Edit tour

Windows Analysis Report
Insight_Medical_Publishing_3.one

Overview

General Information

Sample Name:	Insight_Medical_Publishing_3.one
Analysis ID:	828495
MD5:	0d8f675a79a32d286f8eccb2ff989c91
SHA1:	e0796075d09841386c12f37503495c9624a3c393
SHA256:	7ef31d3538810c895812e331db91f905693b99b682d062d9d0b4dab5df0da0a2
Tags:	one
Infos:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Malicious OneNote

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Sigma detected: Run temp file via regsvr32

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Document exploit detected (process start blacklist hit)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Registers a DLL

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

ONENOTE.EXE (PID: 5852 cmdline: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE" "C:\Users\user\Desktop\Insight_Medical_Publishing_3.one MD5: 8D7E99CB358318E1F38803C9E6B67867)

wscript.exe (PID: 4976 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf" MD5: 7075DD7B9BE8807FCA93ACD86F724884)

regsvr32.exe (PID: 4920 cmdline: C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

regsvr32.exe (PID: 3156 cmdline: "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 1652 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Emotet	While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.	GOLD CABIN MUMMY SPIDER Mealybug	http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ http://ropgadget.com/posts/defensive_pcres.html https://adalogics.com/blog/the-state-of-advanced-code-injections https://asec.ahnlab.com/en/33600/	https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet

Malware Configuration

Threatname: Emotet

{"C2 list": ["91.121.146.47:8080", "66.228.32.31:7080", "182.162.143.56:443", "187.63.160.88:80", "167.172.199.165:8080", "164.90.222.65:443", "104.168.155.143:8080", "163.44.196.120:8080", "160.16.142.56:8080", "159.89.202.34:443", "159.65.88.10:8080", "186.194.240.217:443", "149.56.131.28:8080", "72.15.201.15:8080", "1.234.2.232:8080", "82.223.21.224:8080", "206.189.28.199:8080", "169.57.156.166:8080", "107.170.39.149:8080", "103.43.75.120:443", "91.207.28.33:8080", "213.239.212.5:443", "45.235.8.30:8080", "119.59.103.152:8080", "164.68.99.3:8080", "95.217.221.146:8080", "153.126.146.25:7080", "197.242.150.244:8080", "202.129.205.3:8080", "103.132.242.26:8080", "139.59.126.41:443", "110.232.117.186:8080", "183.111.227.137:8080", "5.135.159.50:443", "201.94.166.162:443", "103.75.201.2:443", "79.137.35.198:8080", "172.105.226.75:8080", "94.23.45.86:4143", "115.68.227.76:8080", "153.92.5.27:8080", "167.172.253.162:8080", "188.44.20.25:443", "147.139.166.154:8080", "129.232.188.93:443", "173.212.193.249:8080", "185.4.135.165:8080", "45.176.232.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5OWVpqQATAJA=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2gGXgqQAuAJA="]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Insight_Medical_Publishing_3.one	JoeSecurity_MalOneNote	Yara detected Malicious OneNote	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_obfuscated	ASP webshell obfuscated	Arnim Rupp	0x38fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x3a1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x962:$jsp4: public 0xfa2:$jsp4: public 0x1e6a:$jsp4: public 0x2822:$jsp4: public 0x2e62:$jsp4: public 0x4322:$jsp4: public 0x4962:$jsp4: public 0x61c:$asp_payload11: wscript.shell 0x24dc:$asp_payload11: wscript.shell 0x3fdc:$asp_payload11: wscript.shell 0x204:$asp_multi_payload_one1: createobject 0x2f2:$asp_multi_payload_one1: createobject 0x36a:$asp_multi_payload_one1: createobject 0x3c4:$asp_multi_payload_one1: createobject 0x600:$asp_multi_payload_one1: createobject 0xd66:$asp_multi_payload_one1: createobject 0x20c4:$asp_multi_payload_one1: createobject 0x21b2:$asp_multi_payload_one1: createobject 0x222a:$asp_multi_payload_one1: createobject
00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp	WEBSHELL_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x4ce:$asp_gen_obf1: "+" 0x4fe:$asp_gen_obf1: "+" 0x238e:$asp_gen_obf1: "+" 0x23be:$asp_gen_obf1: "+" 0x3e8e:$asp_gen_obf1: "+" 0x3ebe:$asp_gen_obf1: "+" 0x38fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x3a1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x962:$jsp4: public 0xfa2:$jsp4: public 0x1e6a:$jsp4: public 0x2822:$jsp4: public 0x2e62:$jsp4: public 0x4322:$jsp4: public 0x4962:$jsp4: public 0x2e2:$asp_input1: request 0xb10:$asp_input1: request 0xb52:$asp_input1: request 0xc68:$asp_input1: request 0x21a2:$asp_input1: request 0x29d0:$asp_input1: request
00000009.00000003.346224913.0000000005175000.00000004.00000020.00020000.00000000.sdmp	WEBSHELL_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0xe066:$asp_gen_obf1: "+" 0xe096:$asp_gen_obf1: "+" 0x154ce:$asp_gen_obf1: "+" 0x154fe:$asp_gen_obf1: "+" 0x1738e:$asp_gen_obf1: "+" 0x173be:$asp_gen_obf1: "+" 0x18e8e:$asp_gen_obf1: "+" 0x18ebe:$asp_gen_obf1: "+" 0x8f00:$tagasp_short2: %> 0x188fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x18a1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0xe4fa:$jsp4: public 0x15962:$jsp4: public 0x15fa2:$jsp4: public 0x16e6a:$jsp4: public 0x17822:$jsp4: public 0x17e62:$jsp4: public 0x19322:$jsp4: public 0x19962:$jsp4: public 0xde7a:$asp_input1: request 0xe6a8:$asp_input1: request
0000000C.00000002.580204342.0000000002B11000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000003.347622434.0000000005182000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_obfuscated	ASP webshell obfuscated	Arnim Rupp	0xb8fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0xba1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x14fa:$jsp4: public 0x8962:$jsp4: public 0x8fa2:$jsp4: public 0x9e6a:$jsp4: public 0xa822:$jsp4: public 0xae62:$jsp4: public 0xc322:$jsp4: public 0xc962:$jsp4: public 0x11b4:$asp_payload11: wscript.shell 0x861c:$asp_payload11: wscript.shell 0xa4dc:$asp_payload11: wscript.shell 0xbfdc:$asp_payload11: wscript.shell 0xd9c:$asp_multi_payload_one1: createobject 0xe8a:$asp_multi_payload_one1: createobject 0xf02:$asp_multi_payload_one1: createobject 0xf5c:$asp_multi_payload_one1: createobject 0x1198:$asp_multi_payload_one1: createobject 0x18fe:$asp_multi_payload_one1: createobject 0x8204:$asp_multi_payload_one1: createobject
00000009.00000003.347622434.0000000005182000.00000004.00000020.00020000.00000000.sdmp	WEBSHELL_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x1066:$asp_gen_obf1: "+" 0x1096:$asp_gen_obf1: "+" 0x84ce:$asp_gen_obf1: "+" 0x84fe:$asp_gen_obf1: "+" 0xa38e:$asp_gen_obf1: "+" 0xa3be:$asp_gen_obf1: "+" 0xbe8e:$asp_gen_obf1: "+" 0xbebe:$asp_gen_obf1: "+" 0xb8fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0xba1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x14fa:$jsp4: public 0x8962:$jsp4: public 0x8fa2:$jsp4: public 0x9e6a:$jsp4: public 0xa822:$jsp4: public 0xae62:$jsp4: public 0xc322:$jsp4: public 0xc962:$jsp4: public 0xe7a:$asp_input1: request 0x16a8:$asp_input1: request 0x16ea:$asp_input1: request
00000009.00000002.353529377.000000000518B000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_obfuscated	ASP webshell obfuscated	Arnim Rupp	0x28fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x2a1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0xe6a:$jsp4: public 0x1822:$jsp4: public 0x1e62:$jsp4: public 0x3322:$jsp4: public 0x3962:$jsp4: public 0x14dc:$asp_payload11: wscript.shell 0x2fdc:$asp_payload11: wscript.shell 0x10c4:$asp_multi_payload_one1: createobject 0x11b2:$asp_multi_payload_one1: createobject 0x122a:$asp_multi_payload_one1: createobject 0x1284:$asp_multi_payload_one1: createobject 0x14c0:$asp_multi_payload_one1: createobject 0x1c26:$asp_multi_payload_one1: createobject 0x1f5e:$asp_multi_payload_one1: createobject 0x2bc4:$asp_multi_payload_one1: createobject 0x2cb2:$asp_multi_payload_one1: createobject 0x2d2a:$asp_multi_payload_one1: createobject 0x2d84:$asp_multi_payload_one1: createobject 0x2fc0:$asp_multi_payload_one1: createobject
00000009.00000002.353529377.000000000518B000.00000004.00000020.00020000.00000000.sdmp	WEBSHELL_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x138e:$asp_gen_obf1: "+" 0x13be:$asp_gen_obf1: "+" 0x2e8e:$asp_gen_obf1: "+" 0x2ebe:$asp_gen_obf1: "+" 0x28fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x2a1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0xe6a:$jsp4: public 0x1822:$jsp4: public 0x1e62:$jsp4: public 0x3322:$jsp4: public 0x3962:$jsp4: public 0x11a2:$asp_input1: request 0x19d0:$asp_input1: request 0x1a12:$asp_input1: request 0x1b28:$asp_input1: request 0x2ca2:$asp_input1: request 0x34d0:$asp_input1: request 0x3512:$asp_input1: request 0x3628:$asp_input1: request 0x14dc:$asp_payload11: wscript.shell 0x2fdc:$asp_payload11: wscript.shell
00000009.00000003.347751255.0000000005182000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_obfuscated	ASP webshell obfuscated	Arnim Rupp	0xb8fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0xba1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x14fa:$jsp4: public 0x8962:$jsp4: public 0x8fa2:$jsp4: public 0x9e6a:$jsp4: public 0xa822:$jsp4: public 0xae62:$jsp4: public 0xc322:$jsp4: public 0xc962:$jsp4: public 0x11b4:$asp_payload11: wscript.shell 0x861c:$asp_payload11: wscript.shell 0xa4dc:$asp_payload11: wscript.shell 0xbfdc:$asp_payload11: wscript.shell 0xd9c:$asp_multi_payload_one1: createobject 0xe8a:$asp_multi_payload_one1: createobject 0xf02:$asp_multi_payload_one1: createobject 0xf5c:$asp_multi_payload_one1: createobject 0x1198:$asp_multi_payload_one1: createobject 0x18fe:$asp_multi_payload_one1: createobject 0x8204:$asp_multi_payload_one1: createobject
00000009.00000003.347751255.0000000005182000.00000004.00000020.00020000.00000000.sdmp	WEBSHELL_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x1066:$asp_gen_obf1: "+" 0x1096:$asp_gen_obf1: "+" 0x84ce:$asp_gen_obf1: "+" 0x84fe:$asp_gen_obf1: "+" 0xa38e:$asp_gen_obf1: "+" 0xa3be:$asp_gen_obf1: "+" 0xbe8e:$asp_gen_obf1: "+" 0xbebe:$asp_gen_obf1: "+" 0xb8fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0xba1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x14fa:$jsp4: public 0x8962:$jsp4: public 0x8fa2:$jsp4: public 0x9e6a:$jsp4: public 0xa822:$jsp4: public 0xae62:$jsp4: public 0xc322:$jsp4: public 0xc962:$jsp4: public 0xe7a:$asp_input1: request 0x16a8:$asp_input1: request 0x16ea:$asp_input1: request
0000000B.00000002.334740049.0000000000F41000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.579427861.0000000001220000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000B.00000002.334703858.0000000000F10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000003.348256209.0000000005189000.00000004.00000020.00020000.00000000.sdmp	webshell_asp_obfuscated	ASP webshell obfuscated	Arnim Rupp	0x48fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x4a1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x1962:$jsp4: public 0x1fa2:$jsp4: public 0x2e6a:$jsp4: public 0x3822:$jsp4: public 0x3e62:$jsp4: public 0x5322:$jsp4: public 0x5962:$jsp4: public 0x161c:$asp_payload11: wscript.shell 0x34dc:$asp_payload11: wscript.shell 0x4fdc:$asp_payload11: wscript.shell 0x1204:$asp_multi_payload_one1: createobject 0x12f2:$asp_multi_payload_one1: createobject 0x136a:$asp_multi_payload_one1: createobject 0x13c4:$asp_multi_payload_one1: createobject 0x1600:$asp_multi_payload_one1: createobject 0x1d66:$asp_multi_payload_one1: createobject 0x30c4:$asp_multi_payload_one1: createobject 0x31b2:$asp_multi_payload_one1: createobject 0x322a:$asp_multi_payload_one1: createobject
00000009.00000003.348256209.0000000005189000.00000004.00000020.00020000.00000000.sdmp	WEBSHELL_asp_generic	Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file	Arnim Rupp	0x14ce:$asp_gen_obf1: "+" 0x14fe:$asp_gen_obf1: "+" 0x338e:$asp_gen_obf1: "+" 0x33be:$asp_gen_obf1: "+" 0x4e8e:$asp_gen_obf1: "+" 0x4ebe:$asp_gen_obf1: "+" 0x48fa:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x4a1a:$tagasp_classid5: 0D43FE01-F093-11CF-8940-00A0C9054228 0x1962:$jsp4: public 0x1fa2:$jsp4: public 0x2e6a:$jsp4: public 0x3822:$jsp4: public 0x3e62:$jsp4: public 0x5322:$jsp4: public 0x5962:$jsp4: public 0x12e2:$asp_input1: request 0x1b10:$asp_input1: request 0x1b52:$asp_input1: request 0x1c68:$asp_input1: request 0x31a2:$asp_input1: request 0x39d0:$asp_input1: request
0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_3	Yara detected Emotet	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
12.2.regsvr32.exe.1220000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.regsvr32.exe.1220000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.regsvr32.exe.f10000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.regsvr32.exe.f10000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security

