Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
AWB-112-17259653.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AWB-112-17259653.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04ncsx0z.kpb.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f21pzxlq.13i.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rnqxau3l.w4s.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xyopqlv1.tus.ps1
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\AWB-112-17259653.exe
|
"C:\Users\user\Desktop\AWB-112-17259653.exe"
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\AWB-112-17259653.exe"
|
|
|
|
C:\Users\user\Desktop\AWB-112-17259653.exe
|
"C:\Users\user\Desktop\AWB-112-17259653.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\wbem\WmiPrvSE.exe
|
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1160000
|
direct allocation
|
page read and write
|
|
|
|
400000
|
remote allocation
|
page execute and read and write
|
|
|
|
7D8B000
|
trusted library allocation
|
page read and write
|
||
|
13DE000
|
stack
|
page read and write
|
||
|
16D0000
|
heap
|
page read and write
|
||
|
540E000
|
stack
|
page read and write
|
||
|
7EEE000
|
stack
|
page read and write
|
||
|
5980000
|
trusted library allocation
|
page execute and read and write
|
||
|
1264000
|
trusted library allocation
|
page read and write
|
||
|
B9E000
|
unkown
|
page readonly
|
||
|
59DB000
|
trusted library allocation
|
page read and write
|
||
|
2D50000
|
trusted library allocation
|
page read and write
|
||
|
5390000
|
trusted library allocation
|
page read and write
|
||
|
56FE000
|
stack
|
page read and write
|
||
|
6520000
|
heap
|
page read and write
|
||
|
1010000
|
heap
|
page read and write
|
||
|
1030000
|
heap
|
page read and write
|
||
|
4EB8000
|
trusted library allocation
|
page read and write
|
||
|
16C0000
|
trusted library allocation
|
page read and write
|
||
|
573E000
|
trusted library allocation
|
page read and write
|
||
|
53AE000
|
trusted library allocation
|
page read and write
|
||
|
1850000
|
heap
|
page read and write
|
||
|
312B000
|
trusted library allocation
|
page read and write
|
||
|
595E000
|
stack
|
page read and write
|
||
|
59BF000
|
trusted library allocation
|
page read and write
|
||
|
7CA0000
|
trusted library allocation
|
page read and write
|
||
|
2EB1000
|
trusted library allocation
|
page read and write
|
||
|
3EC1000
|
trusted library allocation
|
page read and write
|
||
|
59E0000
|
trusted library allocation
|
page read and write
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
874D000
|
heap
|
page read and write
|
||
|
60DE000
|
stack
|
page read and write
|
||
|
5970000
|
trusted library allocation
|
page read and write
|
||
|
5992000
|
trusted library allocation
|
page read and write
|
||
|
5720000
|
heap
|
page read and write
|
||
|
B2EC000
|
stack
|
page read and write
|
||
|
802E000
|
stack
|
page read and write
|
||
|
59C4000
|
trusted library allocation
|
page read and write
|
||
|
7DEE000
|
stack
|
page read and write
|
||
|
8810000
|
trusted library section
|
page read and write
|
||
|
2D30000
|
trusted library allocation
|
page read and write
|
||
|
1230000
|
direct allocation
|
page execute and read and write
|
||
|
7D90000
|
trusted library allocation
|
page read and write
|
||
|
54BE000
|
stack
|
page read and write
|
||
|
61A0000
|
heap
|
page read and write
|
||
|
567F000
|
stack
|
page read and write
|
||
|
103E000
|
heap
|
page read and write
|
||
|
D08000
|
heap
|
page read and write
|
||
|
16AE000
|
stack
|
page read and write
|
||
|
8702000
|
heap
|
page read and write
|
||
|
127D000
|
trusted library allocation
|
page execute and read and write
|
||
|
14F6000
|
direct allocation
|
page execute and read and write
|
||
|
53B1000
|
trusted library allocation
|
page read and write
|
||
|
53BD000
|
trusted library allocation
|
page read and write
|
||
|
6620000
|
trusted library allocation
|
page read and write
|
||
|
128A000
|
trusted library allocation
|
page execute and read and write
|
||
|
899E000
|
stack
|
page read and write
|
||
|
115E000
|
stack
|
page read and write
|
||
|
10C0000
|
heap
|
page read and write
|
||
|
1071000
|
heap
|
page read and write
|
||
|
126D000
|
trusted library allocation
|
page execute and read and write
|
||
|
ED0000
|
heap
|
page read and write
|
||
|
8800000
|
trusted library allocation
|
page read and write
|
||
|
6100000
|
heap
|
page read and write
|
||
|
1282000
|
trusted library allocation
|
page read and write
|
||
|
400A000
|
trusted library allocation
|
page read and write
|
||
|
1273000
|
trusted library allocation
|
page read and write
|
||
|
129B000
|
trusted library allocation
|
page execute and read and write
|
||
|
5978000
|
trusted library allocation
|
page read and write
|
||
|
13CE000
|
direct allocation
|
page execute and read and write
|
||
|
59C0000
|
trusted library allocation
|
page read and write
|
||
|
40F4000
|
trusted library allocation
|
page read and write
|
||
|
CFC000
|
stack
|
page read and write
|
||
|
5750000
|
heap
|
page execute and read and write
|
||
|
7B70000
|
heap
|
page read and write
|
||
|
2EA0000
|
heap
|
page execute and read and write
|
||
|
D00000
|
heap
|
page read and write
|
||
|
1270000
|
trusted library allocation
|
page read and write
|
||
|
14DE000
|
stack
|
page read and write
|
||
|
648E000
|
stack
|
page read and write
|
||
