Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
new.cmd
|
DOS batch file, ASCII text, with CRLF line terminators
|
initial sample
|
||
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wo3hzfje.uuq.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xc45uhss.xtb.psm1
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\new.cmd" "
|
 |
|
|
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
|
powershell -ExecutionPolicy Bypass -File "C:\Users\user\Pictures\install.ps1"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://go.microsoft.coP
|
unknown
|
||
|
https://aka.ms/pscore6
|
unknown
|
||
|
https://aka.ms/pscore68
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7DF4E3D30000
|
trusted library allocation
|
page execute and read and write
|
||
|
17773401000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B1D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1A012BE000
|
stack
|
page read and write
|
||
|
17761800000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B2C7000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B11D000
|
trusted library allocation
|
page execute and read and write
|
||
|
17761770000
|
heap
|
page read and write
|
||
|
17773411000
|
trusted library allocation
|
page read and write
|
||
|
1776344A000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B120000
|
trusted library allocation
|
page read and write
|
||
|
1A014BE000
|
stack
|
page read and write
|
||
|
17773473000
|
trusted library allocation
|
page read and write
|
||
|
17763452000
|
trusted library allocation
|
page read and write
|
||
|
1776330C000
|
heap
|
page read and write
|
||
|
7FFB4B12C000
|
trusted library allocation
|
page read and write
|
||
|
177632E8000
|
heap
|
page read and write
|
||
|
7FFB4B230000
|
trusted library allocation
|
page execute and read and write
|
||
|
1776349A000
|
trusted library allocation
|
page read and write
|
||
|
17763294000
|
heap
|
page read and write
|
||
|
7FFB4B123000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B1CC000
|
trusted library allocation
|
page execute and read and write
|
||
|
7FFB4B1C6000
|
trusted library allocation
|
page read and write
|
||
|
17761820000
|
trusted library allocation
|
page read and write
|
||
|
17763412000
|
trusted library allocation
|
page read and write
|
||
|
177615A0000
|
heap
|
page read and write
|
||
|
17761830000
|
heap
|
page readonly
|
||
|
17763200000
|
heap
|
page read and write
|
||
|
1A0117E000
|
stack
|
page read and write
|
||
|
1A01337000
|
stack
|
page read and write
|
||
|
177632A0000
|
heap
|
page read and write
|
||
|
17761934000
|
heap
|
page read and write
|
||
|
1A00F7E000
|
stack
|
page read and write
|
||
|
177618F0000
|
heap
|
page execute and read and write
|
||
|
1A0107D000
|
stack
|
page read and write
|
||
|
1A0153E000
|
stack
|
page read and write
|
||
|
1A013BE000
|
stack
|
page read and write
|
||
|
1776169C000
|
heap
|
page read and write
|
||
|
7FFB4B1C0000
|
trusted library allocation
|
page read and write
|
||
|
177615CF000
|
heap
|
page read and write
|
||
|
17761686000
|
heap
|
page read and write
|
||
|
177618B0000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B2D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1776341B000
|
trusted library allocation
|
page read and write
|
||
|
177633F0000
|
heap
|
page execute and read and write
|
||
|
1A00FFE000
|
stack
|
page read and write
|
||
|
177615A8000
|
heap
|
page read and write
|
||
|
17763290000
|
heap
|
page read and write
|
||
|
177615DE000
|
heap
|
page read and write
|
||
|
1A00BD6000
|
stack
|
page read and write
|
||
|
177615C9000
|
heap
|
page read and write
|
||
|
1A00EFF000
|
stack
|
page read and write
|
||
|
177615DC000
|
heap
|
page read and write
|
||
|
17761930000
|
heap
|
page read and write
|
||
|
7FFB4B2C1000
|
trusted library allocation
|
page read and write
|
||
|
1A010FF000
|
stack
|
page read and write
|
||
|
1A00E7E000
|
stack
|
page read and write
|
||
|
1776346A000
|
trusted library allocation
|
page read and write
|
||
|
17763455000
|
trusted library allocation
|
page read and write
|
||
|
17761790000
|
heap
|
page read and write
|
||
|
17763401000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B112000
|
trusted library allocation
|
page read and write
|
||
|
7FFB4B1F6000
|
trusted library allocation
|
page execute and read and write
|
||
|
17761580000
|
heap
|
page read and write
|
||
|
177615FC000
|
heap
|
page read and write
|
||
|
17761625000
|
heap
|
page read and write
|
||
|
7FFB4B113000
|
trusted library allocation
|
page execute and read and write
|
||
|
1A0143A000
|
stack
|
page read and write
|
||
|
17773407000
|
trusted library allocation
|
page read and write
|
||
|
1A011FE000
|
stack
|
page read and write
|
||
|
1776333A000
|
heap
|
page read and write
|
||
|
1777B7D1000
|
heap
|
page read and write
|
||
|
7FFB4B2B0000
|
trusted library allocation
|
page read and write
|
||
|
177617C0000
|
heap
|
page read and write
|
||
|
7FFB4B114000
|
trusted library allocation
|
page read and write
|
||
|
1A01279000
|
stack
|
page read and write
|
||
|
7FFB4B2C5000
|
trusted library allocation
|
page read and write
|
There are 67 hidden memdumps, click here to show them.