Sigma Signatures

Malware Analysis System Evasion

Sigma detected: Run temp file via regsvr32

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll, CommandLine: C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf", ParentImage: C:\Windows\SysWOW64\wscript.exe, ParentProcessId: 4976, ParentProcessName: wscript.exe, ProcessCommandLine: C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll, ProcessId: 4920, ProcessName: regsvr32.exe

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 16 - Source IP: 192.168.2.3 - Destination IP: 66.228.32.31

Timestamp:	192.168.2.366.228.32.314968670802404330 03/17/23-09:17:28.925917
SID:	2404330
Source Port:	49686
Destination Port:	7080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 2 - Source IP: 192.168.2.3 - Destination IP: 104.168.155.143

Timestamp:	192.168.2.3104.168.155.1434969480802404302 03/17/23-09:18:01.076339
SID:	2404302
Source Port:	49694
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 7 - Source IP: 192.168.2.3 - Destination IP: 182.162.143.56

Timestamp:	192.168.2.3182.162.143.56496874432404312 03/17/23-09:17:34.182038
SID:	2404312
Source Port:	49687
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 23 - Source IP: 192.168.2.3 - Destination IP: 91.121.146.47

Timestamp:	192.168.2.391.121.146.474968480802404344 03/17/23-09:17:19.192203
SID:	2404344
Source Port:	49684
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 5 - Source IP: 192.168.2.3 - Destination IP: 167.172.199.165

Timestamp:	192.168.2.3167.172.199.1654968980802404308 03/17/23-09:17:48.416747
SID:	2404308
Source Port:	49689
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Insight_Medical_Publishing_3.one	ReversingLabs: Detection: 30%
Source: Insight_Medical_Publishing_3.one	Virustotal: Detection: 41%			Perma Link

Antivirus detection for URL or domain

Source: https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/#	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/eB	Avira URL Cloud: Label: malware
Source: https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	Avira URL Cloud: Label: malware
Source: https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/x	Avira URL Cloud: Label: malware
Source: http://softwareulike.com/cWIYxWMPkK/	Avira URL Cloud: Label: malware
Source: https://159.89.202.34/	Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/	Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	Avira URL Cloud: Label: malware
Source: https://www.gomespontes.com.br/logs/pd/vM	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/l	Avira URL Cloud: Label: malware
Source: https://159.89.202.34/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/h	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/IT	Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/000	Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/.dll	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/n	Avira URL Cloud: Label: malware
Source: http://ozmeydan.com/cekici/9/	Avira URL Cloud: Label: malware
Source: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/wM	Avira URL Cloud: Label: malware
Source: https://www.gomespontes.com.br/logs/pd/	Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/tM	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/mwollpl/	Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/uM	Avira URL Cloud: Label: malware
Source: https://penshorn.org/admin/Ses8712iGR8du/	Avira URL Cloud: Label: malware
Source: http://softwareulike.com/cWIYxWMPkK/7	Avira URL Cloud: Label: malware
Source: https://66.228.32.31:7080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	Avira URL Cloud: Label: malware
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/	Avira URL Cloud: Label: malware
Source: http://softwareulike.com/cWIYxWMPkK/yM	Avira URL Cloud: Label: malware
Source: https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/l/	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/8	Avira URL Cloud: Label: malware
Source: https://159.89.202.34/I	Avira URL Cloud: Label: malware
Source: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/.dllNZr	Avira URL Cloud: Label: malware
Source: http://ozmeydan.com/cekici/9/xM	Avira URL Cloud: Label: malware
Source: https://187.63.160.88:80/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/01	Avira URL Cloud: Label: malware
Source: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/	Avira URL Cloud: Label: malware
Source: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/zM	Avira URL Cloud: Label: malware
Source: https://66.228.32.31:7080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/_	Avira URL Cloud: Label: malware
Source: https://159.89.202.34/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	Avira URL Cloud: Label: malware
Source: https://164.90.222.65/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	Avira URL Cloud: Label: malware
Source: https://163.44.196.120:8080/3	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: penshorn.org	Virustotal: Detection: 10%	Perma Link
Source: https://159.89.202.34/	Virustotal: Detection: 18%	Perma Link
Source: http://softwareulike.com/cWIYxWMPkK/	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll	ReversingLabs: Detection: 58%
Source: C:\Windows\System32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll (copy)	ReversingLabs: Detection: 58%

Source: 0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Emotet {"C2 list": ["91.121.146.47:8080", "66.228.32.31:7080", "182.162.143.56:443", "187.63.160.88:80", "167.172.199.165:8080", "164.90.222.65:443", "104.168.155.143:8080", "163.44.196.120:8080", "160.16.142.56:8080", "159.89.202.34:443", "159.65.88.10:8080", "186.194.240.217:443", "149.56.131.28:8080", "72.15.201.15:8080", "1.234.2.232:8080", "82.223.21.224:8080", "206.189.28.199:8080", "169.57.156.166:8080", "107.170.39.149:8080", "103.43.75.120:443", "91.207.28.33:8080", "213.239.212.5:443", "45.235.8.30:8080", "119.59.103.152:8080", "164.68.99.3:8080", "95.217.221.146:8080", "153.126.146.25:7080", "197.242.150.244:8080", "202.129.205.3:8080", "103.132.242.26:8080", "139.59.126.41:443", "110.232.117.186:8080", "183.111.227.137:8080", "5.135.159.50:443", "201.94.166.162:443", "103.75.201.2:443", "79.137.35.198:8080", "172.105.226.75:8080", "94.23.45.86:4143", "115.68.227.76:8080", "153.92.5.27:8080", "167.172.253.162:8080", "188.44.20.25:443", "147.139.166.154:8080", "129.232.188.93:443", "173.212.193.249:8080", "185.4.135.165:8080", "45.176.232.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5OWVpqQATAJA=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2gGXgqQAuAJA="]}

