Javascript Attempts to Detect VMs via Registry | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: win8.1_64 | windows_script_file
Classification: Dropper, Downloader

f664d5e8a47084388e3d0efabc38b5f04a759e382211846f722be6f7365df7fc (SHA256)

pricaz _6_.js

JScript

Created at 2018-02-28 11:58:00

...

Notifications (1/1)

The operating system was rebooted during the analysis because the sample installed a startup script or application for persistence.

Indicators

File (222)
»
Filename Hash Operations
CONOUT$ - Access
C:\ - Access
C:\$Recycle.Bin\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\$Recycle.Bin\S-1-5-19\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\$Recycle.Bin\S-1-5-21-3643094112-4209292109-138530109-1001\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\BCD.LOG - Access
C:\Boot\bg-BG\bootmgr.exe.mui - Access
C:\Boot\bg-BG\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\BOOTSTAT.DAT MD5: 61837361532f862e30ffee38c44eda46
SHA1: c0092de53a8bed8dc8ee0cfaea61b1b6f3f2124a
SHA256: eadfa2893129bb8a4142c54e6c5be229fa24e7f4cb6e3396a368f420cc98630f 		Access, Read, Write
C:\Boot\BOOTSTAT.DAT.GDCB MD5: 61837361532f862e30ffee38c44eda46
SHA1: c0092de53a8bed8dc8ee0cfaea61b1b6f3f2124a
SHA256: eadfa2893129bb8a4142c54e6c5be229fa24e7f4cb6e3396a368f420cc98630f 		Access
C:\Boot\cs-CZ\bootmgr.exe.mui - Access
C:\Boot\cs-CZ\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\cs-CZ\memtest.exe.mui - Access
C:\Boot\da-DK\bootmgr.exe.mui - Access
C:\Boot\da-DK\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\da-DK\memtest.exe.mui - Access
C:\Boot\de-DE\bootmgr.exe.mui - Access
C:\Boot\de-DE\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\de-DE\memtest.exe.mui - Access
C:\Boot\el-GR\bootmgr.exe.mui - Access
C:\Boot\el-GR\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\el-GR\memtest.exe.mui - Access
C:\Boot\en-GB\bootmgr.exe.mui - Access
C:\Boot\en-GB\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\en-US\bootmgr.exe.mui - Access
C:\Boot\en-US\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\en-US\memtest.exe.mui - Access
C:\Boot\es-ES\bootmgr.exe.mui - Access
C:\Boot\es-ES\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\es-ES\memtest.exe.mui - Access
C:\Boot\et-EE\bootmgr.exe.mui - Access
C:\Boot\et-EE\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\fi-FI\bootmgr.exe.mui - Access
C:\Boot\fi-FI\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\fi-FI\memtest.exe.mui - Access
C:\Boot\Fonts\chs_boot.ttf - Access
C:\Boot\Fonts\cht_boot.ttf - Access
C:\Boot\Fonts\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\Fonts\jpn_boot.ttf - Access
C:\Boot\Fonts\kor_boot.ttf - Access
C:\Boot\Fonts\malgun_boot.ttf - Access
C:\Boot\Fonts\malgunn_boot.ttf - Access
C:\Boot\Fonts\meiryo_boot.ttf - Access
C:\Boot\Fonts\meiryon_boot.ttf - Access
C:\Boot\Fonts\msjh_boot.ttf - Access
C:\Boot\Fonts\msjhn_boot.ttf - Access
C:\Boot\Fonts\msyh_boot.ttf - Access
C:\Boot\Fonts\msyhn_boot.ttf - Access
C:\Boot\Fonts\segmono_boot.ttf - Access
C:\Boot\Fonts\segoe_slboot.ttf - Access
C:\Boot\Fonts\segoen_slboot.ttf - Access
C:\Boot\Fonts\wgl4_boot.ttf - Access
C:\Boot\fr-FR\bootmgr.exe.mui - Access
C:\Boot\fr-FR\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\fr-FR\memtest.exe.mui - Access
C:\Boot\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\hr-HR\bootmgr.exe.mui - Access
C:\Boot\hr-HR\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\hu-HU\bootmgr.exe.mui - Access
C:\Boot\hu-HU\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\hu-HU\memtest.exe.mui - Access
C:\Boot\it-IT\bootmgr.exe.mui - Access
C:\Boot\it-IT\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\it-IT\memtest.exe.mui - Access
C:\Boot\ja-JP\bootmgr.exe.mui - Access
C:\Boot\ja-JP\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\ja-JP\memtest.exe.mui - Access
C:\Boot\ko-KR\bootmgr.exe.mui - Access
C:\Boot\ko-KR\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\ko-KR\memtest.exe.mui - Access
C:\Boot\lt-LT\bootmgr.exe.mui - Access
C:\Boot\lt-LT\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\lv-LV\bootmgr.exe.mui - Access
C:\Boot\lv-LV\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\nb-NO\bootmgr.exe.mui - Access
C:\Boot\nb-NO\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\nb-NO\memtest.exe.mui - Access
C:\Boot\nl-NL\bootmgr.exe.mui - Access
C:\Boot\nl-NL\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\nl-NL\memtest.exe.mui - Access
C:\Boot\pl-PL\bootmgr.exe.mui - Access
C:\Boot\pl-PL\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\pl-PL\memtest.exe.mui - Access
C:\Boot\pt-BR\bootmgr.exe.mui - Access
C:\Boot\pt-BR\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\pt-BR\memtest.exe.mui - Access
C:\Boot\pt-PT\bootmgr.exe.mui - Access
C:\Boot\pt-PT\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\pt-PT\memtest.exe.mui - Access
C:\Boot\qps-ploc\bootmgr.exe.mui - Access
C:\Boot\qps-ploc\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\qps-ploc\memtest.exe.mui - Access
C:\Boot\Resources\en-US\bootres.dll.mui - Access
C:\Boot\Resources\en-US\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\Resources\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\ro-RO\bootmgr.exe.mui - Access
