Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
PO STS_2184_06_2024.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO STS_2184_06_2024.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
|
|
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2v5dz3v2.ajr.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4rgiecup.p4s.ps1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jeh12ql5.ely.psm1
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p4eyps3o.gk1.psm1
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\PO STS_2184_06_2024.exe
|
"C:\Users\user\Desktop\PO STS_2184_06_2024.exe"
|
|
|
|
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
|
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO STS_2184_06_2024.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
400000
|
remote allocation
|
page execute and read and write
|
|
|
|
D40000
|
direct allocation
|
page read and write
|
|
|
|
DEE000
|
heap
|
page read and write
|
||
|
76A2000
|
trusted library allocation
|
page read and write
|
||
|
5250000
|
trusted library allocation
|
page read and write
|
||
|
1270000
|
direct allocation
|
page execute and read and write
|
||
|
545E000
|
stack
|
page read and write
|
||
|
122D000
|
trusted library allocation
|
page execute and read and write
|
||
|
9670000
|
heap
|
page read and write
|
||
|
140E000
|
direct allocation
|
page execute and read and write
|
||
|
1710000
|
heap
|
page read and write
|
||
|
DE0000
|
heap
|
page read and write
|
||
|
125B000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F6A000
|
trusted library allocation
|
page read and write
|
||
|
8400000
|
heap
|
page read and write
|
||
|
2F74000
|
trusted library allocation
|
page read and write
|
||
|
2DA5000
|
trusted library allocation
|
page read and write
|
||
|
1270000
|
trusted library allocation
|
page read and write
|
||
|
2AB0000
|
trusted library allocation
|
page execute and read and write
|
||
|
527D000
|
trusted library allocation
|
page read and write
|
||
|
9EA000
|
stack
|
page read and write
|
||
|
D00000
|
heap
|
page read and write
|
||
|
5B2C000
|
stack
|
page read and write
|
||
|
1399000
|
direct allocation
|
page execute and read and write
|
||
|
4CE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1288000
|
heap
|
page read and write
|
||
|
2F82000
|
trusted library allocation
|
page read and write
|
||
|
83F0000
|
heap
|
page read and write
|
||
|
2AAB000
|
stack
|
page read and write
|
||
|
76E0000
|
heap
|
page read and write
|
||
|
2F3B000
|
trusted library allocation
|
page read and write
|
||
|
852000
|
unkown
|
page readonly
|
||
|
139D000
|
direct allocation
|
page execute and read and write
|
||
|
2CBB000
|
trusted library allocation
|
page read and write
|
||
|
2F78000
|
trusted library allocation
|
page read and write
|
||
|
5300000
|
heap
|
page read and write
|
||
|
850000
|
unkown
|
page readonly
|
||
|
D60000
|
heap
|
page read and write
|
||
|
E23000
|
heap
|
page read and write
|
||
|
526E000
|
trusted library allocation
|
page read and write
|
||
|
4475000
|
trusted library allocation
|
page read and write
|
||
|
2F7E000
|
trusted library allocation
|
page read and write
|
||
|
5303000
|
heap
|
page read and write
|
||
|
BA0000
|
heap
|
page read and write
|
||
|
1252000
|
trusted library allocation
|
page read and write
|
||
|
2C30000
|
trusted library allocation
|
page read and write
|
||
|
10ED000
|
stack
|
page read and write
|
||
|
83EE000
|
stack
|
page read and write
|
||
|
5290000
|
trusted library allocation
|
page read and write
|
||
|
7A3E000
|
stack
|
page read and write
|
||
|
44C7000
|
trusted library allocation
|
page read and write
|
||
|
2C55000
|
trusted library allocation
|
page read and write
|
||
|
4E0C000
|
stack
|
page read and write
|
||
|
6310000
|
trusted library allocation
|
page read and write