Source: unknown	HTTPS traffic detected: 203.26.41.131:443 -> 192.168.2.3:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.3:49687 version: TLS 1.2

Source:	Binary string: ain.pdb source: OneNote15WatsonLog.etl.0.dr
Source:	Binary string: P:\Target\x86\ship\onenote\x-none\onmain.pdbain.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: OneNote15WatsonLog.etl.0.dr
Source:	Binary string: P:\Target\x86\ship\onenote\x-none\onmain.pdb source: OneNote15WatsonLog.etl.0.dr

Source: C:\Windows\System32\regsvr32.exe

Code function: 11_2_0000000180008D28 FindFirstFileExW,

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE

Process created: C:\Windows\SysWOW64\wscript.exe

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 164.90.222.65 443
Source: C:\Windows\SysWOW64\wscript.exe	Network Connect: 203.26.41.131 443
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: penshorn.org
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 66.228.32.31 7080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 187.63.160.88 80
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 104.168.155.143 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 159.89.202.34 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 91.121.146.47 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 160.16.142.56 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 182.162.143.56 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 167.172.199.165 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 163.44.196.120 8080

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2404312 ET CNC Feodo Tracker Reported CnC Server TCP group 7 192.168.2.3:49687 -> 182.162.143.56:443
Source: Traffic	Snort IDS: 2404344 ET CNC Feodo Tracker Reported CnC Server TCP group 23 192.168.2.3:49684 -> 91.121.146.47:8080
Source: Traffic	Snort IDS: 2404330 ET CNC Feodo Tracker Reported CnC Server TCP group 16 192.168.2.3:49686 -> 66.228.32.31:7080
Source: Traffic	Snort IDS: 2404308 ET CNC Feodo Tracker Reported CnC Server TCP group 5 192.168.2.3:49689 -> 167.172.199.165:8080
Source: Traffic	Snort IDS: 2404302 ET CNC Feodo Tracker Reported CnC Server TCP group 2 192.168.2.3:49694 -> 104.168.155.143:8080

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 91.121.146.47:8080
Source: Malware configuration extractor	IPs: 66.228.32.31:7080
Source: Malware configuration extractor	IPs: 182.162.143.56:443
Source: Malware configuration extractor	IPs: 187.63.160.88:80
Source: Malware configuration extractor	IPs: 167.172.199.165:8080
Source: Malware configuration extractor	IPs: 164.90.222.65:443
Source: Malware configuration extractor	IPs: 104.168.155.143:8080
Source: Malware configuration extractor	IPs: 163.44.196.120:8080
Source: Malware configuration extractor	IPs: 160.16.142.56:8080
Source: Malware configuration extractor	IPs: 159.89.202.34:443
Source: Malware configuration extractor	IPs: 159.65.88.10:8080
Source: Malware configuration extractor	IPs: 186.194.240.217:443
Source: Malware configuration extractor	IPs: 149.56.131.28:8080
Source: Malware configuration extractor	IPs: 72.15.201.15:8080
Source: Malware configuration extractor	IPs: 1.234.2.232:8080
Source: Malware configuration extractor	IPs: 82.223.21.224:8080
Source: Malware configuration extractor	IPs: 206.189.28.199:8080
Source: Malware configuration extractor	IPs: 169.57.156.166:8080
Source: Malware configuration extractor	IPs: 107.170.39.149:8080
Source: Malware configuration extractor	IPs: 103.43.75.120:443
Source: Malware configuration extractor	IPs: 91.207.28.33:8080
Source: Malware configuration extractor	IPs: 213.239.212.5:443
Source: Malware configuration extractor	IPs: 45.235.8.30:8080
Source: Malware configuration extractor	IPs: 119.59.103.152:8080
Source: Malware configuration extractor	IPs: 164.68.99.3:8080
Source: Malware configuration extractor	IPs: 95.217.221.146:8080
Source: Malware configuration extractor	IPs: 153.126.146.25:7080
Source: Malware configuration extractor	IPs: 197.242.150.244:8080
Source: Malware configuration extractor	IPs: 202.129.205.3:8080
Source: Malware configuration extractor	IPs: 103.132.242.26:8080
Source: Malware configuration extractor	IPs: 139.59.126.41:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 183.111.227.137:8080
Source: Malware configuration extractor	IPs: 5.135.159.50:443
Source: Malware configuration extractor	IPs: 201.94.166.162:443
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 79.137.35.198:8080
Source: Malware configuration extractor	IPs: 172.105.226.75:8080
Source: Malware configuration extractor	IPs: 94.23.45.86:4143
Source: Malware configuration extractor	IPs: 115.68.227.76:8080
Source: Malware configuration extractor	IPs: 153.92.5.27:8080
Source: Malware configuration extractor	IPs: 167.172.253.162:8080
Source: Malware configuration extractor	IPs: 188.44.20.25:443
Source: Malware configuration extractor	IPs: 147.139.166.154:8080
Source: Malware configuration extractor	IPs: 129.232.188.93:443
Source: Malware configuration extractor	IPs: 173.212.193.249:8080
Source: Malware configuration extractor	IPs: 185.4.135.165:8080
Source: Malware configuration extractor	IPs: 45.176.232.124:443

Source: Joe Sandbox View

ASN Name: RACKCORP-APRackCorpAU RACKCORP-APRackCorpAU

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: global traffic

HTTP traffic detected: POST /qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 182.162.143.56

Source: Joe Sandbox View

IP Address: 110.232.117.186 110.232.117.186

Source: global traffic

HTTP traffic detected: GET /admin/Ses8712iGR8du/ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: penshorn.org

Source: global traffic	TCP traffic: 192.168.2.3:49684 -> 91.121.146.47:8080
Source: global traffic	TCP traffic: 192.168.2.3:49686 -> 66.228.32.31:7080
Source: global traffic	TCP traffic: 192.168.2.3:49689 -> 167.172.199.165:8080
Source: global traffic	TCP traffic: 192.168.2.3:49694 -> 104.168.155.143:8080
Source: global traffic	TCP traffic: 192.168.2.3:49695 -> 163.44.196.120:8080
Source: global traffic	TCP traffic: 192.168.2.3:49696 -> 160.16.142.56:8080

Source: unknown

Network traffic detected: IP country count 17

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65

Source: wscript.exe, 00000009.00000003.352083171.000000000543B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349954279.0000000005423000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.354073376.000000000543C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351723775.0000000005423000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.424429920.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451389170.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480859658.00000000012FD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.420606431.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 0000000C.00000003.417229525.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/U
Source: regsvr32.exe, 0000000C.00000003.423585505.00000000012C4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480911858.00000000012C4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451389170.00000000012C4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 0000000C.00000003.424429920.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451389170.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480859658.00000000012FD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.420606431.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.12.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 0000000C.00000003.417229525.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8018d46f033f9
Source: regsvr32.exe, 0000000C.00000003.424429920.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451389170.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480859658.00000000012FD000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.420606431.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabn
Source: wscript.exe, wscript.exe, 00000009.00000002.353832790.00000000053B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349674998.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347830775.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347700894.0000000005210000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.335628212.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345132720.00000000050AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ozmeydan.com/cekici/9/
Source: wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ozmeydan.com/cekici/9/xM
Source: wscript.exe, 00000009.00000003.347973913.000000000529E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348372206.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348646615.0000000005321000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348586602.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348295456.00000000052AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351610411.0000000005331000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.353640909.0000000005331000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348732137.0000000005328000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348458187.00000000052EB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348118755.00000000052A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://softwareulike.com/cWIYxW
Source: wscript.exe, wscript.exe, 00000009.00000002.353832790.00000000053B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349674998.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347830775.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347700894.0000000005210000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.335628212.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345132720.00000000050AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://softwareulike.com/cWIYxWMPkK/
Source: wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.346224913.0000000005175000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345755235.0000000005160000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347622434.0000000005182000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.353529377.000000000518B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347751255.0000000005182000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348256209.0000000005189000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://softwareulike.com/cWIYxWMPkK/7
Source: wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://softwareulike.com/cWIYxWMPkK/yM
Source: wscript.exe, wscript.exe, 00000009.00000002.353832790.00000000053B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349674998.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347830775.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347700894.0000000005210000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.335628212.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345132720.00000000050AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/
Source: wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/zM
Source: regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.89.202.34/
Source: regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.89.202.34/I
Source: regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.89.202.34/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/
Source: regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.89.202.34/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/h
Source: regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://160.16.142.56:8080/
Source: regsvr32.exe, 0000000C.00000002.580495908.000000000334F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://160.16.142.56:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/
Source: regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://160.16.142.56:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl//6(
Source: regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://163.44.196.120:8080/3
Source: regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/
Source: regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480859658.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/
Source: regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480859658.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/8
Source: regsvr32.exe, 0000000C.00000003.480859658.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/l
Source: regsvr32.exe, 0000000C.00000003.480859658.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/mwollpl/
Source: regsvr32.exe, 0000000C.00000003.480911858.00000000012C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/
Source: regsvr32.exe, 0000000C.00000003.480911858.00000000012C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/#
Source: regsvr32.exe, 0000000C.00000003.480859658.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/IT
Source: regsvr32.exe, 0000000C.00000003.480788885.000000000334E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.580495908.000000000334F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/eB
Source: regsvr32.exe, 0000000C.00000003.480788885.000000000334E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.580495908.000000000334F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/n
Source: regsvr32.exe, 0000000C.00000003.451389170.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://182.162.143.56/
Source: regsvr32.exe, 0000000C.00000003.451389170.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451113819.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/
Source: regsvr32.exe, 0000000C.00000003.451113819.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/l/
Source: regsvr32.exe, 0000000C.00000003.480788885.000000000334E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/x
Source: regsvr32.exe, 0000000C.00000003.480788885.000000000334E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://187.172.199.165:8080/
Source: regsvr32.exe, 0000000C.00000003.480788885.000000000334E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.580495908.000000000334F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://187.63.160.88:80/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/01
Source: regsvr32.exe, 0000000C.00000003.451389170.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451113819.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://66.228.32.31:7080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/
Source: regsvr32.exe, 0000000C.00000003.451389170.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451113819.000000000133A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://66.228.32.31:7080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/_
Source: regsvr32.exe, 0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.121.146.47:8080/
Source: regsvr32.exe, 0000000C.00000003.421394475.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480911858.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451113819.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.121.146.47:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/
Source: regsvr32.exe, 0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.121.146.47:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/000
Source: wscript.exe, wscript.exe, 00000009.00000002.353832790.00000000053B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349674998.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347830775.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347700894.0000000005210000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.335628212.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347622434.000000000512D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/
Source: wscript.exe, 00000009.00000003.349639269.000000000538E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349867697.0000000005396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/.dll
Source: wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349438794.0000000005384000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349093361.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349339319.000000000537A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/.dllNZr
Source: wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/uM
Source: regsvr32.exe, 0000000C.00000003.480911858.00000000012C4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451389170.00000000012C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pe2.162.143.56/
Source: wscript.exe, 00000009.00000003.349954279.0000000005423000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.350000568.000000000540A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.354012857.000000000540A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351723775.0000000005423000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.354073376.0000000005423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://penshorn.org/
Source: wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.350249586.0000000004B2D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.350180272.0000000004B29000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345132720.00000000050C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345037298.000000000510B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345791230.00000000050EF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.343112035.0000000004FCF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337309001.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/
Source: wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://penshorn.org/admin/Ses8712iGR8du/tM
Source: wscript.exe, 00000009.00000003.347225816.00000000050AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFb
Source: wscript.exe, 00000009.00000003.347973913.000000000529E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348372206.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348646615.0000000005321000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348586602.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348295456.00000000052AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351610411.0000000005331000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.353640909.0000000005331000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348732137.0000000005328000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348458187.00000000052EB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348118755.00000000052A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1j
Source: wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347622434.000000000512D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345132720.00000000050C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345037298.000000000510B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345791230.00000000050EF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.343112035.0000000004FCF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337309001.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349571912.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.343189350.0000000004FAE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347462886.00000000051C6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.343401747.0000000005065000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/
Source: wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/wM
Source: wscript.exe, wscript.exe, 00000009.00000002.353832790.00000000053B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349674998.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347830775.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347700894.0000000005210000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.335628212.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347622434.000000000512D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gomespontes.com.br/logs/pd/
Source: wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gomespontes.com.br/logs/pd/vM

