Edit tour

Windows Analysis Report
017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

Overview

General Information

Sample name:	017069451a4dbc523a1165a2f1bd361a762bb40856778.exe
Analysis ID:	1582223
MD5:	9b33561c436559bc1dd43a1eb9dd413c
SHA1:	24ee61f49e77d4d1e900bf6504206b47d0f37333
SHA256:	017069451a4dbc523a1165a2f1bd361a762bb4085677829a0eb3471dd72e6a44
Tags:	exeValleyRATuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Loading BitLocker PowerShell Module

Opens the same file many times (likely Sandbox evasion)

Sets debug register (to hijack the execution of another thread)

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Suspicious powershell command line found

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

Uses Register-ScheduledTask to add task schedules

Checks for available system drives (often done to infect USB drives)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Installs a global mouse hook

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

017069451a4dbc523a1165a2f1bd361a762bb40856778.exe (PID: 7288 cmdline: "C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" MD5: 9B33561C436559BC1DD43A1EB9DD413C)

017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp (PID: 7304 cmdline: "C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp" /SL5="$2044A,766234,203776,C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" MD5: D5A634439F2ABA0A8D26F31577C73343)

cmd.exe (PID: 7320 cmdline: "cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7372 cmdline: timeout /T 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

017069451a4dbc523a1165a2f1bd361a762bb40856778.exe (PID: 7444 cmdline: "C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: 9B33561C436559BC1DD43A1EB9DD413C)

017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp (PID: 7460 cmdline: "C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp" /SL5="$30490,766234,203776,C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES MD5: D5A634439F2ABA0A8D26F31577C73343)

regsvr32.exe (PID: 7484 cmdline: "regsvr32.exe" /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 7496 cmdline: /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

powershell.exe (PID: 7516 cmdline: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7772 cmdline: "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{1E368EEB-D678-4F19-FF6D-518AE4C9820E}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

regsvr32.exe (PID: 8120 cmdline: "regsvr32" /i:360 /s C:\Users\user\AppData\Roaming\Setup_Ring.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 7972 cmdline: C:\Windows\system32\regsvr32.EXE /S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

cleanup

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Child Process Of Regsvr32

Source: Process started

Author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll, ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 7496, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }", ProcessId: 7516, ProcessName: powershell.exe

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DestinationIp: 27.124.34.140, DestinationIsIpv6: false, DestinationPort: 6666, EventID: 3, Image: C:\Windows\System32\regsvr32.exe, Initiated: true, ProcessId: 7496, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Potential Regsvr32 Commandline Flag Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "regsvr32.exe" /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll, CommandLine: "regsvr32.exe" /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp" /SL5="$30490,766234,203776,C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES, ParentImage: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp, ParentProcessId: 7460, ParentProcessName: 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp, ProcessCommandLine: "regsvr32.exe" /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll, ProcessId: 7484, ProcessName: regsvr32.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll, ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 7496, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }", ProcessId: 7516, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }", CommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll, ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 7496, ParentProcessName: regsvr32.exe, ProcessCommandLine: "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }", ProcessId: 7516, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T04:12:30.376945+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49736	27.124.34.140	6666	TCP
2024-12-30T04:13:44.091637+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49737	27.124.34.140	6666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Setup_Ring.dll (copy)	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Roaming\is-K85C4.tmp	ReversingLabs: Detection: 78%

Multi AV Scanner detection for submitted file

Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ _is1

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	File opened: [:	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49736 -> 27.124.34.140:6666
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49737 -> 27.124.34.140:6666

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 27.124.34.140 6666

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.4:49736 -> 27.124.34.140:6666