|
||
|
2F7C000
|
trusted library allocation
|
page read and write
|
||
|
A3D000
|
stack
|
page read and write
|
||
|
76A7000
|
trusted library allocation
|
page read and write
|
||
|
5310000
|
trusted library section
|
page read and write
|
||
|
96A0000
|
heap
|
page read and write
|
||
|
5280000
|
trusted library allocation
|
page read and write
|
||
|
1521000
|
direct allocation
|
page execute and read and write
|
||
|
850000
|
unkown
|
page execute and read and write
|
||
|
4515000
|
trusted library allocation
|
page read and write
|
||
|
57AE000
|
stack
|
page read and write
|
||
|
2F70000
|
trusted library allocation
|
page read and write
|
||
|
2F4A000
|
trusted library allocation
|
page read and write
|
||
|
2AC0000
|
trusted library allocation
|
page read and write
|
||
|
2F94000
|
trusted library allocation
|
page read and write
|
||
|
4CC0000
|
trusted library section
|
page read and write
|
||
|
5276000
|
trusted library allocation
|
page read and write
|
||
|
2C60000
|
heap
|
page execute and read and write
|
||
|
E00000
|
heap
|
page read and write
|
||
|
566E000
|
stack
|
page read and write
|
||
|
9570000
|
heap
|
page read and write
|
||
|
78C0000
|
heap
|
page read and write
|
||
|
121F000
|
stack
|
page read and write
|
||
|
D30000
|
heap
|
page read and write
|
||
|
1230000
|
trusted library allocation
|
page read and write
|
||
|
9C72000
|
trusted library allocation
|
page read and write
|
||
|
58AF000
|
stack
|
page read and write
|
||
|
2AD0000
|
trusted library allocation
|
page read and write
|
||
|
10FF000
|
stack
|
page read and write
|
||
|
8424000
|
heap
|
page read and write
|
||
|
DE8000
|
heap
|
page read and write
|
||
|
1280000
|
heap
|
page read and write
|
||
|
CFE000
|
stack
|
page read and write
|
||
|
1250000
|
trusted library allocation
|
page read and write
|
||
|
76A0000
|
trusted library allocation
|
page read and write
|
||
|
96A7000
|
heap
|
page read and write
|
||
|
E25000
|
heap
|
page read and write
|
||
|
76D0000
|
trusted library section
|
page readonly
|
||
|
82EF000
|
stack
|
page read and write
|
||
|
4563000
|
trusted library allocation
|
page read and write
|
||
|
2F96000
|
trusted library allocation
|
page read and write
|
||
|
7935000
|
heap
|
page read and write
|
||
|
15B8000
|
direct allocation
|
page execute and read and write
|
||
|
2F88000
|
trusted library allocation
|
page read and write
|
||
|
956000
|
unkown
|
page readonly
|
||
|
2F80000
|
trusted library allocation
|
page read and write
|
||
|
53F9000
|
trusted library allocation
|
page read and write
|
||
|
2F6E000
|
trusted library allocation
|
page read and write
|
||
|
2A6E000
|
stack
|
page read and write
|
||
|
53F0000
|
trusted library allocation
|
page read and write
|
||
|
2F61000
|
trusted library allocation
|
page read and write
|
||
|
7F5C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
7710000
|
trusted library allocation
|
page execute and read and write
|
||
|
B200000
|
trusted library allocation
|
page read and write
|
||
|
2F72000
|
trusted library allocation
|
page read and write
|
||
|
2C2E000
|
stack
|
page read and write
|
||
|
52B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F6C000
|
trusted library allocation
|
page read and write
|
||
|
7700000
|
trusted library allocation
|
page read and write
|
||
|
947000
|
unkown
|
page execute and read and write
|
||
|
5410000
|
trusted library allocation
|
page execute and read and write
|
||
|
7BFE000
|
stack
|
page read and write
|
||
|
2F90000
|
trusted library allocation
|
page read and write
|
||
|
791B000
|
stack
|
page read and write
|
||
|
1223000
|
trusted library allocation
|
page execute and read and write
|
||
|
1242000
|
trusted library allocation
|
page read and write
|
||
|
1110000
|
heap
|
page read and write
|
||
|
2F8A000
|
trusted library allocation