Source: unknown

HTTP traffic detected: POST /qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 182.162.143.56

Source: unknown

DNS traffic detected: queries for: penshorn.org

Source: global traffic

HTTP traffic detected: GET /admin/Ses8712iGR8du/ HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: penshorn.org

Source: unknown	HTTPS traffic detected: 203.26.41.131:443 -> 192.168.2.3:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 182.162.143.56:443 -> 192.168.2.3:49687 version: TLS 1.2

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 12.2.regsvr32.exe.1220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.regsvr32.exe.1220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.f10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.580204342.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.334740049.0000000000F41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.579427861.0000000001220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.334703858.0000000000F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: 00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 00000009.00000003.346224913.0000000005175000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 00000009.00000003.347622434.0000000005182000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 00000009.00000003.347622434.0000000005182000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 00000009.00000002.353529377.000000000518B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 00000009.00000002.353529377.000000000518B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 00000009.00000003.347751255.0000000005182000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 00000009.00000003.347751255.0000000005182000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 00000009.00000003.348256209.0000000005189000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: webshell_asp_obfuscated date = 2021/01/12, author = Arnim Rupp, description = ASP webshell obfuscated, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06
Source: 00000009.00000003.348256209.0000000005189000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: WEBSHELL_asp_generic date = 2021-03-07, author = Arnim Rupp, description = Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, score = a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2023-01-06

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\ZLTlFkhzfcDaCjB\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0000000180006818
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_000000018000B878
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0000000180007110
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0000000180008D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0000000180014555
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00EF0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5709C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4CC14
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5A000
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F47D6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4263C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F48BC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F58FC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F43CF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F448FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F490F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F520E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F414D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F53CD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F418DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4F8C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F55CC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F480CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F508CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5A8B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F694BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4DCB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F498AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4AC94
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F44C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5CC84
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F55880
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4D474
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F56C70
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4B07C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F42C78
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4C078
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5B460
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F65450
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5C058
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F47840
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5C44C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F51030
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5EC30
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4B83C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F6181C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F41000
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F49408
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F47C08
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5D5F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F515C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F495BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5BDA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F47530
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5B130
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F46138
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F51924
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F54D20
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5AD28
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F69910
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F57518
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F68500
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5610C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F492F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F596D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4D6CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F43ABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4AAB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F44EB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4BE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F54A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F48A8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F64E8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F43274
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F50A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4A660
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4F65C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4B258
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5A244
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4BA2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F58A2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F50E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5662C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F44214
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4461C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F55A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F68A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F43E0C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5020C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F58E08
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4A7F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F627EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F42FD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F433D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F53FD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F597CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F48FB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4FFB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F58BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4DBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F41B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F55384
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5D770
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5CF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4F77C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F48378
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5E750
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F44758
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4D33C
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4EF14
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F53B14
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5E310
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F54F18
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_01210000
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B276A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B30618
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B16E42
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B373A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B163F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B23FD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B18BC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B28FC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B19B79
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B208CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1CC14
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1640A
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B17D6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B32AB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1AAB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B14EB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B13ABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1BE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B24A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B32E84
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B18A8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B34E8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B192F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B336FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B296D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1D6CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1263C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1BA2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B28A2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B20E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2662C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B14214
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1461C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B25A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B38A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B28E08
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B13E0C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2020C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B20A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B13274
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1A660
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1B258
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1F65C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2A244
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B36E48
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B18FB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1FFB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B28BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1DBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B347A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B11B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B25384
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1A7F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2FFFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B327EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B12FD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B133D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B297CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1D33C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2E310
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B38310
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1EF14
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B23B14
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B24F18
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B35B1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2D770
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2CF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B18378
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1F77C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B38B68
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2E750
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B14758
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2A8B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1DCB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B394BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B344A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B198AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1AC94
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B31494
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2709C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B25880
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B14C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2CC84
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B3488C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B13CF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B190F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B148FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B220E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B114D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B23CD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B31CD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B118DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1F8C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B25CC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B180CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B21030
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2EC30
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1B83C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B17410
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B3181C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B11000
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2A000
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B19408
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B17C08
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B26C70
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1D474
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B12C78
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1C078
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B1B07C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2B460
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B35868
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B35450
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2C058
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B17840
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2C44C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B195BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2BDA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2D5F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B215C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2B130
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B16138
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B24D20
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B21924
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2AD28
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B39910
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B27518
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B38500
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B32100
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2610C
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B34D64

Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0000000180010AC0 ExitProcess,RtlQueueApcWow64Thread,NtTestAlert,
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0000000180010DB0 ZwOpenSymbolicLinkObject,ZwOpenSymbolicLinkObject,

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll 2F39C2879989DDD7F9ECF52B6232598E5595F8BF367846FF188C9DFBF1251253

Source: Insight_Medical_Publishing_3.one	ReversingLabs: Detection: 30%
Source: Insight_Medical_Publishing_3.one	Virustotal: Detection: 41%

Source: C:\Windows\SysWOW64\wscript.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE" "C:\Users\user\Desktop\Insight_Medical_Publishing_3.one
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll"
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process created: C:\Windows\SysWOW64\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll"

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32

Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE

File created: C:\Users\user\Documents\{FEEE3FA4-F7B3-4CCE-AC94-72B79C0B1135}

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE

File created: C:\Users\user\AppData\Local\Temp\{1A5C047D-3D28-4AA6-A11A-87D0AFF6CFBA} - OProcSessId.dat

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winONE@9/11@1/49

Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 11_2_00F48BC8 Process32NextW,Process32FirstW,CreateToolhelp32Snapshot,FindCloseChangeNotification,

Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages

Source:	Binary string: ain.pdb source: OneNote15WatsonLog.etl.0.dr
Source:	Binary string: P:\Target\x86\ship\onenote\x-none\onmain.pdbain.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 source: OneNote15WatsonLog.etl.0.dr
Source:	Binary string: P:\Target\x86\ship\onenote\x-none\onmain.pdb source: OneNote15WatsonLog.etl.0.dr

Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0000000180005C69 push rdi; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00000001800056DD push rdi; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4A0FC push ebp; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F580D7 push ebp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F46CDE push esi; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F46C9F pushad ; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4A1D2 push ebp; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F57987 push ebp; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F58157 push ebp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F49D51 push ebp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F57D4E push ebp; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F57D3C push ebp; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F57D25 push 4D8BFFFFh; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F57EAF push 458BCC5Ah; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F49E8B push eax; retf
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F4A26E push ebp; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00F5C731 push esi; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B2C731 push esi; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B16C9F pushad ; ret
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B16CDE push esi; iretd
Source: C:\Windows\System32\regsvr32.exe	Code function: 12_2_02B36D34 push edi; ret

Source: rad38C2A.tmp.dll.9.dr

Static PE information: section name: _RDATA

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll

Source: C:\Windows\SysWOW64\wscript.exe	File created: C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll			Jump to dropped file
Source: C:\Windows\System32\regsvr32.exe	File created: C:\Windows\System32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll (copy)			Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\System32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll (copy)

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe

File opened: C:\Windows\system32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll:Zone.Identifier read attributes | delete

Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\wscript.exe TID: 4956	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\regsvr32.exe TID: 1540	Thread sleep time: -270000s >= -30000s

Source: C:\Windows\System32\regsvr32.exe

API coverage: 8.0 %

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\regsvr32.exe

Code function: 11_2_0000000180008D28 FindFirstFileExW,

Source: C:\Windows\System32\regsvr32.exe

File Volume queried: C:\ FullSizeInformation

Source: regsvr32.exe, 0000000C.00000003.451113819.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.420606431.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0P/
Source: wscript.exe, 00000009.00000002.353992148.00000000053FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: wscript.exe, 00000009.00000003.349954279.0000000005423000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351723775.0000000005423000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.354073376.0000000005423000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.424429920.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451389170.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480911858.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.420606431.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451649748.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000009.00000002.353992148.00000000053FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: regsvr32.exe, 0000000C.00000003.424429920.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451389170.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480911858.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.420606431.00000000012F0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451649748.00000000012F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC

Source: C:\Windows\System32\regsvr32.exe

Code function: 11_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Windows\System32\regsvr32.exe

Code function: 11_2_000000018000A878 GetProcessHeap,

Source: C:\Windows\System32\regsvr32.exe

Code function: 11_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,

Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00000001800082EC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Windows\System32\regsvr32.exe	Code function: 11_2_00000001800017DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 164.90.222.65 443
Source: C:\Windows\SysWOW64\wscript.exe	Network Connect: 203.26.41.131 443
Source: C:\Windows\SysWOW64\wscript.exe	Domain query: penshorn.org
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 66.228.32.31 7080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 187.63.160.88 80
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 104.168.155.143 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 159.89.202.34 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 91.121.146.47 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 160.16.142.56 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 182.162.143.56 443
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 167.172.199.165 8080
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 163.44.196.120 8080

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll

Source: C:\Windows\System32\regsvr32.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\regsvr32.exe

Code function: 11_2_00000001800070A0 cpuid

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\regsvr32.exe

Code function: 11_2_0000000180001D98 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Stealing of Sensitive Information

Yara detected Malicious OneNote

Source: Yara match

File source: Insight_Medical_Publishing_3.one, type: SAMPLE

Yara detected Emotet

Source: Yara match	File source: 0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 12.2.regsvr32.exe.1220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.regsvr32.exe.1220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.f10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.regsvr32.exe.f10000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.580204342.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.334740049.0000000000F41000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.579427861.0000000001220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.334703858.0000000000F10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Malicious OneNote

Source: Yara match

File source: Insight_Medical_Publishing_3.one, type: SAMPLE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	1 DLL Side-Loading	111 Process Injection	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Exploitation for Client Execution	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Scripting	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	114 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Regsvr32	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Insight_Medical_Publishing_3.one	31%	ReversingLabs	Script-WScript.Trojan.OneNote
Insight_Medical_Publishing_3.one	41%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll	58%	ReversingLabs	Win64.Trojan.Emotet
C:\Windows\System32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll (copy)	58%	ReversingLabs	Win64.Trojan.Emotet

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
12.2.regsvr32.exe.1220000.0.unpack	100%	Avira	HEUR/AGEN.1215476		Download File
11.2.regsvr32.exe.f10000.0.unpack	100%	Avira	HEUR/AGEN.1215476		Download File

Domains

Source	Detection	Scanner	Label	Link
penshorn.org	11%	Virustotal		Browse
windowsupdatebg.s.llnwi.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://182.162.143.56/	0%	URL Reputation	safe
https://182.162.143.56/	0%	URL Reputation	safe
https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/#	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/eB	100%	Avira URL Cloud	malware
https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	100%	Avira URL Cloud	malware
https://159.89.202.34/	19%	Virustotal		Browse
http://softwareulike.com/cWIYxWMPkK/	16%	Virustotal		Browse
https://91.121.146.47:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	100%	Avira URL Cloud	malware
https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/x	100%	Avira URL Cloud	malware
https://pe2.162.143.56/	0%	Avira URL Cloud	safe
http://softwareulike.com/cWIYxWMPkK/	100%	Avira URL Cloud	malware
https://159.89.202.34/	100%	Avira URL Cloud	malware
https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/	100%	Avira URL Cloud	malware
https://91.121.146.47:8080/	100%	Avira URL Cloud	malware
https://187.172.199.165:8080/	0%	Avira URL Cloud	safe
https://160.16.142.56:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	0%	Avira URL Cloud	safe
https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	100%	Avira URL Cloud	malware
https://160.16.142.56:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl//6(	0%	Avira URL Cloud	safe
https://www.gomespontes.com.br/logs/pd/vM	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/l	100%	Avira URL Cloud	malware
https://159.89.202.34/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/h	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/IT	100%	Avira URL Cloud	malware
https://91.121.146.47:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/000	100%	Avira URL Cloud	malware
https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/.dll	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/n	100%	Avira URL Cloud	malware
https://portalevolucao.com/GerarBoleto/fLIOoFb	0%	Avira URL Cloud	safe
http://ozmeydan.com/cekici/9/	100%	Avira URL Cloud	malware
https://penshorn.org/	0%	Avira URL Cloud	safe
https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/wM	100%	Avira URL Cloud	malware
https://www.gomespontes.com.br/logs/pd/	100%	Avira URL Cloud	malware
https://penshorn.org/admin/Ses8712iGR8du/tM	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/mwollpl/	100%	Avira URL Cloud	malware
https://portalevolucao.com/GerarBoleto/fLIOoFbFs1j	0%	Avira URL Cloud	safe
https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/uM	100%	Avira URL Cloud	malware
https://penshorn.org/admin/Ses8712iGR8du/	100%	Avira URL Cloud	malware
http://softwareulike.com/cWIYxWMPkK/7	100%	Avira URL Cloud	malware
https://66.228.32.31:7080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	100%	Avira URL Cloud	malware
http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/	100%	Avira URL Cloud	malware
http://softwareulike.com/cWIYxWMPkK/yM	100%	Avira URL Cloud	malware
https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/l/	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/8	100%	Avira URL Cloud	malware
https://159.89.202.34/I	100%	Avira URL Cloud	malware
https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/.dllNZr	100%	Avira URL Cloud	malware
http://softwareulike.com/cWIYxW	0%	Avira URL Cloud	safe
http://ozmeydan.com/cekici/9/xM	100%	Avira URL Cloud	malware
https://187.63.160.88:80/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/01	100%	Avira URL Cloud	malware
https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/	100%	Avira URL Cloud	malware
http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/zM	100%	Avira URL Cloud	malware
https://66.228.32.31:7080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/_	100%	Avira URL Cloud	malware
https://159.89.202.34/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	100%	Avira URL Cloud	malware
https://160.16.142.56:8080/	0%	Avira URL Cloud	safe
https://164.90.222.65/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	100%	Avira URL Cloud	malware
https://163.44.196.120:8080/3	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
penshorn.org	203.26.41.131	true	true	11%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	178.79.242.128	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	true	Avira URL Cloud: malware	unknown
https://penshorn.org/admin/Ses8712iGR8du/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://softwareulike.com/cWIYxWMPkK/	wscript.exe, wscript.exe, 00000009.00000002.353832790.00000000053B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349674998.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347830775.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347700894.0000000005210000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.335628212.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345132720.00000000050AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/eB	regsvr32.exe, 0000000C.00000003.480788885.000000000334E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.580495908.000000000334F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://159.89.202.34/	regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://182.162.143.56/	regsvr32.exe, 0000000C.00000003.451389170.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/#	regsvr32.exe, 0000000C.00000003.480911858.00000000012C4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://91.121.146.47:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	regsvr32.exe, 0000000C.00000003.421394475.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480911858.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451113819.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/x	regsvr32.exe, 0000000C.00000003.480788885.000000000334E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://pe2.162.143.56/	regsvr32.exe, 0000000C.00000003.480911858.00000000012C4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451389170.00000000012C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/	wscript.exe, wscript.exe, 00000009.00000002.353832790.00000000053B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349674998.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347830775.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347700894.0000000005210000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.335628212.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347622434.000000000512D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	regsvr32.exe, 0000000C.00000003.480911858.00000000012C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://91.121.146.47:8080/	regsvr32.exe, 0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://160.16.142.56:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	regsvr32.exe, 0000000C.00000002.580495908.000000000334F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://187.172.199.165:8080/	regsvr32.exe, 0000000C.00000003.480788885.000000000334E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://160.16.142.56:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl//6(	regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.gomespontes.com.br/logs/pd/vM	wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/l	regsvr32.exe, 0000000C.00000003.480859658.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/	regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480859658.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://159.89.202.34/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/h	regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/IT	regsvr32.exe, 0000000C.00000003.480859658.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://91.121.146.47:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/000	regsvr32.exe, 0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/.dll	wscript.exe, 00000009.00000003.349639269.000000000538E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349867697.0000000005396000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/n	regsvr32.exe, 0000000C.00000003.480788885.000000000334E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.580495908.000000000334F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://portalevolucao.com/GerarBoleto/fLIOoFb	wscript.exe, 00000009.00000003.347225816.00000000050AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ozmeydan.com/cekici/9/	wscript.exe, wscript.exe, 00000009.00000002.353832790.00000000053B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349674998.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347830775.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347700894.0000000005210000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.335628212.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345132720.00000000050AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://penshorn.org/	wscript.exe, 00000009.00000003.349954279.0000000005423000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.350000568.000000000540A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.354012857.000000000540A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351723775.0000000005423000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.354073376.0000000005423000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/wM	wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.gomespontes.com.br/logs/pd/	wscript.exe, wscript.exe, 00000009.00000002.353832790.00000000053B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349674998.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347830775.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347700894.0000000005210000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.335628212.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347622434.000000000512D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://penshorn.org/admin/Ses8712iGR8du/tM	wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/mwollpl/	regsvr32.exe, 0000000C.00000003.480859658.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://portalevolucao.com/GerarBoleto/fLIOoFbFs1j	wscript.exe, 00000009.00000003.347973913.000000000529E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348372206.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348646615.0000000005321000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348586602.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348295456.00000000052AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351610411.0000000005331000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.353640909.0000000005331000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348732137.0000000005328000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348458187.00000000052EB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348118755.00000000052A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/uM	wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://softwareulike.com/cWIYxWMPkK/7	wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.346224913.0000000005175000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345755235.0000000005160000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347622434.0000000005182000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.353529377.000000000518B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347751255.0000000005182000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348256209.0000000005189000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://66.228.32.31:7080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	regsvr32.exe, 0000000C.00000003.451389170.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451113819.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/	wscript.exe, wscript.exe, 00000009.00000002.353832790.00000000053B9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F4F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349674998.00000000053B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347830775.0000000005237000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347700894.0000000005210000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EA0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.335628212.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.338453916.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345054891.00000000050AC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345132720.00000000050AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://softwareulike.com/cWIYxWMPkK/yM	wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://182.162.143.56/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/l/	regsvr32.exe, 0000000C.00000003.451113819.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/8	regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.480859658.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://159.89.202.34/I	regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bbvoyage.com/useragreement/ElKHvb4QIQqSrh6Hqm/.dllNZr	wscript.exe, 00000009.00000003.349283109.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349438794.0000000005384000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349093361.000000000536E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349339319.000000000537A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://softwareulike.com/cWIYxW	wscript.exe, 00000009.00000003.347973913.000000000529E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348372206.00000000052DD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348646615.0000000005321000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348586602.00000000052F4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348295456.00000000052AD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351610411.0000000005331000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.353640909.0000000005331000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348732137.0000000005328000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348458187.00000000052EB000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348118755.00000000052A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ozmeydan.com/cekici/9/xM	wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://187.63.160.88:80/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/01	regsvr32.exe, 0000000C.00000003.480788885.000000000334E000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.580495908.000000000334F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://portalevolucao.com/GerarBoleto/fLIOoFbFs1jHtX/	wscript.exe, 00000009.00000003.348896452.0000000005346000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337749840.0000000004EB3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345265478.0000000005158000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.351239933.00000000052BD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.342436422.0000000004F6A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.340495152.0000000004F55000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348209733.0000000005208000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349520694.00000000053A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347622434.000000000512D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345132720.00000000050C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345037298.000000000510B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.345791230.00000000050EF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.343112035.0000000004FCF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337309001.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.337545792.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.349571912.00000000053A7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.343189350.0000000004FAE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.347462886.00000000051C6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.343401747.0000000005065000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://wrappixels.com/wp-admin/GdIA2oOQEiO5G/zM	wscript.exe, 00000009.00000003.350048423.0000000004B54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://66.228.32.31:7080/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/_	regsvr32.exe, 0000000C.00000003.451389170.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000003.451113819.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://159.89.202.34/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://160.16.142.56:8080/	regsvr32.exe, 0000000C.00000002.579752485.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://164.90.222.65/qudwkmxm/xmonncmqfa/dpvphsc/beehnbizxmwollpl/	regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://163.44.196.120:8080/3	regsvr32.exe, 0000000C.00000002.579752485.000000000133A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
103.132.242.26	unknown	India	45117	INPL-IN-APIshansNetworkIN	true
104.168.155.143	unknown	United States	54290	HOSTWINDSUS	true
79.137.35.198	unknown	France	16276	OVHFR	true
115.68.227.76	unknown	Korea Republic of	38700	SMILESERV-AS-KRSMILESERVKR	true
163.44.196.120	unknown	Singapore	135161	GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	true
206.189.28.199	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
203.26.41.131	penshorn.org	Australia	38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	true
107.170.39.149	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
66.228.32.31	unknown	United States	63949	LINODE-APLinodeLLCUS	true
197.242.150.244	unknown	South Africa	37611	AfrihostZA	true
185.4.135.165	unknown	Greece	199246	TOPHOSTGR	true
183.111.227.137	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
45.176.232.124	unknown	Colombia	267869	CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC	true
169.57.156.166	unknown	United States	36351	SOFTLAYERUS	true
164.68.99.3	unknown	Germany	51167	CONTABODE	true
139.59.126.41	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
167.172.253.162	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
167.172.199.165	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
202.129.205.3	unknown	Thailand	45328	NIPA-AS-THNIPATECHNOLOGYCOLTDTH	true
147.139.166.154	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
153.92.5.27	unknown	Germany	47583	AS-HOSTINGERLT	true
159.65.88.10	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
172.105.226.75	unknown	United States	63949	LINODE-APLinodeLLCUS	true
164.90.222.65	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
213.239.212.5	unknown	Germany	24940	HETZNER-ASDE	true
5.135.159.50	unknown	France	16276	OVHFR	true
186.194.240.217	unknown	Brazil	262733	NetceteraTelecomunicacoesLtdaBR	true
119.59.103.152	unknown	Thailand	56067	METRABYTE-TH453LadplacoutJorakhaebuaTH	true
159.89.202.34	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
91.121.146.47	unknown	France	16276	OVHFR	true
160.16.142.56	unknown	Japan	9370	SAKURA-BSAKURAInternetIncJP	true
201.94.166.162	unknown	Brazil	28573	CLAROSABR	true
91.207.28.33	unknown	Kyrgyzstan	39819	PROHOSTKG	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
103.43.75.120	unknown	Japan	20473	AS-CHOOPAUS	true
188.44.20.25	unknown	Macedonia	57374	GIV-ASMK	true
45.235.8.30	unknown	Brazil	267405	WIKINETTELECOMUNICACOESBR	true
153.126.146.25	unknown	Japan	7684	SAKURA-ASAKURAInternetIncJP	true
72.15.201.15	unknown	United States	13649	ASN-VINSUS	true
187.63.160.88	unknown	Brazil	28169	BITCOMPROVEDORDESERVICOSDEINTERNETLTDABR	true
82.223.21.224	unknown	Spain	8560	ONEANDONE-ASBrauerstrasse48DE	true
173.212.193.249	unknown	Germany	51167	CONTABODE	true
95.217.221.146	unknown	Germany	24940	HETZNER-ASDE	true
149.56.131.28	unknown	Canada	16276	OVHFR	true
182.162.143.56	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
1.234.2.232	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
129.232.188.93	unknown	South Africa	37153	xneeloZA	true
94.23.45.86	unknown	France	16276	OVHFR	true

