13_2_0105C731 push esi; iretd 13_2_0105C732
PE file contains sections with non-standard names
Source: rad16F69.tmp.dll.10.dr Static PE information: section name: _RDATA
Registers a DLL
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad16F69.tmp.dll
Drops PE files
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\BqnZyHskpeTuo\PjkJxfQvhUP.dll (copy) Jump to dropped file
Source: C:\Windows\SysWOW64\wscript.exe File created: C:\Users\user\AppData\Local\Temp\rad16F69.tmp.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\regsvr32.exe File created: C:\Windows\System32\BqnZyHskpeTuo\PjkJxfQvhUP.dll (copy) Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk Jump to behavior
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\System32\regsvr32.exe File opened: C:\Windows\system32\BqnZyHskpeTuo\PjkJxfQvhUP.dll:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTEM.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\wscript.exe TID: 2200 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 6004 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 4108 Thread sleep time: -270000s >= -30000s Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\System32\regsvr32.exe API coverage: 9.3 %
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180008D28 FindFirstFileExW, 12_2_0000000180008D28
Source: C:\Windows\System32\regsvr32.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: wscript.exe, 0000000A.00000003.351129018.0000000005957000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329298977.0000000005955000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354489899.000000000595B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.0000000005955000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.353306127.0000000005959000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW.
Source: wscript.exe, 0000000A.00000003.351129018.0000000005957000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354379182.00000000058C5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.346976631.000000000584E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.329298977.0000000005955000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349340106.000000000587E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000002.354489899.000000000595B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350893818.0000000005955000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.350121296.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349605880.00000000058AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349744376.00000000058B4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000A.00000003.349194761.000000000586D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: regsvr32.exe, 0000000D.00000003.410330799.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000002.572469448.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000D.00000003.433728463.00000000010BB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0000000180001C48
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_000000018000A878 GetProcessHeap, 12_2_000000018000A878
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory, 12_2_0000000180010C10
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_0000000180001C48
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800082EC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 12_2_00000001800082EC
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800017DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 12_2_00000001800017DC

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.65.88.10 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 164.90.222.65 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 203.26.41.131 443 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Domain query: penshorn.org
Source: C:\Windows\System32\regsvr32.exe Network Connect: 66.228.32.31 7080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 187.63.160.88 80 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 104.168.155.143 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 159.89.202.34 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 91.121.146.47 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 160.16.142.56 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 182.162.143.56 443 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 167.172.199.165 8080 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Network Connect: 163.44.196.120 8080 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad16F69.tmp.dll Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\regsvr32.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_00000001800070A0 cpuid 12_2_00000001800070A0
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Code function: 12_2_0000000180001D98 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 12_2_0000000180001D98

