IOC Report
3.ps1

loading gif

Files

File Path
Type
Category
Malicious
3.ps1
ASCII text, with very long lines (12594), with CRLF line terminators
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
modified
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5noeq2o4.gsw.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ngfgu5wb.msr.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WMNT3I4XNG9Y59JGGE9M.temp
data
dropped

Processes

Path
Cmdline
Malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\3.ps1"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
3.78.244.11
malicious
http://3.78.244.11:8080/dot.gif
3.78.244.11
 malicious
http://3.78.244.11:8080/dot.gifG
unknown
http://nuget.org/NuGet.exe
unknown
http://pesterbdd.com/images/Pester.png
unknown
http://3.78.244.11:8080/dot.gif~
unknown
http://www.apache.org/licenses/LICENSE-2.0.html
unknown
https://go.micro
unknown
http://3.78.244.11:8080/dot.gif11:8080/dot.gif
unknown
https://contoso.com/License
unknown
http://3.78.244.11:8080/dot.gifD
unknown
https://contoso.com/Icon
unknown
http://3.78.244.11:8080/dot.gifllV
unknown
http://3.78.244.11:8080/dot.gifPDL
unknown
http://3.78.244.11:8080/dot.gifll
unknown
https://github.com/Pester/Pester
unknown
http://3.78.244.11:8080/dot.gifU
unknown
https://contoso.com/
unknown
https://nuget.org/nuget.exe
unknown
http://3.78.244.11:8080/dot.gife
unknown
http://3.78.244.11:8080/dot.gifystem32
unknown
http://3.78.244.11:8080/dot.gif9.0
unknown
https://aka.ms/pscore68
unknown
http://127.0.0.1:%u/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://3.78.244.11:8080/dot.gif1
unknown
http://crl.v
unknown
http://3.78.244.11:8080/dot.gif2
unknown
There are 18 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
3.78.244.11
unknown
United States
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
22EF9EB0000
heap
page read and write
 malicious
22EFA0B0000
direct allocation
page execute and read and write
 malicious
22EF1AEF000
trusted library allocation
page read and write
 malicious
22EF1952000
trusted library allocation
page read and write
 malicious
22EE28B3000
trusted library allocation
page read and write
 malicious
22EF9B10000
direct allocation
page execute and read and write
 malicious
22EDFA90000
heap
page read and write
7FFD9B770000
trusted library allocation
page read and write
7FFD9B9C0000
trusted library allocation
page read and write
22EE2E6B000
trusted library allocation
page read and write
7FFD9B957000
trusted library allocation
page read and write
A30D8CC000
stack
page read and write
7FFD9BA60000
trusted library allocation
page read and write
22EF9CD3000
heap
page read and write
22EF98E4000
heap
page read and write
22EFA103000
direct allocation
page execute and read and write
7FFD9B774000
trusted library allocation
page read and write
22EFA0FE000
direct allocation
page execute and read and write
22EDF8C0000
heap
page read and write
7FFD9B92A000
trusted library allocation
page read and write
7FFD9B77D000
trusted library allocation
page execute and read and write
22EE1966000
trusted library allocation
page read and write
22EF9D9D000
heap
page read and write
A30CCFF000
stack
page read and write
22EF9A2A000
heap
page read and write
7FFD9B980000
trusted library allocation
page read and write
7FFD9B954000
trusted library allocation
page read and write
7FFD9B772000
trusted library allocation
page read and write
22EF9BA0000
heap
page execute and read and write
22EE12A0000
heap
page read and write
7FFD9B9D0000
trusted library allocation
page read and write
7FFD9BA20000
trusted library allocation
page read and write
7FFD9BA40000
trusted library allocation
page read and write
22EF9CE5000
heap
page read and write
22EDF964000
heap
page read and write
22EDF9AC000
heap
page read and write
22EDF942000
heap
page read and write
22EDF966000
heap
page read and write
22EF9BA7000
heap
page execute and read and write
A30D782000
stack
page read and write
22EF9D98000
heap
page read and write
22EDFAB0000
heap
page read and write
7FFD9BA70000
trusted library allocation
page read and write
7FFD9BAD0000
trusted library allocation
page read and write
7FFD9BA80000
trusted library allocation
page read and write
22EF9CE3000
heap
page read and write
7FFD9B921000
trusted library allocation
page read and write
22EF9A2F000
heap
page read and write
A30C8FE000
stack
page read and write
22EE1370000
trusted library allocation
page read and write
22EE13C5000
heap
page read and write
22EDF97E000
heap
page read and write
7FFD9B910000
trusted library allocation
page read and write
22EF9D9F000
heap
page read and write
7FFD9BA90000
trusted library allocation
page read and write
A30C2B5000
stack
page read and write
22EDF8C9000
heap