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	828495
Start date and time:	2023-03-17 09:15:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 0s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Insight_Medical_Publishing_3.one
Detection:	MAL
Classification:	mal100.troj.expl.evad.winONE@9/11@1/49
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 50.2% (good quality ratio 42.4%) Quality average: 60.5% Quality standard deviation: 35.6%
HCA Information:	Successful, ratio: 89% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .one

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 93.184.221.240, 95.140.230.192
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:16:48	API Interceptor	2x Sleep call for process: wscript.exe modified
09:17:21	API Interceptor	10x Sleep call for process: regsvr32.exe modified

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 62582 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	62582
Entropy (8bit):	7.996063107774368
Encrypted:	true
SSDEEP:	1536:Jk3XPi43VgGp0gB2itudTSRAn/TWTdWftu:CHa43V5p022iZ4CgA
MD5:	E71C8443AE0BC2E282C73FAEAD0A6DD3
SHA1:	0C110C1B01E68EDFACAEAE64781A37B1995FA94B
SHA-256:	95B0A5ACC5BF70D3ABDFD091D0C9F9063AA4FDE65BD34DBF16786082E1992E72
SHA-512:	B38458C7FA2825AFB72794F374827403D5946B1132E136A0CE075DFD351277CF7D957C88DC8A1E4ADC3BCAE1FA8010DAE3831E268E910D517691DE24326391A6
Malicious:	false
Preview:	MSCF....v.......,...................I.................BVrl .authroot.stl....oJ5..CK..8U....a..3.1.P. J.".t..2F2e.dHH......$E.KB.2D..-SJE....^..'..y.}..,{m.....\...]4.G.......h....148...e.gr.....48:.L...g.....Xef.x:..t...J...6-....kW6Z>....&......ye.U.Q&z:.vZ..._....a...]..T.E.....B.h.,...[....V.O.3..EW.x.?.Q..$.@.W..=.B.f..8a.Y.JK..g./%p..C.4CD.s..Jd.u..@.g=...a.. .h%..'.xjy7.E..\.....A..':.4TdW?Ko3$.Hg.z.d~....../q..C.....`...A[ W(.........9...GZ.;....l&?........F...p?... .p.....{S.L4..v.+...7.T?.....p..`..&..9.......f...0+.L.....1.2b)..vX5L'.~....2vz.,E.Ni.{#...o..w.?.#.3..h.v<.S%.].tD@!Le.w.q.7.8....QW.FT.....hE.........Y............./.%Q...k....Y.n..v.A..../...>B..5\..-Ko.......O<.b.K.{.O.b...._.7...4.;%9N..K.X>......kg-9..r.c.g.G\|.[.-...HT...",?.q...ad....7RE.......!f..#../....?.-.^.K.c^...+{.g......]<..$.=.O....ii7.wJ+S..Z..d.....>..J*...T..Q7..`.r,<$....\d:K`..T.n....N.....C..j.;.1SX..j....1...R....+....Yg....]....3..9..S..D..`.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	290
Entropy (8bit):	2.9542848029467006
Encrypted:	false
SSDEEP:	6:kKNg1ry/CN+SkQlPlEGYRMY9z+4KlDA3RUe/:WJCpkPlE99SNxAhUe/
MD5:	D9F329065228D1052F80DFD86FBAF630
SHA1:	BEB453F722F5DA26BAB114412369BC790455C431
SHA-256:	4B5C31C51235D3A2F1AFA5BCE16D41AA2DA95014B493C526637BE6E1865EF2EB
SHA-512:	BF037A5AFFF2DB2BDA7BC204BEBAE79192DC1DF823C7496BD669ECE3395ACD01BF5C9461666A32C9F2E679665EE7068EA9049E51181FCF454A7033F34803DF55
Malicious:	false
Preview:	p...... .........1...X..(....................................................... ..........).K..................v...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\header

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE
File Type:	Matlab v4 mat-file (little endian) \340\004, numeric, rows 262223750, columns 0
Category:	dropped
Size (bytes):	72
Entropy (8bit):	2.106463217645438
Encrypted:	false
SSDEEP:	3:ulXH+lS8TcRaAqlAaRtl:KelS8Tc8TX
MD5:	6D35FE979A2AF81158578D8FF8AA4390
SHA1:	4FACFE5FFF9553E926FC82615BBFF18F47876715
SHA-256:	41E5436CD2453FF8DC3D187CCC680CE58212D72C77CCA0E632B51085BDE7ECED
SHA-512:	947226E35A9BEC0F93AE0467AC23DBE81EFC681A48F3FE6F49F70A2B0BDD35AB533165240D442C2492EA57D29CFA403B848FF8E9BB6EFEADAB507C12DEAE4CEE
Malicious:	false
Preview:	.....7..........$...................................T...................

