Windows Analysis Report
g3y89237.exe

Malicious sample detected (through community Yara rule)

Source: global traffic

TCP traffic: 192.168.2.6:49813 -> 185.196.9.174:7777

Source: Joe Sandbox View

ASN Name: SIMPLECARRIERCH SIMPLECARRIERCH

Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174
Source: unknown	TCP traffic detected without corresponding DNS query: 185.196.9.174

Source: regsvr32.exe, 00000004.00000002.3418346673.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabG5
Source: regsvr32.exe, 00000004.00000002.3418346673.0000000002350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enen=b03f5f7&
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2309860244.0000020BAA2B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://osoft.co
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91BB1000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3418997736.0000000002742000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3418997736.00000000026C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2311324939.0000020BAA37E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

System Summary

Source: 4.2.regsvr32.exe.23d130d.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 4.2.regsvr32.exe.668bfd.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 4.2.regsvr32.exe.23d130d.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 4.2.regsvr32.exe.668bfd.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000002.3418525753.00000000023D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000002.3417790081.000000000064B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF5A810 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,	0_2_00007FF70BF5A810
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B36493C memset,HeapCreate,HeapAlloc,CreateTimerQueue,CreateEventW,GetModuleHandleA,GetLastError,memset,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,AddVectoredExceptionHandler,NtQueryInformationProcess,NtQuerySystemInformation,NtOpenThread,RtlFreeHeap,NtGetContextThread,NtSetContextThread,NtClose,DeleteFileW,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddressForCaller,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateEventW,WaitForSingleObject,GetLastError,memcpy,CloseHandle,	4_2_00007FFD8B36493C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B396DF0 NtReadFile,	4_2_00007FFD8B396DF0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B3753D0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,	4_2_00007FFD8B3753D0

Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF44F70	0_2_00007FF70BF44F70
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF44FE2	0_2_00007FF70BF44FE2
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF81C00	0_2_00007FF70BF81C00
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF88550	0_2_00007FF70BF88550
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF818D9	0_2_00007FF70BF818D9
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF464CC	0_2_00007FF70BF464CC
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF5ED20	0_2_00007FF70BF5ED20
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF73D80	0_2_00007FF70BF73D80
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF5DDC0	0_2_00007FF70BF5DDC0
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4BE10	0_2_00007FF70BF4BE10
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF50E10	0_2_00007FF70BF50E10
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF41E50	0_2_00007FF70BF41E50
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF69E80	0_2_00007FF70BF69E80
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4EF8C	0_2_00007FF70BF4EF8C
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF79F90	0_2_00007FF70BF79F90
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4EFFB	0_2_00007FF70BF4EFFB
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF88000	0_2_00007FF70BF88000
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF89040	0_2_00007FF70BF89040
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF52045	0_2_00007FF70BF52045
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF8C060	0_2_00007FF70BF8C060
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF77060	0_2_00007FF70BF77060
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F06B	0_2_00007FF70BF4F06B
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF6A06A	0_2_00007FF70BF6A06A
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF87090	0_2_00007FF70BF87090
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4A950	0_2_00007FF70BF4A950
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F9A5	0_2_00007FF70BF4F9A5
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF729B0	0_2_00007FF70BF729B0
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF459C2	0_2_00007FF70BF459C2
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF489F0	0_2_00007FF70BF489F0
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF69A10	0_2_00007FF70BF69A10
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4FA24	0_2_00007FF70BF4FA24
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF46A45	0_2_00007FF70BF46A45
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF64A70	0_2_00007FF70BF64A70
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF5BAC0	0_2_00007FF70BF5BAC0
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF6DAD0	0_2_00007FF70BF6DAD0
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4EB70	0_2_00007FF70BF4EB70
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF5FB80	0_2_00007FF70BF5FB80
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4EC30	0_2_00007FF70BF4EC30
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4FC94	0_2_00007FF70BF4FC94
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4CCD0	0_2_00007FF70BF4CCD0
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF45526	0_2_00007FF70BF45526
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F583	0_2_00007FF70BF4F583
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F5A6	0_2_00007FF70BF4F5A6
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF6C5B0	0_2_00007FF70BF6C5B0
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F5F5	0_2_00007FF70BF4F5F5
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF6A60F	0_2_00007FF70BF6A60F
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4663B	0_2_00007FF70BF4663B
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF45646	0_2_00007FF70BF45646
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF8F660	0_2_00007FF70BF8F660
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF73660	0_2_00007FF70BF73660
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF8F680	0_2_00007FF70BF8F680
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F69D	0_2_00007FF70BF4F69D
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF466A5	0_2_00007FF70BF466A5
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF7A700	0_2_00007FF70BF7A700
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF77750	0_2_00007FF70BF77750
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4B760	0_2_00007FF70BF4B760
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F7AB	0_2_00007FF70BF4F7AB
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F816	0_2_00007FF70BF4F816
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF87819	0_2_00007FF70BF87819
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF75850	0_2_00007FF70BF75850
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4C880	0_2_00007FF70BF4C880
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF81900	0_2_00007FF70BF81900
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF53120	0_2_00007FF70BF53120
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F166	0_2_00007FF70BF4F166
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF75160	0_2_00007FF70BF75160
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF8E1C0	0_2_00007FF70BF8E1C0
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF7B1D0	0_2_00007FF70BF7B1D0
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF441F8	0_2_00007FF70BF441F8
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF43200	0_2_00007FF70BF43200
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF87240	0_2_00007FF70BF87240
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF72260	0_2_00007FF70BF72260
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF46270	0_2_00007FF70BF46270
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF452E6	0_2_00007FF70BF452E6
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF6A2E7	0_2_00007FF70BF6A2E7
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F37A	0_2_00007FF70BF4F37A
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF5E3B0	0_2_00007FF70BF5E3B0
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF45406	0_2_00007FF70BF45406
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF6A419	0_2_00007FF70BF6A419
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF70420	0_2_00007FF70BF70420
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF7C430	0_2_00007FF70BF7C430
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF64470	0_2_00007FF70BF64470
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F47C	0_2_00007FF70BF4F47C
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF4F4E9	0_2_00007FF70BF4F4E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34784DFA	2_2_00007FFD34784DFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD3478B9F2	2_2_00007FFD3478B9F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD3478264D	2_2_00007FFD3478264D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34788D70	2_2_00007FFD34788D70
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD3478BAFA	2_2_00007FFD3478BAFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD3478B300	2_2_00007FFD3478B300
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34784270	2_2_00007FFD34784270
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34788AB5	2_2_00007FFD34788AB5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34783812	2_2_00007FFD34783812
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34853C21	2_2_00007FFD34853C21
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B36493C	4_2_00007FFD8B36493C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B3627CB	4_2_00007FFD8B3627CB
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B36358F	4_2_00007FFD8B36358F
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B377C20	4_2_00007FFD8B377C20
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B37DAB0	4_2_00007FFD8B37DAB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B38BB20	4_2_00007FFD8B38BB20
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B36EB10	4_2_00007FFD8B36EB10
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B361B17	4_2_00007FFD8B361B17
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B38E8E0	4_2_00007FFD8B38E8E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B385910	4_2_00007FFD8B385910
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B398050	4_2_00007FFD8B398050
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B378010	4_2_00007FFD8B378010
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B38CEB0	4_2_00007FFD8B38CEB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B36AED0	4_2_00007FFD8B36AED0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B392ED0	4_2_00007FFD8B392ED0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B382E90	4_2_00007FFD8B382E90
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B367E50	4_2_00007FFD8B367E50
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B36237F	4_2_00007FFD8B36237F
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B38B400	4_2_00007FFD8B38B400
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B3832F0	4_2_00007FFD8B3832F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B379310	4_2_00007FFD8B379310
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B3771A4	4_2_00007FFD8B3771A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B38E210	4_2_00007FFD8B38E210
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B37E0B0	4_2_00007FFD8B37E0B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B3940D0	4_2_00007FFD8B3940D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B39F060	4_2_00007FFD8B39F060
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B390090	4_2_00007FFD8B390090
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B36A120	4_2_00007FFD8B36A120
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B38C7D0	4_2_00007FFD8B38C7D0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B390760	4_2_00007FFD8B390760
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B36182A	4_2_00007FFD8B36182A
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B3896F0	4_2_00007FFD8B3896F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B393620	4_2_00007FFD8B393620
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B3735F0	4_2_00007FFD8B3735F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD8B396540	4_2_00007FFD8B396540
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_02416A1C	4_2_02416A1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_02416DF8	4_2_02416DF8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_02417228	4_2_02417228
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_0241A4D4	4_2_0241A4D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_02415B40	4_2_02415B40
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_02417CDC	4_2_02417CDC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD347914A8	4_2_00007FFD347914A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD34795F45	4_2_00007FFD34795F45
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD347A0E66	4_2_00007FFD347A0E66
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD3479719E	4_2_00007FFD3479719E
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD347A1C12	4_2_00007FFD347A1C12
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD3479CDCD	4_2_00007FFD3479CDCD
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_00007FFD34797362	4_2_00007FFD34797362