page read and write
22EF9CD6000
heap
page read and write
22EE1B08000
trusted library allocation
page read and write
7FFD9B856000
trusted library allocation
page execute and read and write
22EE1740000
trusted library allocation
page read and write
7FFD9BB00000
trusted library allocation
page read and write
22EDFC80000
heap
page read and write
22EF9DB2000
heap
page read and write
7FFD9B890000
trusted library allocation
page execute and read and write
22EF9BD0000
heap
page read and write
A30CC7F000
stack
page read and write
22EDFC85000
heap
page read and write
22EE301D000
trusted library allocation
page read and write
7FFD9B82C000
trusted library allocation
page execute and read and write
22EDF96A000
heap
page read and write
7FFD9B990000
trusted library allocation
page read and write
22EF18F0000
trusted library allocation
page read and write
22EF9A73000
heap
page read and write
7FFD9BAB0000
trusted library allocation
page read and write
7FFD9B78B000
trusted library allocation
page read and write
22EF190A000
trusted library allocation
page read and write
22EE3A1D000
trusted library allocation
page read and write
22EF9BB0000
heap
page read and write
7FFD9B952000
trusted library allocation
page read and write
22EE18A3000
trusted library allocation
page read and write
22EE1360000
trusted library section
page read and write
7FFD9B780000
trusted library allocation
page read and write
22EF9AEE000
heap
page read and write
22EE13C0000
heap
page read and write
22EF18E1000
trusted library allocation
page read and write
22EF9D85000
heap
page read and write
22EF9CB0000
heap
page read and write
22EF9A7D000
heap
page read and write
22EE1340000
trusted library allocation
page read and write
7FFD9B9A0000
trusted library allocation
page read and write
22EE18D0000
heap
page read and write
22EF9DA2000
heap
page read and write
7FFD9BAF0000
trusted library allocation
page read and write
7FFD9BAC0000
trusted library allocation
page read and write
7FFD9BAE0000
trusted library allocation
page read and write
22EE18A0000
trusted library allocation
page read and write
22EFA101000
direct allocation
page execute and read and write
22EE1350000
trusted library section
page read and write
7FFD9BA50000
trusted library allocation
page read and write
22EE1380000
heap
page readonly
22EDF9A6000
heap
page read and write
7FFD9B820000
trusted library allocation
page read and write
22EE1390000
trusted library allocation
page read and write
7DF4B5080000
trusted library allocation
page execute and read and write
22EDF95E000
heap
page read and write
22EDF8D2000
heap
page read and write
22EF1A27000
trusted library allocation
page read and write
22EF9CCC000
heap
page read and write
22EE2508000
trusted library allocation
page read and write
7FFD9BA00000
trusted library allocation
page read and write
22EFA0FB000
direct allocation
page execute and read and write
A30C97D000
stack
page read and write
7FFD9B960000
trusted library allocation
page execute and read and write
22EDF8A0000
heap
page read and write
22EE3019000
trusted library allocation
page read and write
A30D7CF000
stack
page read and write
7FFD9B773000
trusted library allocation
page execute and read and write
A30CDFB000
stack
page read and write
22EF99F0000
heap
page read and write
A30C77D000
stack
page read and write
22EE18E1000
trusted library allocation
page read and write
22EF9A86000
heap
page read and write
22EE1820000
heap
page execute and read and write
7FFD9B930000
trusted library allocation
page execute and read and write
7FFD9B970000
trusted library allocation
page read and write
22EE1800000
heap
page execute and read and write
22EE2F53000
trusted library allocation
page read and write
22EDF947000
heap
page read and write
22EF9DBA000
heap
page read and write
22EF9DB6000
heap
page read and write
A30CD7E000
stack
page read and write
7FFD9B830000
trusted library allocation
page execute and read and write
22EF9A6F000
heap
page read and write
7FFD9B9F0000
trusted library allocation
page read and write
22EE1310000
heap
page read and write
7FFD9BAA0000
trusted library allocation
page read and write
7FFD9BA30000
trusted library allocation
page read and write
7FFD9B9B0000
trusted library allocation
page read and write
7FFD9B9E0000
trusted library allocation
page read and write
7FFD9B940000
trusted library allocation
page execute and read and write
22EE1710000
trusted library allocation
page read and write
7FFD9BA10000
trusted library allocation
page read and write
22EF9D96000
heap
page read and write
7FFD9B826000
trusted library allocation
page read and write
22EF9D4B000
heap
page read and write
22EFA0F8000
direct allocation
page execute and read and write
There are 137 hidden memdumps, click here to show them.