Source: Joe Sandbox View

ASN Name: BCPL-SGBGPNETGlobalASNSG BCPL-SGBGPNETGlobalASNSG

Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.34.140

Source: global traffic

DNS traffic detected: DNS query: y.baidu.com

Source: powershell.exe, 0000000B.00000002.1946561582.00000252626E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: powershell.exe, 0000000B.00000002.1946561582.00000252626E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v3
Source: powershell.exe, 00000009.00000002.1796460646.000001372A283000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1932762399.000002525A393000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000009.00000002.1762021981.000001371A438000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000009.00000002.1762021981.000001371A211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1846609385.000002524A321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.1762021981.000001371A438000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe, 00000000.00000003.1668869969.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe, 00000000.00000003.1669075263.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp, 00000001.00000000.1669681179.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp.0.dr, is-UDVS3.tmp.6.dr	String found in binary or memory: http://www.innosetup.com/
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe, 00000000.00000003.1668869969.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe, 00000000.00000003.1669075263.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp, 00000001.00000000.1669681179.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp.0.dr, is-UDVS3.tmp.6.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: powershell.exe, 00000009.00000002.1762021981.000001371A211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1846609385.000002524A321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 0000000B.00000002.1932762399.000002525A393000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000B.00000002.1932762399.000002525A393000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000B.00000002.1932762399.000002525A393000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp, 00000006.00000003.1706353966.0000000005B30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support/rust/deps
Source: powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000009.00000002.1796460646.000001372A283000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1932762399.000002525A393000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: C:\Windows\System32\regsvr32.exe

Windows user hook set: 0 mouse low level C:\Windows\system32\DINPUT8.dll

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFD9B334FFB		9_2_00007FFD9B334FFB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FFD9B414DFB		11_2_00007FFD9B414DFB

Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp.5.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-UDVS3.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-UDVS3.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: is-K85C4.tmp.6.dr

Static PE information: Number of sections : 11 > 10

Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe, 00000000.00000003.1668869969.00000000024D1000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe, 00000000.00000003.1669075263.000000007FE3D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.evad.winEXE@25/417@20/1

Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp

File created: C:\Users\user\AppData\Local\unins000.dat

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\2024.12.13
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\uZgGU

Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

File created: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp

Jump to behavior

Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

File read: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe "C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe"
Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Process created: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp "C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp" /SL5="$2044A,766234,203776,C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe"
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe "C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp "C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp" /SL5="$30490,766234,203776,C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{1E368EEB-D678-4F19-FF6D-518AE4C9820E}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.EXE /S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /i:360 /s C:\Users\user\AppData\Roaming\Setup_Ring.dll
Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Process created: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp "C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp" /SL5="$2044A,766234,203776,C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C timeout /T 3 & "C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /T 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe "C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Process created: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp "C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp" /SL5="$30490,766234,203776,C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{1E368EEB-D678-4F19-FF6D-518AE4C9820E}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /i:360 /s C:\Users\user\AppData\Roaming\Setup_Ring.dll	Jump to behavior

Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ _is1

Jump to behavior

Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

Static file information: File size 1150632 > 1048576

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{1E368EEB-D678-4F19-FF6D-518AE4C9820E}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command "if (Get-ScheduledTask \| Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll' }) { exit 0 } else { exit 1 }"	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{1E368EEB-D678-4F19-FF6D-518AE4C9820E}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"	Jump to behavior

Source: is-UDVS3.tmp.6.dr	Static PE information: real checksum: 0x0 should be: 0x1352a1
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp.5.dr	Static PE information: real checksum: 0x0 should be: 0x12d741
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0x12d741
Source: is-K85C4.tmp.6.dr	Static PE information: real checksum: 0xf5a6c should be: 0xfa6d2
Source: 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Static PE information: real checksum: 0x0 should be: 0x1253db
Source: _setup64.tmp.1.dr	Static PE information: real checksum: 0x0 should be: 0x8546
Source: _setup64.tmp.6.dr	Static PE information: real checksum: 0x0 should be: 0x8546

Source: is-K85C4.tmp.6.dr

Static PE information: section name: .xdata

Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp

Process created: C:\Windows\SysWOW64\regsvr32.exe "regsvr32.exe" /s /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFD9B21D2A5 pushad ; iretd	9_2_00007FFD9B21D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFD9B335C7F push ebx; iretd	9_2_00007FFD9B335C82
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_00007FFD9B33792B push ebx; retf	9_2_00007FFD9B33796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FFD9B2FD2A5 pushad ; iretd	11_2_00007FFD9B2FD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FFD9B41B044 push eax; ret	11_2_00007FFD9B41B051
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 11_2_00007FFD9B4E6DCB push ecx; iretd	11_2_00007FFD9B4E6DCC

Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	File created: C:\Users\user\AppData\Roaming\is-K85C4.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	File created: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	File created: C:\Users\user\AppData\Roaming\Setup_Ring.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ICN7T.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	File created: C:\Users\user\AppData\Local\Temp\is-R95LB.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	File created: C:\Users\user\AppData\Local\Temp\is-ICN7T.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	File created: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	File created: C:\Users\user\AppData\Local\Temp\is-R95LB.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	File created: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	File created: C:\Users\user\AppData\Local\is-UDVS3.tmp	Jump to dropped file

Boot Survival

Uses Register-ScheduledTask to add task schedules

Source: C:\Windows\System32\regsvr32.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{1E368EEB-D678-4F19-FF6D-518AE4C9820E}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0) -RunLevel Highest"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6843	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2952	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6812	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2620	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\is-K85C4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Setup_Ring.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ICN7T.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-R95LB.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-ICN7T.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-R95LB.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\is-UDVS3.tmp	Jump to dropped file

Source: C:\Windows\System32\regsvr32.exe TID: 8148	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 8144	Thread sleep time: -660000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608	Thread sleep count: 6843 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7608	Thread sleep count: 2952 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep count: 6812 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep count: 2620 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	1 Input Capture	21 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	211 Process Injection	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 DLL Side-Loading	1 Scheduled Task/Job	121 Virtualization/Sandbox Evasion	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	211 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Regsvr32	Cached Domain Credentials	2 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-9M57J.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-ICN7T.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-ICN7T.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-R95LB.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-R95LB.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\is-UDVS3.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\unins000.exe (copy)	4%	ReversingLabs
C:\Users\user\AppData\Roaming\Setup_Ring.dll (copy)	78%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Roaming\is-K85C4.tmp	78%	ReversingLabs	Win64.Trojan.Generic

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
y.baidu.com	unknown	unknown	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	017069451a4dbc523a1165a2f1bd361a762bb40856778.exe, 00000000.00000003.1668869969.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe, 00000000.00000003.1669075263.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp, 00000001.00000000.1669681179.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp.0.dr, is-UDVS3.tmp.6.dr	false		high
http://crl.v3	powershell.exe, 0000000B.00000002.1946561582.00000252626E7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000009.00000002.1796460646.000001372A283000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1932762399.000002525A393000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000009.00000002.1762021981.000001371A438000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000009.00000002.1762021981.000001371A438000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000B.00000002.1932762399.000002525A393000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000009.00000002.1796460646.000001372A283000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1932762399.000002525A393000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000B.00000002.1932762399.000002525A393000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 0000000B.00000002.1932762399.000002525A393000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000009.00000002.1762021981.000001371A211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1846609385.000002524A321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	017069451a4dbc523a1165a2f1bd361a762bb40856778.exe, 00000000.00000003.1668869969.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe, 00000000.00000003.1669075263.000000007FD20000.00000004.00001000.00020000.00000000.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp, 00000001.00000000.1669681179.0000000000401000.00000020.00000001.01000000.00000004.sdmp, 017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp.0.dr, is-UDVS3.tmp.6.dr	false		high
https://docs.rs/getrandom#nodejs-es-module-support/rust/deps	017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp, 00000006.00000003.1706353966.0000000005B30000.00000004.00001000.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000009.00000002.1762021981.000001371A211000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1846609385.000002524A321000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.v	powershell.exe, 0000000B.00000002.1946561582.00000252626E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 0000000B.00000002.1846609385.000002524A549000.00000004.00000800.00020000.00000000.sdmp	false		high