Source: C:\Users\user\Desktop\g3y89237.exe	Code function: String function: 00007FF70BF48ED0 appears 63 times
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: String function: 00007FF70BF4A360 appears 37 times
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: String function: 00007FF70BF5A0A0 appears 75 times
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: String function: 00007FF70BF8FD54 appears 72 times
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: String function: 00007FF70BF43C30 appears 78 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 00007FFD8B374C90 appears 109 times
Source: C:\Windows\System32\regsvr32.exe	Code function: String function: 00007FFD8B368330 appears 69 times

Source: QEMs.ini.0.dr	Static PE information: Number of sections : 11 > 10
Source: g3y89237.exe	Static PE information: Number of sections : 11 > 10

Source: 4.2.regsvr32.exe.23d130d.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 4.2.regsvr32.exe.668bfd.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 4.2.regsvr32.exe.23d130d.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 4.2.regsvr32.exe.668bfd.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000002.3418525753.00000000023D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000002.3417790081.000000000064B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/7@0/2

Source: C:\Users\user\Desktop\g3y89237.exe

Code function: 0_2_00007FF70BF5CCF0 memset,FormatMessageW,GetLastError,HeapFree,HeapFree,

0_2_00007FF70BF5CCF0

Source: C:\Users\user\Desktop\g3y89237.exe

Code function: 0_2_00007FF70BF8C060 SetLastError,GetCurrentDirectoryW,GetLastError,GetLastError,HeapFree,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlLookupFunctionEntry,CreateToolhelp32Snapshot,memset,Module32FirstW,Module32NextW,UnmapViewOfFile,CloseHandle,HeapFree,UnmapViewOfFile,CloseHandle,CloseHandle,HeapFree,HeapFree,HeapFree,HeapFree,GetLastError,HeapFree,HeapFree,

0_2_00007FF70BF8C060

Source: C:\Users\user\Desktop\g3y89237.exe

File created: C:\Users\user\AppData\Roaming\QEMs.ini

Source: C:\Windows\System32\regsvr32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2760:120:WilError_03
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\LsdacJlsbotslshJmsr
Source: C:\Windows\System32\regsvr32.exe	Mutant created: \Sessions\1\BaseNamedObjects\cbRHd
Source: C:\Users\user\Desktop\g3y89237.exe	Mutant created: \Sessions\1\BaseNamedObjects\MUTEX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_es3wdygj.rbs.ps1

Source: g3y89237.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\g3y89237.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: g3y89237.exe

ReversingLabs: Detection: 57%

Source: unknown	Process created: C:\Users\user\Desktop\g3y89237.exe "C:\Users\user\Desktop\g3y89237.exe"
Source: C:\Users\user\Desktop\g3y89237.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{8C004488-0C84-408C-CC80-404C848444CC}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini
Source: C:\Users\user\Desktop\g3y89237.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini
Source: C:\Users\user\Desktop\g3y89237.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{8C004488-0C84-408C-CC80-404C848444CC}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"	Jump to behavior
Source: C:\Users\user\Desktop\g3y89237.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini	Jump to behavior

Source: C:\Users\user\Desktop\g3y89237.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\g3y89237.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\g3y89237.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\g3y89237.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Users\user\Desktop\g3y89237.exe

File written: C:\Users\user\AppData\Roaming\QEMs.ini

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Suspicious powershell command line found

Source: g3y89237.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: g3y89237.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation

Source: C:\Users\user\Desktop\g3y89237.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{8C004488-0C84-408C-CC80-404C848444CC}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Source: C:\Users\user\Desktop\g3y89237.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{8C004488-0C84-408C-CC80-404C848444CC}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"			Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 4_2_00007FFD8B36493C memset,HeapCreate,HeapAlloc,CreateTimerQueue,CreateEventW,GetModuleHandleA,GetLastError,memset,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,AddVectoredExceptionHandler,NtQueryInformationProcess,NtQuerySystemInformation,NtOpenThread,RtlFreeHeap,NtGetContextThread,NtSetContextThread,NtClose,DeleteFileW,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddressForCaller,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateEventW,WaitForSingleObject,GetLastError,memcpy,CloseHandle,

4_2_00007FFD8B36493C

Source: g3y89237.exe	Static PE information: section name: .xdata
Source: QEMs.ini.0.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD3466D2A5 pushad ; iretd	2_2_00007FFD3466D2A6
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_023D4BC4 push es; retf 0000h	4_2_023D4BCC
Source: C:\Windows\System32\regsvr32.exe	Code function: 4_2_023D4C11 push es; retf	4_2_023D4C25

Source: C:\Users\user\Desktop\g3y89237.exe

File created: C:\Users\user\AppData\Roaming\QEMs.ini

Jump to dropped file

Source: C:\Users\user\Desktop\g3y89237.exe

File created: C:\Users\user\AppData\Roaming\QEMs.ini

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 25C0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Memory allocated: 1A6C0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4478	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5398	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Window / User API: threadDelayed 7597	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Window / User API: threadDelayed 2266	Jump to behavior

Source: C:\Users\user\Desktop\g3y89237.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\QEMs.ini

Jump to dropped file

Source: C:\Users\user\Desktop\g3y89237.exe	API coverage: 9.2 %
Source: C:\Windows\System32\regsvr32.exe	API coverage: 7.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 964	Thread sleep count: 4478 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 964	Thread sleep count: 5398 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2244	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 4232	Thread sleep count: 7597 > 30	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 5956	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1212	Thread sleep count: 2266 > 30	Jump to behavior

Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF44F70 GetSystemTimePreciseAsFileTime followed by cmp: cmp rax, 01h and CTI: jnbe 00007FF70BF45304h	0_2_00007FF70BF44F70
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF44F70 GetSystemTimePreciseAsFileTime followed by cmp: cmp rax, 01h and CTI: jnbe 00007FF70BF4542Ch	0_2_00007FF70BF44F70
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF44F70 GetSystemTimePreciseAsFileTime followed by cmp: cmp rax, 01h and CTI: jnbe 00007FF70BF45544h	0_2_00007FF70BF44F70
Source: C:\Users\user\Desktop\g3y89237.exe	Code function: 0_2_00007FF70BF44F70 GetSystemTimePreciseAsFileTime followed by cmp: cmp rax, 01h and CTI: jnbe 00007FF70BF4566Ch	0_2_00007FF70BF44F70

Source: C:\Windows\System32\regsvr32.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: regsvr32.exe, 00000004.00000002.3418346673.0000000002350000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\System32\regsvr32.exe

4_2_00007FFD8B36493C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\g3y89237.exe

Code function: 0_2_00007FF70BF41180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,

0_2_00007FF70BF41180

Source: C:\Users\user\Desktop\g3y89237.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\System32\regsvr32.exe

Network Connect: 185.196.9.174 7777

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\g3y89237.exe

NtWriteFile: Indirect: 0x7FF70BF5A861

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\regsvr32.exe

Thread register set: 356 5

Source: C:\Users\user\Desktop\g3y89237.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{8C004488-0C84-408C-CC80-404C848444CC}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"			Jump to behavior
Source: C:\Users\user\Desktop\g3y89237.exe	Process created: C:\Windows\System32\regsvr32.exe "regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini			Jump to behavior

Source: C:\Users\user\Desktop\g3y89237.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata/roaming/qems.ini\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{8c004488-0c84-408c-cc80-404c848444cc}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries)"
Source: C:\Users\user\Desktop\g3y89237.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" "register-scheduledtask -action (new-scheduledtaskaction -execute \"regsvr32\" -argument \"/s /i:install c:\users\user\appdata/roaming/qems.ini\") -trigger (new-scheduledtasktrigger -once -at (get-date).addminutes(1) -repetitioninterval (new-timespan -minutes 1)) -taskname 'microsoftedgeupdatetaskmachineua{8c004488-0c84-408c-cc80-404c848444cc}' -description 'default' -settings (new-scheduledtasksettingsset -allowstartifonbatteries -dontstopifgoingonbatteries)"			Jump to behavior