C:\Boot\ro-RO\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\ru-RU\bootmgr.exe.mui - Access
C:\Boot\ru-RU\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\ru-RU\memtest.exe.mui - Access
C:\Boot\sk-SK\bootmgr.exe.mui - Access
C:\Boot\sk-SK\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\sl-SI\bootmgr.exe.mui - Access
C:\Boot\sl-SI\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\sr-Latn-CS\bootmgr.exe.mui - Access
C:\Boot\sr-Latn-CS\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\sr-Latn-RS\bootmgr.exe.mui - Access
C:\Boot\sr-Latn-RS\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\sv-SE\bootmgr.exe.mui - Access
C:\Boot\sv-SE\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\sv-SE\memtest.exe.mui - Access
C:\Boot\tr-TR\bootmgr.exe.mui - Access
C:\Boot\tr-TR\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\tr-TR\memtest.exe.mui - Access
C:\Boot\uk-UA\bootmgr.exe.mui - Access
C:\Boot\uk-UA\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\zh-CN\bootmgr.exe.mui - Access
C:\Boot\zh-CN\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\zh-CN\memtest.exe.mui - Access
C:\Boot\zh-HK\bootmgr.exe.mui - Access
C:\Boot\zh-HK\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Boot\zh-HK\memtest.exe.mui - Access
C:\Boot\zh-TW\bootmgr.exe.mui - Access
C:\Boot\zh-TW\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\\GDCB-DECRYPT.txt MD5: e6cf22b643516b1cbc1454324c2aa5cb
SHA1: 22726d8300f1511353749f6fb1ac1daa05a3c915
SHA256: a4382db195164b328ba5d86c2fec6e5505cc7e769a564a466193382813c85f12 		Access, Write
C:\Program Files\WindowsPowerShell\Modules - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Commands.Management\Microsoft.PowerShell.Commands.Management.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Commands.Utility\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.xaml - Access
C:\Users\5JgHKoaOfdp - Access
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\ - Access
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_037cac7f-3205-4f41-87ab-36285b680510 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_188860f4-0679-4fd0-b484-187a5f17529b - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_27a6b737-e0ba-4068-91dd-df8565735034 - Access
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3186b7f4-e38a-40a6-af89-228fb596d0a1 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3d8ab723-44d5-4795-947e-d5b7229dfa98 MD5: a15e3bf31a9614ef17d3c33e54536e17
SHA1: 186d1c742c97a503765a44c8ba7236d6561e1228
SHA256: 2af233b36d2216fae1abf43ad7726d871355236517fdbf49367fdb599b168b85 		Access, Read, Write
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3e67daab-35d0-4e80-9b43-df246309b2d1 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_475e4689-74ef-43e7-90fe-d79deb0624b6 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_49e7e553-4311-4abe-b1f1-75195838f0f3 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_50d1a972-c2bc-4be3-857a-6ad57bf37250 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5713a0d6-d10b-4b74-9a40-4d532ad03618 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_59d5724e-f87a-4ca0-8538-a1aa0afd1b15 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_600154a2-5b63-48f9-943c-f8e123360163 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_64f9e75e-6fc7-41b7-be7a-7c9fe8ff921f - Access
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_66f2ad77-2ad3-4044-a136-48e7ec5af0c1 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_70ef2992-2518-42eb-ad6f-f6d2b834087e - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_720292a3-508e-47f8-8133-7dbca19a17fa - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_882fc4e8-005d-47a8-b798-e37046e181df - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a0f47a5b-3971-44a5-bd40-01241883a431 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a3dea8a0-8c87-4f9b-9a1c-300ad32616da - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b38f6763-c723-40d8-b8de-c06c46071305 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c8b9e900-0989-431a-88c5-32335c6c413f - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dbee20bc-62c7-4e43-88cf-26896b7d00e5 - Access, Read
C:\Users\5JgHKoaOfdp\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex MD5: e8e6e1b9670f015ff4e0a55a47615496
SHA1: 9f64bbffa5f580d8056edf6bcfebedcace913943
SHA256: 2ba0ac4628e063acc987add7b3107068c6bb8d8bcc2b722132880bd6ba2de898 		Access, Read, Write
C:\Users\5JgHKoaOfdp\AppData\RoamingeOX20.exe MD5: b045619c51603937bff8f832fb125339
SHA1: 2c8ddc87345e1c52173d9ed19161adbf60efe125
SHA256: 4e21cb59a18a4be27cf9879fdcc40411cd9ec5bc8b4340101d4eed2a3ff82c49 		Access, Write
C:\Users\5JgHKoaOfdp\Documents\WindowsPowerShell\Modules - Access
C:\Users\5JGHKO~1\Desktop\PRICAZ~1.JS - Access
C:\Windows - Access
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll - Access
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config - Access, Read
C:\Windows\system32 - Access
powershell.exe - Access
C:\Windows\System32\Wbem - Access