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582223
Start date and time:	2024-12-30 04:11:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	017069451a4dbc523a1165a2f1bd361a762bb40856778.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@25/417@20/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 18 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Time	Type	Description
03:12:15	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineUA{1E368EEB-D678-4F19-FF6D-518AE4C9820E} path: regsvr32 s>/S /i:360 C:\Users\user\AppData\Roaming\Setup_Ring.dll
22:12:02	API Interceptor	45x Sleep call for process: powershell.exe modified
22:12:27	API Interceptor	88092x Sleep call for process: regsvr32.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	http://nemoinsure.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://1drv.ms/o/c/1ba8fd2bd98c98a8/EmMMbLWVyqxBh9Z6zxri2ZUBVkwUpSiY2KbvhupkdaFzGA?e=F6pNlD	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Kellyb Timesheet Report.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.45
	ceFgl3jkkk.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BCPL-SGBGPNETGlobalASNSG	Lets-x64.exe	Get hash	malicious	Nitol, Zegost	Browse	202.79.169.178
	KL-3.1.16.exe	Get hash	malicious	Nitol, Zegost	Browse	143.92.60.116
	Whyet-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	118.107.45.13
	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	118.107.44.219
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	118.107.44.219
	Gabriel-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	118.107.45.13
	MEuu1a2o6n.exe	Get hash	malicious	GhostRat	Browse	118.107.44.219
	OdiHmn3pRK.exe	Get hash	malicious	Unknown	Browse	118.107.44.219
	S1Rv3ioghk.exe	Get hash	malicious	Unknown	Browse	118.107.44.112
	WiezmDFd6L.exe	Get hash	malicious	Unknown	Browse	134.122.155.90

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\is-ICN7T.tmp\_isetup\_setup64.tmp	vc8Kx5C54G.exe	Get hash	malicious	Socks5Systemz	Browse
	AbC0LBkVhr.exe	Get hash	malicious	Socks5Systemz	Browse
	Mg5bMQ2lWi.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	KRdh0OaXqH.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	wG1fFAzGfH.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	AGcC2uK0El.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	6hvZpn91O8.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	j9htknb7BQ.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse
	AMS_Client_SSO.exe	Get hash	malicious	Unknown	Browse
	i9DKxTZoVd.exe	Get hash	malicious	Unknown	Browse

Process:	C:\Windows\System32\regsvr32.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	97643
Entropy (8bit):	7.880181205983893
Encrypted:	false
SSDEEP:	1536:CBCz5m0ikEEa/NZd4WArZy1TWJWlIRCoT3CZTYhOnqG5iOQnALH5w/SWCcfMJ1je:WO/iXVZd4WAFyMJWvoLCOzG5YnMtWCZe
MD5:	BDFE2A997E8823D39361C38EC49B689C
SHA1:	2D6B142041177ACC967864A92B5F036676EE0465
SHA-256:	1C4D7FBFCC62AFF679B46BA2CD9C94FA7DAFE29EC3DE939C5F5051D596BE6763
SHA-512:	E02C7A8CB7B2A4482A85AEEB2D71632427C9A7A67ECADD920482AED895F689024E0AAD82C16D076F82D029017AEF15BD8F8849FF0A9CE09C863AA13FC4B658D5
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.*bi.F.xJ.5KC"...N...m.g....Uf.....?.2......Q.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..<.t..A...#'..N>.._.u.......^y.[......1..].+..B....%?........r.....{f`.'(Xw...&e.......Q...8X.V..._.^.(..(...&(....~....[.....).....+.F"8x{I.t.p....pj.g.Ez..+..........O.Wz.......\..4;?...O.........QA..Z.DqCr.Y...L....V..\A.

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

Process:	C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1223168
Entropy (8bit):	6.330739929540704
Encrypted:	false
SSDEEP:	24576:tYwCLCUplZhgjXj8YcgoniqO3CBiO0jaS+EtjC67V5QNx9Ie:MGUhni7iSFCQij
MD5:	D5A634439F2ABA0A8D26F31577C73343
SHA1:	7B86B632DDFC82EBC58861A3968B3D2138CD9D53
SHA-256:	B61A425A51DB33911BDC3B8CD89DD2FB47B9E6CDFABCBCAE29391B3568EED198
SHA-512:	A3A426FB963436E9C467506FEC6EF9C3919A9AB1CA15F92759B37672D0F3BDCC026B2A44A7AF684EA46455EE3216307E5818C282F7BDBCAD6C45DF24B1EE5AC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...V..O..........................................@..........................p...................@...............................7..................................................................................X...x............................text...<........................... ..`.itext.............................. ..`.data..../.......0..................@....bss....pa...............................idata...7.......8..................@....tls....<............ ...................rdata............... ..............@..@.rsrc................"..............@..@....................................@..@........................................................................................................................................