Source: regsvr32.exe, 00000004.00000002.3418997736.0000000002738000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3420968424.000000001B772000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3418997736.0000000002A00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: regsvr32.exe, 00000004.00000002.3418997736.0000000002738000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3418997736.0000000002A08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\g3y89237.exe

Code function: 0_2_00007FF70BF88550 GetCurrentProcessId,ProcessPrng,HeapFree,CreateNamedPipeW,GetLastError,HeapFree,HeapFree,HeapFree,CloseHandle,HeapFree,HeapFree,HeapFree,CloseHandle,

0_2_00007FF70BF88550

Source: C:\Users\user\Desktop\g3y89237.exe

Code function: 0_2_00007FF70BF44F70 CreateMutexA,GetLastError,SHGetKnownFolderPath,lstrlenW,CoTaskMemFree,GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,memcpy,memset,RtlFreeHeap,RtlFreeHeap,HeapFree,RtlFreeHeap,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,CloseHandle,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,

0_2_00007FF70BF44F70

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Found many strings related to Crypto-Wallets (likely being stolen)

Source: regsvr32.exe, 00000004.00000002.3418346673.00000000023B2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3420402664.000000001B1C2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3420402664.000000001B009000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\regsvr32.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match

File source: Process Memory Space: regsvr32.exe PID: 356, type: MEMORYSTR

Source: regsvr32.exe, 00000004.00000002.3418997736.0000000002A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \\Electrum\\wall
Source: regsvr32.exe, 00000004.00000002.3418997736.0000000002A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb
Source: regsvr32.exe, 00000004.00000002.3418997736.0000000002A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \\Exodus\\exodus
Source: regsvr32.exe, 00000004.00000002.3418997736.0000000002A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \\Exodus\\exodus
Source: powershell.exe, 00000002.00000002.2324083460.00007FFD34950000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Remote Access Functionality

Yara detected DcRat

Source: Yara match

File source: Process Memory Space: regsvr32.exe PID: 356, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	213 Process Injection	11 Masquerading	OS Credential Dumping	11 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	213 Process Injection	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	14 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
g3y89237.exe	58%	ReversingLabs	Win64.Worm.AutoRun

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\QEMs.ini	3%	ReversingLabs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2304433922.0000020BA1C20000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://osoft.co	powershell.exe, 00000002.00000002.2309860244.0000020BAA2B7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.microsoft.	powershell.exe, 00000002.00000002.2311324939.0000020BAA37E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2280528606.0000020B91BB1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2280528606.0000020B91BB1000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3418997736.0000000002742000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000004.00000002.3418997736.00000000026C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2280528606.0000020B91DD8000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
8.8.8.8	unknown	United States		15169	GOOGLEUS	false
185.196.9.174	unknown	Switzerland		42624	SIMPLECARRIERCH	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529307
Start date and time:	2024-10-08 20:50:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	g3y89237.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/7@0/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 93% Number of executed functions: 28 Number of non-executed functions: 196
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6008 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: g3y89237.exe

Simulations

Behavior and APIs

Time	Type	Description
14:51:10	API Interceptor	42x Sleep call for process: powershell.exe modified
20:51:20	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineUA{8C004488-0C84-408C-CC80-404C848444CC} path: regsvr32 s>/s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRIERCH	z71htmivzKAUpOkr2J.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	1tstvk3Sls.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.196.11.237
	GX9zyKVNXR.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	Lys2hJAvd1.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	JfvFiUr0DO.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	gLKtR4HuEw.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	injector V2.5.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	Jeverly.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	by_execute.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	Shark#U041ePShC.exe	Get hash	malicious	RedLine	Browse	185.196.9.26

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul1jR:NllU
MD5:	0EC63F8643FAD46EC878DB86E00F7FF5
SHA1:	53D9444F5369A346E09B2E3D95E06D838BD43A52
SHA-256:	E35DD4598E36CB170B240FD08843073B98DD8BDA901C13FCEBC923ABA2EAE934
SHA-512:	EF572FBB9395F9077C737A458960558BDB7CBBDD183001ECEB1ABF4B82784F0B16E3A7BA1F1F3353E73387AEBC28952A198979E10FE3FD13F2064E69DA69677F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e..................................."............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30oytdva.odu.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ameqqxp.hmz.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eryajlto.zes.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_es3wdygj.rbs.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\second_data_temp.zip