Stealing of Sensitive Information
barindex
Yara detected Malicious OneNote
Source: Yara match File source: Insight_Medical_Publishing_4.one, type: SAMPLE
Source: Yara match File source: C:\Users\user\Desktop\Insight_Medical_Publishing_4.one, type: DROPPED
Yara detected Emotet
Source: Yara match File source: 0000000D.00000002.572082302.000000000107B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 13.2.regsvr32.exe.1010000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.regsvr32.exe.1010000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.regsvr32.exe.590000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.571771558.0000000001041000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.327461788.0000000000590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.571413418.0000000001010000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.327486572.00000000005C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected Malicious OneNote
Source: Yara match File source: Insight_Medical_Publishing_4.one, type: SAMPLE
Source: Yara match File source: C:\Users\user\Desktop\Insight_Medical_Publishing_4.one, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 828494 Sample: Insight_Medical_Publishing_4.one Startdate: 17/03/2023 Architecture: WINDOWS Score: 100 40 129.232.188.93 xneeloZA South Africa 2->40 42 45.235.8.30 WIKINETTELECOMUNICACOESBR Brazil 2->42 44 35 other IPs or domains 2->44 56 Snort IDS alert for network traffic 2->56 58 Antivirus detection for URL or domain 2->58 60 Multi AV Scanner detection for dropped file 2->60 62 6 other signatures 2->62 10 ONENOTE.EXE 50 501 2->10         started        13 ONENOTEM.EXE 2->13         started        signatures3 process4 file5 38 C:\Users\...\Insight_Medical_Publishing_4.one, data 10->38 dropped 15 wscript.exe 2 10->15         started        20 ONENOTEM.EXE 1 10->20         started        process6 dnsIp7 52 penshorn.org 203.26.41.131, 443, 49702 DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU Australia 15->52 32 C:\Users\user\AppData\...\rad16F69.tmp.dll, PE32+ 15->32 dropped 34 C:\Users\user\AppData\Local\Temp\click.wsf, ASCII 15->34 dropped 54 System process connects to network (likely due to code injection or exploit) 15->54 22 regsvr32.exe 15->22         started        file8 signatures9 process10 process11 24 regsvr32.exe 2 22->24         started        file12 36 C:\Windows\...\PjkJxfQvhUP.dll (copy), PE32+ 24->36 dropped 64 Hides that the sample has been downloaded from the Internet (zone.identifier) 24->64 28 regsvr32.exe 24->28         started        signatures13 process14 dnsIp15 46 160.16.142.56, 8080 SAKURA-BSAKURAInternetIncJP Japan 28->46 48 91.121.146.47, 49705, 8080 OVHFR France 28->48 50 9 other IPs or domains 28->50 66 System process connects to network (likely due to code injection or exploit) 28->66 signatures16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
110.232.117.186
 unknown Australia
56038 RACKCORP-APRackCorpAU true
103.132.242.26
 unknown India
45117 INPL-IN-APIshansNetworkIN true
104.168.155.143
 unknown United States
54290 HOSTWINDSUS true
79.137.35.198
 unknown France
16276 OVHFR true
115.68.227.76
 unknown Korea Republic of
38700 SMILESERV-AS-KRSMILESERVKR true
163.44.196.120
 unknown Singapore
135161 GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG true
206.189.28.199
 unknown United States
14061 DIGITALOCEAN-ASNUS true
203.26.41.131
 penshorn.org Australia
38719 DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU true
107.170.39.149
 unknown United States
14061 DIGITALOCEAN-ASNUS true
66.228.32.31
 unknown United States
63949 LINODE-APLinodeLLCUS true
197.242.150.244
 unknown South Africa
37611 AfrihostZA true
185.4.135.165
 unknown Greece
199246 TOPHOSTGR true
183.111.227.137
 unknown Korea Republic of
4766 KIXS-AS-KRKoreaTelecomKR true
45.176.232.124
 unknown Colombia
267869 CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC true
169.57.156.166
 unknown United States
36351 SOFTLAYERUS true
164.68.99.3
 unknown Germany
51167 CONTABODE true
139.59.126.41
 unknown Singapore
14061 DIGITALOCEAN-ASNUS true
167.172.253.162
 unknown United States
14061 DIGITALOCEAN-ASNUS true
167.172.199.165
 unknown United States
14061 DIGITALOCEAN-ASNUS true
202.129.205.3
 unknown Thailand
45328 NIPA-AS-THNIPATECHNOLOGYCOLTDTH true
147.139.166.154
 unknown United States
45102 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC true
153.92.5.27
 unknown Germany
47583 AS-HOSTINGERLT true
159.65.88.10
 unknown United States
14061 DIGITALOCEAN-ASNUS true
172.105.226.75
 unknown United States
63949 LINODE-APLinodeLLCUS true
164.90.222.65
 unknown United States
14061 DIGITALOCEAN-ASNUS true
213.239.212.5
 unknown Germany
24940 HETZNER-ASDE true
5.135.159.50
 unknown France
16276 OVHFR true
186.194.240.217
 unknown Brazil
262733 NetceteraTelecomunicacoesLtdaBR true
119.59.103.152
 unknown Thailand
56067 METRABYTE-TH453LadplacoutJorakhaebuaTH true
159.89.202.34
 unknown United States
14061 DIGITALOCEAN-ASNUS true
91.121.146.47
 unknown France
16276 OVHFR true
160.16.142.56
 unknown Japan 9370 SAKURA-BSAKURAInternetIncJP true
201.94.166.162
 unknown Brazil
28573 CLAROSABR true
91.207.28.33
 unknown Kyrgyzstan
39819 PROHOSTKG true
103.75.201.2
 unknown Thailand
133496 CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH true
103.43.75.120
 unknown Japan 20473 AS-CHOOPAUS true
188.44.20.25
 unknown Macedonia
57374 GIV-ASMK true
45.235.8.30
 unknown Brazil
267405 WIKINETTELECOMUNICACOESBR true
153.126.146.25
 unknown Japan 7684 SAKURA-ASAKURAInternetIncJP true
72.15.201.15
 unknown United States
13649 ASN-VINSUS true
187.63.160.88
 unknown Brazil
28169 BITCOMPROVEDORDESERVICOSDEINTERNETLTDABR true
82.223.21.224
 unknown Spain
8560 ONEANDONE-ASBrauerstrasse48DE true
173.212.193.249
 unknown Germany
51167 CONTABODE true
95.217.221.146
 unknown Germany
24940 HETZNER-ASDE true
149.56.131.28
 unknown Canada
16276 OVHFR true
182.162.143.56
 unknown Korea Republic of
3786 LGDACOMLGDACOMCorporationKR true
1.234.2.232
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR true
129.232.188.93
 unknown South Africa
37153 xneeloZA true
94.23.45.86
 unknown France
16276 OVHFR true

Contacted Domains

Name IP Active
penshorn.org 203.26.41.131 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://penshorn.org/admin/Ses8712iGR8du/ true
  • Avira URL Cloud: malware
 unknown
https://182.162.143.56/wviitvvypaw/exnwmeb/fqgitydelxiavmv/ true
  • Avira URL Cloud: malware
 unknown