|
page read and write
|
||
|
DD0000
|
heap
|
page read and write
|
||
|
CBE000
|
stack
|
page read and write
|
||
|
7920000
|
trusted library allocation
|
page read and write
|
||
|
E0A000
|
heap
|
page read and write
|
||
|
52C0000
|
trusted library allocation
|
page read and write
|
||
|
CF7000
|
stack
|
page read and write
|
||
|
B3C000
|
stack
|
page read and write
|
||
|
53E0000
|
trusted library allocation
|
page read and write
|
||
|
967D000
|
heap
|
page read and write
|
||
|
11FF000
|
stack
|
page read and write
|
||
|
153D000
|
direct allocation
|
page execute and read and write
|
||
|
7BBE000
|
stack
|
page read and write
|
||
|
1240000
|
trusted library allocation
|
page read and write
|
||
|
123D000
|
trusted library allocation
|
page execute and read and write
|
||
|
E98000
|
heap
|
page read and write
|
||
|
E9D000
|
heap
|
page read and write
|
||
|
1246000
|
trusted library allocation
|
page execute and read and write
|
||
|
6350000
|
trusted library allocation
|
page read and write
|
||
|
2F92000
|
trusted library allocation
|
page read and write
|
||
|
2C40000
|
trusted library allocation
|
page read and write
|
||
|
2F7A000
|
trusted library allocation
|
page read and write
|
||
|
D50000
|
heap
|
page read and write
|
||
|
2CB9000
|
trusted library allocation
|
page read and write
|
||
|
1224000
|
trusted library allocation
|
page read and write
|
||
|
7690000
|
heap
|
page read and write
|
||
|
576E000
|
stack
|
page read and write
|
||
|
4CBE000
|
stack
|
page read and write
|
||
|
A1BE000
|
stack
|
page read and write
|
||
|
2F98000
|
trusted library allocation
|
page read and write
|
||
|
3C71000
|
trusted library allocation
|
page read and write
|
||
|
852000
|
unkown
|
page execute and read and write
|
||
|
7720000
|
heap
|
page read and write
|
||
|
10AE000
|
stack
|
page read and write
|
||
|
7C00000
|
trusted library allocation
|
page read and write
|
||
|
4479000
|
trusted library allocation
|
page read and write
|
||
|
1100000
|
trusted library allocation
|
page read and write
|
||
|
124A000
|
trusted library allocation
|
page execute and read and write
|
||
|
76F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2AE0000
|
heap
|
page read and write
|
||
|
7A7E000
|
stack
|
page read and write
|
||
|
9681000
|
heap
|
page read and write
|
||
|
2C50000
|
trusted library allocation
|
page read and write
|
||
|
1220000
|
trusted library allocation
|
page read and write
|
||
|
4CF0000
|
trusted library section
|
page read and write
|
||
|
5A2C000
|
stack
|
page read and write
|
||
|
5271000
|
trusted library allocation
|
page read and write
|
||
|
4D00000
|
trusted library section
|
page read and write
|
||
|
2F76000
|
trusted library allocation
|
page read and write
|
||
|
954000
|
unkown
|
page execute and read and write
|
||
|
562F000
|
stack
|
page read and write
|
||
|
E01000
|
heap
|
page read and write
|
||
|
F00000
|
heap
|
page read and write
|
||
|
7930000
|
heap
|
page read and write
|
||
|
1536000
|
direct allocation
|
page execute and read and write
|
||
|
DAD000
|
stack
|
page read and write
|
||
|
2C71000
|
trusted library allocation
|
page read and write
|
||
|
78D0000
|
heap
|
page execute and read and write
|
||
|
3D5F000
|
trusted library allocation
|
page read and write
|
||
|
7B7F000
|
stack
|
page read and write
|
||
|
524F000
|
stack
|
page read and write
|
||
|
E7E000
|
heap
|
page read and write
|
||
|
2F86000
|
trusted library allocation
|
page read and write
|
||
|
E08000
|
heap
|
page read and write
|
||
|
2BEE000
|
stack
|
page read and write
|
||
|
2F84000
|
trusted library allocation
|
page read and write
|
||
|
1257000
|
trusted library allocation
|
page execute and read and write
|
||
|
316F000
|
trusted library allocation
|
page read and write
|
There are 178 hidden memdumps, click here to show them.