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	196418
Entropy (8bit):	7.940648651684764
Encrypted:	false
SSDEEP:	3072:cawln3q3afb9T3kjA8TDNu7gL1JkCS+2/lybYq0ammMRuM7Wk3BG3u9ut2onhzjZ:i3q3aD9jWA81u7gL1M+2ohymMsMyk3BQ
MD5:	97C72688B52C0414DBDD568B79164CD1
SHA1:	8228C716B40DB6618C479FEB5780CB5A83E048C5
SHA-256:	813B1356C67E8243329C41F7235172DD46E5305F5B01961C1C499F9CDBB55A05
SHA-512:	70EADC06297D9D1EF24D0230D3032C9175D3571BE4A7C739F8F130727068C2CE6F5D2CA7C6FE4601B9102EC830DFEFE62397452C702BA8566A80AA2849AC1BE5
Malicious:	false
Preview:	PK........IJ<Y..5...........second_data.bin.\gT.M.F@d..T.."....H.E...5..M...T.... b.7.?..D..R.......(.P.N.d-aw......y....w&.W>,,..D3..iw.K.hH..5.0..)1....Z$"=.@..._..R....e..<...g..g....Y.I.......n~z..Q\.%.N..C.kBs.F.f..H...X.j....:...v9..r..[..^.h?.'..~-\|..;.....K..........%......x.R...n.....0_K)..kZ\.......c.c.#v...yp..........wZ..1.Xz..fmm.Z!e=...M.....T...l.twoy....O..BD^.....X5.....`..C3..8....i._iIf.......V...(.....%.VP..i.!y...#...T...K.W[.>..tX.....@.!~(....;...E..':b.s'Vx.....K.7,\m9g...?.T.{..........n.f.........DmOU\sT....I..z.s..............x:.Jz....U...?.......Fev.t^kRm.v H.Z.b..j.yH~q.oN.[I...s..?......p.`z.\.u.vY.B].......[.Q...S.....>..o.?..Z.H<#.So?ouT.wF....:..yRg....U-4.QV..../....Y...c......'.w.<.r..jx..Wm:V..-.H_l...o.=O...j[.fFQ.>G>IY.#%.....#...>.K..ceW......H..V>....,.Sy?.7..k..S..cd......7.._......{r.-.......Z..eJ..%C6......_...........\.h.r....fJ\|7)..O.'....eC.NK~....".Ey......v..Q.A.]*.2.^9.K.i.bR....

C:\Users\user\AppData\Roaming\QEMs.ini

Process:	C:\Users\user\Desktop\g3y89237.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	565760
Entropy (8bit):	7.22638858913546
Encrypted:	false
SSDEEP:	12288:KOP1GIVEBUsI3NdVU+VwQCaRjWz1u7iP9hYR0g:nLGi73NdVU+VwQCt1uwLYR
MD5:	3215CD0C5B1A3C9FA3507E56D987372E
SHA1:	B0EBBCCAE5B02E287EAFCEAC9D7D69785928C0DF
SHA-256:	8E5ABD89E9823C6BE5C6D149F15434FB84760A008F2034A0D17F8C0094F738CF
SHA-512:	AB32F2E6C72F46AFA16EDF7DD4F7F2DF684751F94B7E2B81452E2AF7CEAE29888FF93CE55BD0007DF4168F7F42588EBCDC553C1C724962AA37603EC1B7AD2CF0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...],.f..........."...*............0................................................5....`... .................................................h............`..x...........................................`A..(.......................0............................text...............................`..`.data...............................@....rdata..............................@..@.pdata..x....`.......<..............@..@.xdata.../.......0...X..............@..@.bss....@................................edata..............................@..@.idata..h...........................@....CRT....`...........................@....tls................................@....reloc..............................@..B........................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.474155007450314
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	g3y89237.exe
File size:	813'056 bytes
MD5:	95a6d287978fa62ad30f26bae7aec73b
SHA1:	759461ef978d1fc7d8a0571980b0065b51a61531
SHA256:	48980f70da16b59927768b0e3a4d56c8c98e129f05f7f26b81847ffede708428
SHA512:	4b2c702d64893804a803e4414ef22d4eaa8fbb95678d1b9011a46dd5c94fb7d1945cfe49a67dc345f6260f7ee23f4ca6601a60634e977b6b84ca9d02072c6003
SSDEEP:	24576:JqmTmwgCof8IO6kh97pa66GbKHA+bEFymZtsnmPI9SflCE9:Jqm67CovO6kr7l9bsA3nfsng9CE
TLSH:	4505D05BB59165BDD156C0B4A3969A73AA33B88A15307D7F03E0C2343F5AE601F2CF29
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...r,.f...............*.....d.................@.....................................A....`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400013d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x66F82C72 [Sat Sep 28 16:18:58 2024 UTC]
TLS Callbacks:	0x4001bd50, 0x1, 0x40050630, 0x1, 0x40050600, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1126c03dff64ebd50cc488a05fb408fc