C:\Users\user\AppData\Local\Temp\OneNote15WatsonLog.etl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.7053394102816869
Encrypted:	false
SSDEEP:	48:geymLsJE+mZc8/hzSlZWV6dNg6qnuaLvOlSosUZKg9eiDx8lW:NiuPZGlZWV6da6+uazODZKDiDv
MD5:	DD5E5ED496A7861D9B6F291070CC5F5B
SHA1:	697CDBB2F039943BE9EB82B52D5711709BC998E1
SHA-256:	B1D13B637698D27B702BD7797D61AD1B2A297FDF8758B5E653DF2AE3961612D8
SHA-512:	486214A36237BAB2DC7925CDCBA1F799A3F790C0BB18FBABEEECA7C47568376E3E520DD185F7D53878C2B955B7D2CC122DAA4EA377B221BF6E5D2AD313670EF1
Malicious:	false
Preview:	.@..`....................................................................................t...............@.......B...........X..Zb..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..............................................................[...... .....p....X..........O.n.e.N.o.t.e. .W.a.t.s.o.n. .L.o.g...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.n.e.N.o.t.e.1.5.W.a.t.s.o.n.L.o.g...e.t.l.......P.P.............................................................................7.B..t......17134.1.x86fre.rs4_release.180410-1804......$.@..t......U......@..%\|n.z.....P:\Target\x86\ship\onenote\x-none\onmain.pdb.ain.pdb.0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000.............................................

C:\Users\user\AppData\Local\Temp\click.wsf

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.94770277922009
Encrypted:	false
SSDEEP:	3:tWn:tWn
MD5:	07F5A0CFFD9B2616EA44FB90CCC04480
SHA1:	641B12C5FFA1A31BC367390E34D441A9CE1958EE
SHA-256:	A0430A038E7D879375C9CA5BF94CB440A3B9A002712118A7BCCC1FF82F1EA896
SHA-512:	09E7488C138DEAD45343A79AD0CB37036C5444606CDFD8AA859EE70227A96964376A17F07E03D0FC353708CA9AAF979ABF8BC917E6C2D005A0052575E074F531
Malicious:	true
Preview:	badum tss

C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll

Download File

Process:	C:\Windows\SysWOW64\wscript.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	316928
Entropy (8bit):	7.337848702590508
Encrypted:	false
SSDEEP:	6144:cwNQMQTlfdUPABVy559hhR3iP7TfPYbrF1EFVw0todxKROsCt:rNbadDBkZ6rPeEFizdxxsCt
MD5:	BFC060937DC90B273ECCB6825145F298
SHA1:	C156C00C7E918F0CB7363614FB1F177C90D8108A
SHA-256:	2F39C2879989DDD7F9ECF52B6232598E5595F8BF367846FF188C9DFBF1251253
SHA-512:	CC1FEE19314B0A0F9E292FA84F6E98F087033D77DB937848DDA1DA0C88F49997866CBA5465DF04BF929B810B42FDB81481341064C4565C9B6272FA7F3B473AC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L`.=...n...n...nCy.o...nCy.o...nCy.o...n.z.o(..n.z.o...n.z.o...nCy.o...n...nq..n.z.o...n.z.o...n.zsn...n...n...n.z.o...nRich...n................PE..d....6.d.........." ...!.F...................................................0............ .............................................T...d...d....`..(....0............... ..........8...........................p...@............`..`............................text....D.......F.................. ..`.rdata.......`.......J..............@..@.data...............................@....pdata.......0......................@..@_RDATA..\....P......................@..@.rsrc...(....`......................@..@.reloc....... ......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE
File Type:	data
Category:	dropped
Size (bytes):	25280
Entropy (8bit):	0.5433410247296293
Encrypted:	false
SSDEEP:	48:PbnnYsDoODcOOErE5+9olgk8Z4GQTaza2egb:PbzoUOkI+6lAUaza2ee
MD5:	D0642277D4B13D42E7606EF972F5AFE9
SHA1:	ED016803728F5DDC3EA7346683C1F6D93A26F90B
SHA-256:	BB4AC658CDF79F055414BB6981C415ABB9CA64C6CF47D1895FA1D7A8E0A3BEAE
SHA-512:	7FB1F165197D53E3B0CAE3ABDBD19755AFB0F61CA2E602FCC1A14828248E69A607B4CCF84A1C2E1A234F69C99DDAE7823F4044B7A572E3337526BC62E6A90AE3
Malicious:	false
Preview:	.%c....L..=../\.......G...S.h.................?.....I...........................................................................................................h............................b...............i.....N..{..j.............S..L.b.$..+.............................7...7...7...7..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\36a44befa49650d0.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE
File Type:	data
Category:	dropped
Size (bytes):	3873
Entropy (8bit):	3.514272379585467
Encrypted:	false
SSDEEP:	48:N8dQdO1aMIFVbqzqgdCDDGTCDfodRdQdO1aMh7+xGqzWk7dCDGWG5CDdZ0tgH:oKiqfGaoFqLZhgO4
MD5:	9AC073B56A8C9E131C96CEA3E1D410B2
SHA1:	EA91260019132F020F365CDF5201C58D0ED6149E
SHA-256:	F5CA8F18F25E2A9B8F571C4A721E53DC636AD5D4688E240104680352E31B41AE
SHA-512:	A6615C16F9E199B00F4CF381B66BD936BFC21DE93129CD54E5D92CCACB81DEBA556D7F5E3CDE3711B93CD33CC58EC9828A8D372AE5B6D8D0FF3127C77A74115A
Malicious:	false
Preview:	...................................FL..................F.@.. .....Q{....,1..X....Q{...(............................P.O. .:i.....+00.../C:\.....................1......U...PROGRA~2.........L.qV......................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....j.1......P...MICROS~1..R.......P.qV.......]....................m.Q.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.....Z.1......P*...Office16..B.......P.qV.......]......................&.O.f.f.i.c.e.1.6.....b.2.(...qP.. .ONENOTE.EXE.H......qP..qV...............................O.N.E.N.O.T.E...E.X.E.......k...............-.......j...........>.S......C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE....(.W.i.n.d.o.w.s. .+. .N.).../.s.i.d.e.n.o.t.e.<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.O.f.f.i.c.e.1.6.\.O.N.E.N.O.T.E...E.X.E.........%ProgramFiles%\Microsoft Office\Office16\ONENOTE.EXE........................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZUNH4RPCMTORJA8SP86T.temp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE
File Type:	data
Category:	dropped
Size (bytes):	3873
Entropy (8bit):	3.514272379585467
Encrypted:	false
SSDEEP:	48:N8dQdO1aMIFVbqzqgdCDDGTCDfodRdQdO1aMh7+xGqzWk7dCDGWG5CDdZ0tgH:oKiqfGaoFqLZhgO4
MD5:	9AC073B56A8C9E131C96CEA3E1D410B2
SHA1:	EA91260019132F020F365CDF5201C58D0ED6149E
SHA-256:	F5CA8F18F25E2A9B8F571C4A721E53DC636AD5D4688E240104680352E31B41AE
SHA-512:	A6615C16F9E199B00F4CF381B66BD936BFC21DE93129CD54E5D92CCACB81DEBA556D7F5E3CDE3711B93CD33CC58EC9828A8D372AE5B6D8D0FF3127C77A74115A
Malicious:	false
Preview:	...................................FL..................F.@.. .....Q{....,1..X....Q{...(............................P.O. .:i.....+00.../C:\.....................1......U...PROGRA~2.........L.qV......................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....j.1......P...MICROS~1..R.......P.qV.......]....................m.Q.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.....Z.1......P*...Office16..B.......P.qV.......]......................&.O.f.f.i.c.e.1.6.....b.2.(...qP.. .ONENOTE.EXE.H......qP..qV...............................O.N.E.N.O.T.E...E.X.E.......k...............-.......j...........>.S......C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE....(.W.i.n.d.o.w.s. .+. .N.).../.s.i.d.e.n.o.t.e.<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.O.f.f.i.c.e.1.6.\.O.N.E.N.O.T.E...E.X.E.........%ProgramFiles%\Microsoft Office\Office16\ONENOTE.EXE........................................................