|
634F000
|
stack
|
page read and write
|
||
|
7B7E000
|
heap
|
page read and write
|
||
|
7FEE000
|
stack
|
page read and write
|
||
|
3EB1000
|
trusted library allocation
|
page read and write
|
||
|
6630000
|
trusted library allocation
|
page execute and read and write
|
||
|
5740000
|
trusted library allocation
|
page execute and read and write
|
||
|
53B6000
|
trusted library allocation
|
page read and write
|
||
|
1260000
|
trusted library allocation
|
page read and write
|
||
|
5999000
|
trusted library allocation
|
page read and write
|
||
|
E3A000
|
stack
|
page read and write
|
||
|
10E5000
|
heap
|
page read and write
|
||
|
1286000
|
trusted library allocation
|
page execute and read and write
|
||
|
1297000
|
trusted library allocation
|
page execute and read and write
|
||
|
5730000
|
trusted library allocation
|
page read and write
|
||
|
1578000
|
direct allocation
|
page execute and read and write
|
||
|
585E000
|
stack
|
page read and write
|
||
|
5394000
|
trusted library allocation
|
page read and write
|
||
|
2E6F000
|
stack
|
page read and write
|
||
|
6090000
|
trusted library allocation
|
page read and write
|
||
|
573B000
|
trusted library allocation
|
page read and write
|
||
|
1290000
|
trusted library allocation
|
page read and write
|
||
|
1280000
|
trusted library allocation
|
page read and write
|
||
|
111F000
|
stack
|
page read and write
|
||
|
8706000
|
heap
|
page read and write
|
||
|
7CE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
14E1000
|
direct allocation
|
page execute and read and write
|
||
|
101E000
|
stack
|
page read and write
|
||
|
9F0000
|
heap
|
page read and write
|
||
|
B1EC000
|
stack
|
page read and write
|
||
|
5433000
|
heap
|
page read and write
|
||
|
816E000
|
stack
|
page read and write
|
||
|
2D2B000
|
stack
|
page read and write
|
||
|
7C70000
|
trusted library section
|
page read and write
|
||
|
56BE000
|
stack
|
page read and write
|
||
|
1292000
|
trusted library allocation
|
page read and write
|
||
|
5990000
|
trusted library allocation
|
page read and write
|
||
|
F37000
|
stack
|
page read and write
|
||
|
6190000
|
heap
|
page read and write
|
||
|
12B0000
|
trusted library allocation
|
page read and write
|
||
|
618E000
|
stack
|
page read and write
|
||
|
86C0000
|
heap
|
page read and write
|
||
|
AF2000
|
unkown
|
page readonly
|
||
|
135D000
|
direct allocation
|
page execute and read and write
|
||
|
12D0000
|
heap
|
page read and write
|
||
|
59D0000
|
trusted library allocation
|
page read and write
|
||
|
5430000
|
heap
|
page read and write
|
||
|
638B000
|
stack
|
page read and write
|
||
|
6510000
|
heap
|
page read and write
|
||
|
B09E000
|
stack
|
page read and write
|
||
|
14FD000
|
direct allocation
|
page execute and read and write
|
||
|
8767000
|
heap
|
page read and write
|
||
|
16D8000
|
heap
|
page read and write
|
||
|
106F000
|
heap
|
page read and write
|
||
|
6515000
|
heap
|
page read and write
|
||
|
AF0000
|
unkown
|
page readonly
|
||
|
2D60000
|
heap
|
page read and write
|
||
|
87E0000
|
trusted library allocation
|
page read and write
|
||
|
547E000
|
stack
|
page read and write
|
||
|
8713000
|
heap
|
page read and write
|
||
|
6554000
|
heap
|
page read and write
|
||
|
1359000
|
direct allocation
|
page execute and read and write
|
||
|
12C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7F4A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
AF9E000
|
stack
|
page read and write
|
||
|
FFE000
|
stack
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
614E000
|
stack
|
page read and write
|
||
|
167F000
|
stack
|
page read and write
|
||
|
7C90000
|
trusted library section
|
page read and write
|
||
|
2D45000
|
trusted library allocation
|
page read and write
|
||
|
8272000
|
trusted library allocation
|
page read and write
|
||
|
FB0000
|
heap
|
page read and write
|
||
|
504C000
|
stack
|
page read and write
|
||
|
1056000
|
heap
|
page read and write
|
||
|
EE0000
|
heap
|
page read and write
|
||
|
59A8000
|
trusted library allocation
|
page read and write
|
||
|
10E7000
|
heap
|
page read and write
|
||
|
599D000
|
trusted library allocation
|
page read and write
|
||
|
1064000
|
heap
|
page read and write
|
||
|
60F0000
|
trusted library section
|
page readonly
|
||
|
1250000
|
trusted library allocation
|
page read and write
|
||
|
1263000
|
trusted library allocation
|
page execute and read and write
|
||
|
59B5000
|
trusted library allocation
|
page read and write
|
||
|
123E000
|
stack
|
page read and write
|
||
|
5995000
|
trusted library allocation
|
page read and write
|
||
|
7C80000
|
trusted library allocation
|
page execute and read and write
|
||
|
7D4D000
|
stack
|
page read and write
|
||
|
97D000
|
stack
|
page read and write
|
||
|
16B0000
|
trusted library allocation
|
page read and write
|
||
|
6530000
|
heap
|
page read and write
|
||
|
2D40000
|
trusted library allocation
|
page read and write
|
||
|
53C0000
|
trusted library allocation
|
page read and write
|
||
|
59B0000
|
trusted library allocation
|
page read and write
|
||
|
54D0000
|
trusted library allocation
|
page read and write
|
||
|
59BA000
|
trusted library allocation
|
page read and write
|
||
|
812E000
|
stack
|
page read and write
|
||
|
7D80000
|
trusted library allocation
|
page read and write
|
There are 167 hidden memdumps, click here to show them.