C:\Windows\System32\WindowsPowerShell\v1.0\ - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Certificate.format.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\DotNetTypes.format.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\FileSystem.format.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\Help.format.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\HelpV3.format.ps1xml - Access, Read
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\AppBackgroundTask\AppBackgroundTask.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\AppLocker\AppLocker.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\Appx\Appx.psd1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\AssignedAccess\AssignedAccess.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\AssignedAccess\AssignedAccess.psm1 - Access
c:\windows\system32\windowspowershell\v1.0\Modules\BitLocker\BitLocker.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psm1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer\BitsTransfer.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BranchCache\BranchCache.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\CimCmdlets\CimCmdlets.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender\Defender.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dism\Dism.Format.ps1xml - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dism\Dism.psd1 - Access, Read
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dism\Dism.psm1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dism\Dism.Types.ps1xml - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dism\en-US\Dism.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dism\en\Dism.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Dism\Microsoft.Dism.PowerShell.dll - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DnsClient\DnsClient.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\International\International.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\iSCSI\iSCSI.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psm1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Kds\Kds.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Commands.Management\Microsoft.PowerShell.Commands.Management.dll - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Commands.Utility\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Diagnostics\Microsoft.PowerShell.Diagnostics.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host\Microsoft.PowerShell.Host.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1 - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\en-US\Microsoft.PowerShell.Utility.psd1 - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\en\Microsoft.PowerShell.Utility.psd1 - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Commands.Utility.dll\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1 - Access, Read
C:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1 - Access, Read
c:\windows\system32\windowspowershell\v1.0\Modules\Microsoft.WSMan.Management\Microsoft.WSMan.Management.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetAdapter\NetAdapter.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetConnection\NetConnection.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\NetEventPacketCapture.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetLbfo\NetLbfo.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetNat\NetNat.psd1 - Access
C:\Windows\system32\WindowsPowerShell\v1.0\Modules\NetQos\NetQos.psd1 - Access
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config - Access
C:\Windows\System32\WindowsPowerShell\v1.0\types.ps1xml - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\typesv3.ps1xml - Access, Read
Registry (52)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\.JS Access, Read
HKEY_CLASSES_ROOT\JSFile\ScriptEngine Access, Read
HKEY_CURRENT_USER Access
HKEY_CURRENT_USER\Control Panel\International Access, Read
HKEY_CURRENT_USER\Environment Access, Read
HKEY_CURRENT_USER\Keyboard Layout\Preload Access, Read
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Access, Write
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\E. Australia Standard Time Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\E. Australia Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script\Features Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\1\PowerShellSnapIns Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings Access, Read
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient Access
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters Access, Read
Mutex (2)
»
Mutex Name Operations
Global\PowerShell_CommandAnalysis_Lock_S-1-5-21-3643094112-4209292109-138530109-1001 Access, Delete
Global\pc_group=WORKGROUP&ransom_id=37c4473eba2ee5af Access
URL (3)
»
URL Operations
telemetry7win.at/merry.rar?SOiJ GET
ipv4bot.whatismyipaddress.com/ GET
185.198.57.157/curl.php?token=1082 POST
IP (13)
»
IP Protocols
213.164.242.16 HTTP, DNS, TCP
85.105.167.110 HTTP, DNS, TCP
89.238.207.5 HTTP, DNS, TCP
109.239.19.225 HTTP, DNS, TCP
89.75.148.59 HTTP, DNS, TCP
94.190.179.160 HTTP, DNS, TCP
91.139.147.93 HTTP, DNS, TCP
90.177.80.171 HTTP, DNS, TCP
188.254.187.254 HTTP, DNS, TCP
109.121.206.4 HTTP, DNS, TCP
31.41.44.99 DNS, UDP
94.103.82.89 DNS, UDP
185.198.57.157 HTTP, TCP
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image