C:\Windows\System32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll (copy)

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	316928
Entropy (8bit):	7.337848702590508
Encrypted:	false
SSDEEP:	6144:cwNQMQTlfdUPABVy559hhR3iP7TfPYbrF1EFVw0todxKROsCt:rNbadDBkZ6rPeEFizdxxsCt
MD5:	BFC060937DC90B273ECCB6825145F298
SHA1:	C156C00C7E918F0CB7363614FB1F177C90D8108A
SHA-256:	2F39C2879989DDD7F9ECF52B6232598E5595F8BF367846FF188C9DFBF1251253
SHA-512:	CC1FEE19314B0A0F9E292FA84F6E98F087033D77DB937848DDA1DA0C88F49997866CBA5465DF04BF929B810B42FDB81481341064C4565C9B6272FA7F3B473AC5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L`.=...n...n...nCy.o...nCy.o...nCy.o...n.z.o(..n.z.o...n.z.o...nCy.o...n...nq..n.z.o...n.z.o...n.zsn...n...n...n.z.o...nRich...n................PE..d....6.d.........." ...!.F...................................................0............ .............................................T...d...d....`..(....0............... ..........8...........................p...@............`..`............................text....D.......F.................. ..`.rdata.......`.......J..............@..@.data...............................@....pdata.......0......................@..@_RDATA..\....P......................@..@.rsrc...(....`......................@..@.reloc....... ......................@..B........................................................................................................................................................................................

Static File Info

General

File type:	data
Entropy (8bit):	6.730628431064467
TrID:	Microsoft OneNote note (16024/2) 100.00%
File name:	Insight_Medical_Publishing_3.one
File size:	120428
MD5:	0d8f675a79a32d286f8eccb2ff989c91
SHA1:	e0796075d09841386c12f37503495c9624a3c393
SHA256:	7ef31d3538810c895812e331db91f905693b99b682d062d9d0b4dab5df0da0a2
SHA512:	d1d81b41e35469ed748fb96998cdbfdaeffd7de481dc12486bd383d1e1e602a24c44c5e0ff4c0a016f0a12afee0a5d36a91f1c64c504918652ee40273b96141a
SSDEEP:	1536:RDBoTVdaeNtuXndCrJJmT4HVnteV4FrdMiYcx7bfCb6HPdnXE:1BoC+tCYvSMVnte8ZP1Y6JU
TLSH:	C3C33BF1A8025C0AE123C976B1FB661399D051ED42283B2BF87D507DD978A20D6DD8EF
File Content Preview:	.R\{...M..Sx.).......i.E......&.................?......I...................................................................._fh.*..E.......n..w.....................h...........................8....... ....... ..}...M..t:."S.9.............TL.E..!......

File Icon


Icon Hash:	d4dce0626664606c

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.366.228.32.314968670802404330 03/17/23-09:17:28.925917	TCP	2404330	ET CNC Feodo Tracker Reported CnC Server TCP group 16	49686	7080	192.168.2.3	66.228.32.31
192.168.2.3104.168.155.1434969480802404302 03/17/23-09:18:01.076339	TCP	2404302	ET CNC Feodo Tracker Reported CnC Server TCP group 2	49694	8080	192.168.2.3	104.168.155.143
192.168.2.3182.162.143.56496874432404312 03/17/23-09:17:34.182038	TCP	2404312	ET CNC Feodo Tracker Reported CnC Server TCP group 7	49687	443	192.168.2.3	182.162.143.56
192.168.2.391.121.146.474968480802404344 03/17/23-09:17:19.192203	TCP	2404344	ET CNC Feodo Tracker Reported CnC Server TCP group 23	49684	8080	192.168.2.3	91.121.146.47
192.168.2.3167.172.199.1654968980802404308 03/17/23-09:17:48.416747	TCP	2404308	ET CNC Feodo Tracker Reported CnC Server TCP group 5	49689	8080	192.168.2.3	167.172.199.165

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2023 09:16:35.903984070 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:35.904050112 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:35.904140949 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:35.935425997 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:35.935475111 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:36.551140070 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:36.551393032 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:36.557358980 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:36.557415962 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:36.557888031 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:36.608803034 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:36.779211044 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:36.779283047 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.158073902 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.158145905 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.158165932 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.158256054 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.158298016 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.158320904 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.202626944 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.457853079 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.457876921 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.457962036 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.457998991 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.458026886 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.458039045 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.458044052 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.458075047 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.458103895 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.458115101 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.458156109 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.458179951 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.458184958 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.458234072 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.758245945 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.758268118 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.758343935 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.758510113 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.758533955 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.758608103 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.758629084 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.758707047 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.758722067 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.758810043 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.758877039 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.758889914 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.758935928 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.759017944 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:37.759037018 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:37.812072039 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.060399055 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060420036 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060472012 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060570955 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.060602903 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060621977 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060642958 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.060646057 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060656071 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060662985 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.060672998 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060704947 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.060745001 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.060760021 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060776949 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060812950 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.060832977 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060849905 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060857058 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.060890913 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.060905933 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060926914 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.060965061 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.060985088 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061007977 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.061018944 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061058998 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.061074972 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061094999 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.061104059 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061120987 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061153889 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.061197996 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061196089 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.061213970 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061285973 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061321020 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.061321020 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.061343908 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061362982 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.061363935 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061404943 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.061422110 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.061448097 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.061481953 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.067372084 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.361330032 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.361689091 CET	443	49683	203.26.41.131	192.168.2.3
Mar 17, 2023 09:16:38.361789942 CET	49683	443	192.168.2.3	203.26.41.131
Mar 17, 2023 09:16:38.361789942 CET	49683	443	192.168.2.3	203.26.41.131

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2023 09:16:35.870768070 CET	58974	53	192.168.2.3	8.8.8.8
Mar 17, 2023 09:16:35.890346050 CET	53	58974	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 17, 2023 09:16:35.870768070 CET	192.168.2.3	8.8.8.8	0x11ba	Standard query (0)	penshorn.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 17, 2023 09:16:29.040373087 CET	8.8.8.8	192.168.2.3	0x99d2	No error (0)	windowsupdatebg.s.llnwi.net	178.79.242.128	A (IP address)	IN (0x0001)	false
Mar 17, 2023 09:16:29.040373087 CET	8.8.8.8	192.168.2.3	0x99d2	No error (0)	windowsupdatebg.s.llnwi.net	95.140.236.128	A (IP address)	IN (0x0001)	false
Mar 17, 2023 09:16:35.890346050 CET	8.8.8.8	192.168.2.3	0x11ba	No error (0)	penshorn.org	203.26.41.131	A (IP address)	IN (0x0001)	false
Mar 17, 2023 09:17:19.883671045 CET	8.8.8.8	192.168.2.3	0xb6f0	No error (0)	windowsupdatebg.s.llnwi.net	95.140.230.192	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

penshorn.org

182.162.143.56

Target ID:	0
Start time:	09:16:08
Start date:	17/03/2023
Path:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE
Wow64 process (32bit):	true
Commandline:	C:\Program Files (x86)\Microsoft Office\Office16\ONENOTE.EXE" "C:\Users\user\Desktop\Insight_Medical_Publishing_3.one
Imagebase:	0xc40000
File size:	1676072 bytes
MD5 hash:	8D7E99CB358318E1F38803C9E6B67867
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: wscript.exePID: 4976, Parent PID: 5852

General

Target ID:	9
Start time:	09:16:33
Start date:	17/03/2023
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Local\Temp\click.wsf"
Imagebase:	0x1260000
File size:	147456 bytes
MD5 hash:	7075DD7B9BE8807FCA93ACD86F724884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: webshell_asp_obfuscated, Description: ASP webshell obfuscated, Source: 00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: WEBSHELL_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000009.00000003.348706974.000000000518A000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: WEBSHELL_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000009.00000003.346224913.0000000005175000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: webshell_asp_obfuscated, Description: ASP webshell obfuscated, Source: 00000009.00000003.347622434.0000000005182000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: WEBSHELL_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000009.00000003.347622434.0000000005182000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: webshell_asp_obfuscated, Description: ASP webshell obfuscated, Source: 00000009.00000002.353529377.000000000518B000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: WEBSHELL_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000009.00000002.353529377.000000000518B000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: webshell_asp_obfuscated, Description: ASP webshell obfuscated, Source: 00000009.00000003.347751255.0000000005182000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: WEBSHELL_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000009.00000003.347751255.0000000005182000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: webshell_asp_obfuscated, Description: ASP webshell obfuscated, Source: 00000009.00000003.348256209.0000000005189000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp Rule: WEBSHELL_asp_generic, Description: Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file, Source: 00000009.00000003.348256209.0000000005189000.00000004.00000020.00020000.00000000.sdmp, Author: Arnim Rupp
Reputation:	high

Analysis Process: regsvr32.exePID: 4920, Parent PID: 4976

General

Target ID:	10
Start time:	09:16:38
Start date:	17/03/2023
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\regsvr32.exe" "C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll
Imagebase:	0xac0000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: regsvr32.exePID: 3156, Parent PID: 4920

General

Target ID:	11
Start time:	09:16:38
Start date:	17/03/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll"
Imagebase:	0x7ff758390000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000002.334740049.0000000000F41000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000002.334703858.0000000000F10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: regsvr32.exePID: 1652, Parent PID: 3156

General

Target ID:	12
Start time:	09:16:40
Start date:	17/03/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll"
Imagebase:	0x7ff758390000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.580204342.0000000002B11000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.579427861.0000000001220000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_3, Description: Yara detected Emotet, Source: 0000000C.00000002.579579352.0000000001268000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Insight_Medical_Publishing_3.one

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Emotet

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Malware Analysis System Evasion

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\header

C:\Users\user\AppData\Local\Temp\OneNote15WatsonLog.etl

C:\Users\user\AppData\Local\Temp\click.wsf

C:\Users\user\AppData\Local\Temp\rad38C2A.tmp.dll

C:\Users\user\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\36a44befa49650d0.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZUNH4RPCMTORJA8SP86T.temp

C:\Windows\System32\ZLTlFkhzfcDaCjB\GJcmgWEWTZrc.dll (copy)

Static File Info

General

Windows Analysis Report
Insight_Medical_Publishing_3.one