54303e5a...fd2e

VTI SCORE: 95/100

Dynamic Analysis Report

Classification: -

54303e5aa05db2becbef0978baa60775858899b17a5d372365ba3c5b1220fd2e (SHA256)

DOC2410201810718458.xls

Excel Document

Created at 2018-10-24 06:15:00

Notifications (1/1)

Due to a WHOIS service error, no query could be made to get WHOIS data of any contacted domain.

Indicators

File (13)

Filename	Hash	Operations
C:\	-	Access
C:\Users\aETAdzjz	-	Access
C:\Users\aETAdzjz\Desktop	-	Access
C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.dll	-	Access
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Config\machine.config	-	Access, Read
c:\wIndOws\SyStem32\CliP.ExE	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\Diagnostics.Format.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\GetEvent.types.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.config	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml	-	Access
C:\Windows\System32\WindowsPowerShell\v1.0\WSMan.format.ps1xml	-	Access, Read

Registry (93)

Registry Key Name	Operations
Application	Access
Application\PowerShell	Access
HKEY_CLASSES_ROOT\Licenses	Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7	Read
HKEY_CLASSES_ROOT\TypeLib	Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}	Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0	Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0	Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64	Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}	Access
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9	Access
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0	Access
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\0\win64	Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\409	Access
HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.9\9	Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}	Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8	Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0	Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64	Access, Read
HKEY_CURRENT_USER	Access
HKEY_CURRENT_USER\Environment	Access
HKEY_CURRENT_USER\Environment\PSMODULEPATH	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor	Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions	Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common	Access
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BackGroundCompile	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnAllErrors	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\BreakOnServerErrors	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\CompileOnDemand	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\NotifyUserBeforeStateLoss	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\RequireDeclaration	Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common\VbaCapability	Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\PipelineMaxStackSizeMB	Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\StackVersion	Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\CategoryOptions	Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Counter Names	Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\FileMappingSize	Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\First Counter	Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\IsMultiInstance	Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance\Library	Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Media Center\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine\ApplicationBase	Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellEngine\StackVersion	Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment	Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PSMODULEPATH	Read
HKEY_PERFORMANCE_DATA	Access
HardwareEvents	Access
HardwareEvents\PowerShell	Access
Internet Explorer	Access
Internet Explorer\PowerShell	Access
Key Management Service	Access
Key Management Service\PowerShell	Access
Media Center	Access
Media Center\PowerShell	Access
OAlerts	Access
OAlerts\ApplicationBase	Read
OAlerts\PowerShell	Access

Mutex (1)

Mutex Name	Operations
Global\.net clr networking	Access, Delete

Domain (2)

Domain	Sources
images2.imgbox.com	Function Log, PCAP
images2.imgbox.com.sds.rncdn7.com	Function Log, PCAP

IP (3)

IP	Protocols	Sources
66.254.122.102	TCP, UDP	Function Log, PCAP
66.254.122.104	TCP, UDP	Function Log, PCAP
66.254.122.100	TCP, UDP	Function Log, PCAP

Export IOCs

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Notifications (1/1)

Indicators

Before

After