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000BF775h]
mov dword ptr [eax], 00000001h
call 00007F2348E97A4Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [000BF755h]
mov dword ptr [eax], 00000000h
call 00007F2348E97A2Fh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F2348EE6D74h
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F2348E97C89h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ecx
push edi
inc ecx
push esi
inc ecx
push esp
push esi
push edi
push ebx
dec eax
sub esp, 58h
dec eax
mov esi, edx
dec eax
mov edi, ecx
xorps xmm0, xmm0
movaps esp+40h, dqword ptr [xmm0]
movaps esp+30h, dqword ptr [xmm0]
dec eax
lea ebx, dword ptr [esp+28h]
dec esp
lea esi, dword ptr [esp+30h]
dec esp
lea edi, dword ptr [00051B7Fh]
dec esp
lea esp, dword ptr [00051B88h]
nop dword ptr [eax+eax+00000000h]
inc ecx
mov eax, 00000020h
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8000	0x12fc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcc000	0x4e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xc1000	0x1a04	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xcd000	0x4f4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc07a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc8498	0x3e0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x50658	0x50800	2645da5252a8ede0ab4bce17306bbc97	False	0.5288571185947205	data	6.316500921252662	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x52000	0x100	0x200	10eb475aeba5d9d51c142f7732b620fa	False	0.115234375	data	0.6706989826579657	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x53000	0x6dc60	0x6de00	b52a252b3d733ec5a51b845151e68585	False	0.9442859428327645	data	7.941446733172013	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0xc1000	0x1a04	0x1c00	b83c0c8e30f804b9063bd6f6fa6c57a9	False	0.4877232142857143	data	5.3403135577888605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0xc3000	0x3b90	0x3c00	22efaa79625930fcf57efa266b0a0df9	False	0.4087890625	data	5.6697002618983285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0xc7000	0x200	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc8000	0x12fc	0x1400	506063cf9ba0d152684b0d41f4abeecc	False	0.3203125	COM executable for DOS	4.499330191107107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xca000	0x68	0x200	9fce38482d7d11a62c73b491188da9fd	False	0.07421875	data	0.37876561408198567	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xcb000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xcc000	0x4e8	0x600	ff2527db6408abb7a087171a5113ff09	False	0.3352864583333333	data	4.784930512373522	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xcd000	0x4f4	0x600	b1c8fb044929943ce0b3cf41acc33d7c	False	0.5696614583333334	data	4.90304425543602	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xcc058	0x48f	XML 1.0 document, ASCII text			0.40102827763496146

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, InitializeCriticalSection, LeaveCriticalSection, RaiseException, RtlUnwindEx, VirtualProtect, VirtualQuery, __C_specific_handler
msvcrt.dll	__getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _fpreset, _initterm, _onexit, abort, calloc, exit, fprintf, free, fwrite, malloc, memcmp, memcpy, memmove, memset, signal, strlen, strncmp, vfprintf
ntdll.dll	NtReadFile, NtWriteFile, RtlNtStatusToDosError
KERNEL32.dll	AddVectoredExceptionHandler, CancelIo, CloseHandle, CompareStringOrdinal, CreateEventW, CreateFileMappingA, CreateFileW, CreateMutexA, CreateNamedPipeW, CreateProcessW, CreateThread, CreateToolhelp32Snapshot, DeleteProcThreadAttributeList, DuplicateHandle, FormatMessageW, FreeEnvironmentStringsW, GetConsoleMode, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFullPathNameW, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetStdHandle, GetSystemDirectoryW, GetSystemTimePreciseAsFileTime, GetWindowsDirectoryW, HeapAlloc, HeapFree, HeapReAlloc, InitOnceBeginInitialize, InitOnceComplete, InitializeProcThreadAttributeList, MapViewOfFile, Module32FirstW, Module32NextW, MultiByteToWideChar, ReadFile, ReadFileEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetFileInformationByHandle, SetLastError, SetThreadStackGuarantee, SetUnhandledExceptionFilter, Sleep, SleepEx, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnmapViewOfFile, UpdateProcThreadAttribute, WaitForMultipleObjects, WaitForSingleObject, WriteConsoleW, WriteFileEx, lstrlenW
ole32.dll	CoTaskMemFree
SHELL32.dll	SHGetKnownFolderPath
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
bcryptprimitives.dll	ProcessPrng