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\quickScreenShot\20241229\20241229231227.jpg

C:\ProgramData\quickScreenShot\20241229\20241229231327.jpg

C:\ProgramData\quickScreenShot\20241229\20241229231428.jpg

C:\ProgramData\quickScreenShot\20241229\20241229231529.jpg

C:\ProgramData\quickScreenShot\20241229\20241229231629.jpg

C:\ProgramData\quickScreenShot\20241229\20241229231730.jpg

C:\ProgramData\quickScreenShot\20241229\20241229231830.jpg

C:\ProgramData\quickScreenShot\20241229\20241229231930.jpg

C:\ProgramData\quickScreenShot\20241229\20241229232030.jpg

C:\ProgramData\quickScreenShot\20241229\20241229232130.jpg

C:\ProgramData\quickScreenShot\20241229\20241229232230.jpg

C:\ProgramData\quickScreenShot\20241229\20241229232331.jpg

C:\ProgramData\quickScreenShot\20241229\20241229232431.jpg

C:\ProgramData\quickScreenShot\20241229\20241229232531.jpg

C:\ProgramData\quickScreenShot\20241229\20241229232631.jpg

C:\ProgramData\quickScreenShot\20241229\20241229232731.jpg

C:\ProgramData\quickScreenShot\20241229\20241229232831.jpg

C:\ProgramData\quickScreenShot\20241229\20241229232931.jpg

C:\ProgramData\quickScreenShot\20241229\20241229233032.jpg

Windows Analysis Report
017069451a4dbc523a1165a2f1bd361a762bb40856778.exe

Entrypoint:	0x416478
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x499720E7 [Sat Feb 14 19:52:07 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	483f0c4259a9148c34961abbda6146c1

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e000	0xf9e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x21000	0x1a724	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x20000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e350	0x24c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x143f8	0x14400	c9bb3afc1ceaaa31127ccfa204c657ef	False	0.5487316743827161	data	6.482216817915366	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x16000	0xbe8	0xc00	1ba5adf2e1058c0460dcc814ba86fb32	False	0.6246744791666666	data	6.005798728198158	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x17000	0xd9c	0xe00	d5b22eff9e08edaa95f493c1a71158c0	False	0.2924107142857143	data	2.669288666959085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x18000	0x574c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x1e000	0xf9e	0x1000	b47eaca4c149ee829de76a342b5560d5	False	0.35595703125	data	4.9677831942996935	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x1f000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x20000	0x18	0x200	3746f5876803f8f30db5bb2deb8772ae	False	0.05078125	data	0.190488766434666	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x21000	0x1a724	0x1a800	26cd386614b3730e621ed84fc057c796	False	0.12855616155660377	data	4.2308792707919185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2138c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	English	United States	0.1033065183958358
RT_STRING	0x31bb4	0xc4	data			0.5969387755102041
RT_STRING	0x31c78	0xcc	data			0.6225490196078431
RT_STRING	0x31d44	0x174	data			0.5510752688172043
RT_STRING	0x31eb8	0x39c	data			0.34523809523809523
RT_STRING	0x32254	0x34c	data			0.4218009478672986
RT_STRING	0x325a0	0x294	data			0.4106060606060606
RT_RCDATA	0x32834	0x82e8	data	English	United States	0.11261637622344235
RT_RCDATA	0x3ab1c	0x10	data			1.5
RT_RCDATA	0x3ab2c	0x1a0	data			0.8149038461538461
RT_RCDATA	0x3accc	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x3acf8	0x14	data	English	United States	1.15
RT_VERSION	0x3ad0c	0x4b8	COM executable for DOS	English	United States	0.3170529801324503
RT_MANIFEST	0x3b1c4	0x560	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4251453488372093

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	GetKeyboardType, LoadStringW, MessageBoxA, CharNextW
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetSystemInfo, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenW, lstrcpynW, LoadLibraryExW, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetCommandLineW, FreeLibrary, FindFirstFileW, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleW
user32.dll	CreateWindowExW, TranslateMessage, SetWindowLongW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, ExitWindowsEx, DispatchMessageW, DestroyWindow, CharUpperBuffW, CallWindowProcW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, SizeofResource, SignalObjectAndWait, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, RemoveDirectoryW, ReadFile, MultiByteToWideChar, LockResource, LoadResource, LoadLibraryW, LeaveCriticalSection, InitializeCriticalSection, GetWindowsDirectoryW, GetVersionExW, GetUserDefaultLangID, GetThreadLocale, GetSystemInfo, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesW, GetExitCodeProcess, GetEnvironmentVariableW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentProcess, GetCommandLineW, GetCPInfo, InterlockedExchange, InterlockedCompareExchange, FreeLibrary, FormatMessageW, FindResourceW, EnumCalendarInfoW, EnterCriticalSection, DeleteFileW, DeleteCriticalSection, CreateProcessW, CreateFileW, CreateEventW, CreateDirectoryW, CompareStringW, CloseHandle
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW
comctl32.dll	InitCommonControls
kernel32.dll	Sleep
advapi32.dll	AdjustTokenPrivileges
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 04:12:28.443275928 CET	58075	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:12:28.627684116 CET	53	58075	1.1.1.1	192.168.2.4
Dec 30, 2024 04:12:33.528456926 CET	59966	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:12:33.536969900 CET	53	59966	1.1.1.1	192.168.2.4
Dec 30, 2024 04:12:38.528471947 CET	61137	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:12:38.676073074 CET	53	61137	1.1.1.1	192.168.2.4
Dec 30, 2024 04:12:43.528749943 CET	51888	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:12:43.694933891 CET	53	51888	1.1.1.1	192.168.2.4
Dec 30, 2024 04:12:48.528608084 CET	62085	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:12:48.676603079 CET	53	62085	1.1.1.1	192.168.2.4
Dec 30, 2024 04:12:53.528867960 CET	59480	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:12:53.690999031 CET	53	59480	1.1.1.1	192.168.2.4
Dec 30, 2024 04:12:58.531876087 CET	52549	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:12:58.732315063 CET	53	52549	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:03.535412073 CET	58627	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:03.684047937 CET	53	58627	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:08.832283020 CET	52287	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:09.071409941 CET	53	52287	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:13.528769016 CET	58188	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:13.694364071 CET	53	58188	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:18.529386997 CET	56808	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:18.695332050 CET	53	56808	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:23.528965950 CET	60441	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:23.768937111 CET	53	60441	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:28.528983116 CET	57232	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:28.692317963 CET	53	57232	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:33.528740883 CET	57951	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:33.755075932 CET	53	57951	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:38.535294056 CET	50033	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:38.541984081 CET	53	50033	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:43.530670881 CET	59898	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:43.771620035 CET	53	59898	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:48.531657934 CET	63595	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:48.702788115 CET	53	63595	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:53.528887033 CET	58074	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:53.761149883 CET	53	58074	1.1.1.1	192.168.2.4
Dec 30, 2024 04:13:58.531318903 CET	55782	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:13:58.795365095 CET	53	55782	1.1.1.1	192.168.2.4
Dec 30, 2024 04:14:03.559478998 CET	65330	53	192.168.2.4	1.1.1.1
Dec 30, 2024 04:14:03.822417021 CET	53	65330	1.1.1.1	192.168.2.4

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 04:12:55.997010946 CET	1.1.1.1	192.168.2.4	0xa0a5	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 04:12:55.997010946 CET	1.1.1.1	192.168.2.4	0xa0a5	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	22:11:56
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe"
Imagebase:	0x400000
File size:	1'150'632 bytes
MD5 hash:	9B33561C436559BC1DD43A1EB9DD413C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	22:11:57
Start date:	29/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-1N88P.tmp\017069451a4dbc523a1165a2f1bd361a762bb40856778.tmp" /SL5="$2044A,766234,203776,C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe"
Imagebase:	0x400000
File size:	1'223'168 bytes
MD5 hash:	D5A634439F2ABA0A8D26F31577C73343
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	22:12:00
Start date:	29/12/2024
Path:	C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\017069451a4dbc523a1165a2f1bd361a762bb40856778.exe" /VERYSILENT /SUPPRESSMSGBOXES
Imagebase:	0x400000
File size:	1'150'632 bytes
MD5 hash:	9B33561C436559BC1DD43A1EB9DD413C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true