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T20:51:31.760492+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	185.196.9.174	7777	192.168.2.6	49813	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 20:51:31.100656033 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:31.105777979 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:31.105863094 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:31.132884026 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:31.138326883 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:31.751373053 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:31.755328894 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:31.760492086 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:31.954617023 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:32.006150961 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:34.733884096 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:34.740019083 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:34.740672112 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:34.746701002 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:45.409971952 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:45.415251970 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:45.415329933 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:45.420226097 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:45.618129969 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:45.662375927 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:45.760426044 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:45.803019047 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:56.069075108 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:56.077176094 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:56.077244997 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:56.083287954 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:56.434566975 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:56.474896908 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:51:56.581466913 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:51:56.631181955 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:06.745662928 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:06.751518011 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:06.751595974 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:06.756894112 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:07.087275028 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:07.131202936 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:07.229324102 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:07.271852970 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:17.412918091 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:17.418009043 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:17.418077946 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:17.423330069 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:17.623289108 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:17.678097010 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:17.792530060 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:17.834328890 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:28.084896088 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:28.090074062 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:28.090193987 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:28.095894098 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:28.434242010 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:28.475030899 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:28.572995901 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:28.615571022 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:38.761836052 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:38.766853094 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:38.770273924 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:38.775502920 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:39.109386921 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:39.162447929 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:39.247435093 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:39.303051949 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:49.428792000 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:49.555726051 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:49.557833910 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:49.562957048 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:49.896245003 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:49.943697929 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:52:50.042135954 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:52:50.084480047 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:00.101666927 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:00.106807947 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:00.107037067 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:00.111995935 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:00.463148117 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:00.506511927 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:00.589169025 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:00.631247997 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:10.796350956 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:10.805334091 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:10.805393934 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:10.813086987 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:11.150815010 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:11.193774939 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:11.292645931 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:11.334352016 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:15.185776949 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:15.191323996 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:15.191404104 CEST	49813	7777	192.168.2.6	185.196.9.174
Oct 8, 2024 20:53:15.197130919 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:15.640657902 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:15.668472052 CEST	7777	49813	185.196.9.174	192.168.2.6
Oct 8, 2024 20:53:15.668556929 CEST	49813	7777	192.168.2.6	185.196.9.174

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 8, 2024 20:51:25.096282005 CEST	192.168.2.6	8.8.8.8	4d5a		Echo
Oct 8, 2024 20:51:25.103641987 CEST	8.8.8.8	192.168.2.6	555a		Echo Reply

Target ID:	0
Start time:	14:51:06
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\g3y89237.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\g3y89237.exe"
Imagebase:	0x7ff70bf40000
File size:	813'056 bytes
MD5 hash:	95A6D287978FA62AD30F26BAE7AEC73B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	14:51:07
Start date:	08/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" "Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute \"regsvr32\" -Argument \"/s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini\") -Trigger (New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(1) -RepetitionInterval (New-TimeSpan -Minutes 1)) -TaskName 'MicrosoftEdgeUpdateTaskMachineUA{8C004488-0C84-408C-CC80-404C848444CC}' -Description 'Default' -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries)"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	14:51:07
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	14:51:20
Start date:	08/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.EXE /s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini
Imagebase:	0x7ff781110000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000002.3418525753.00000000023D0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000002.3417790081.000000000064B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	14:51:24
Start date:	08/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"regsvr32" /s /i:INSTALL C:\Users\user\AppData/Roaming/QEMs.ini
Imagebase:	0x7ff781110000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true