Windows Analysis Report
000002.exe

Source: 000002.exe	Binary or memory string: c:\autorun.inf
Source: 000002.exe	Binary or memory string: [autorun] Shellexecute=explore.exe
Source: 000002.exe	Binary or memory string: %sautorun.inf
Source: 000002.exe, 00000000.00000002.351583858.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: 000002.exe, 00000000.00000002.351583858.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: %sautorun.inf
Source: 000002.exe, 00000000.00000002.351583858.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: svchost.exeuniplat.dllADVAPI32.dllkernel32.dllGetModuleHandleAGetProcAddressgg.exegadu-gadu.exetlen.exegadu.exeakuku.exeskype.exeaqq.exeicq.exeICQLite.exepowergg.exe%c%c\Program Files\Internet Explorer\iexplore.exe \%c%c\Program Files\Internet Explorer\IEXPLORE.EXE \SeDebugPrivilege%s\system\win32out.dll%s\system\win32in.dll%s\system\geturladres.txt%s\system\geturlplik.txt%s\system\inicadres.dll%s\system\inidccport.dllrw[autorun]
Source: 000002.exe, 00000000.00000002.351583858.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Shellexecute=explore.exeShellexecute=explore.exe%c:\%sautorun.inf%sexplore.exer+bw+b
Source: 000002.exe, 00000000.00000002.351583858.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: c:\autorun.inf
Source: 000002.exe, 00000000.00000002.351583858.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: tc:\autorun.infc:\explore.exeC:\WindowsC:\Users\user\Desktop\000002.exe
Source: svchost.exe	Binary or memory string: )tc:\autorun.inf
Source: svchost.exe	Binary or memory string: [autorun] Shellexecute=explore.exe
Source: svchost.exe	Binary or memory string: %sautorun.inf
Source: svchost.exe, 00000002.00000002.611920729.0000000000401000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: [autorun]
Source: svchost.exe, 00000002.00000002.611920729.0000000000401000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: %sautorun.inf
Source: svchost.exe, 00000002.00000002.611920729.0000000000401000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: svchost.exeuniplat.dllADVAPI32.dllkernel32.dllGetModuleHandleAGetProcAddressgg.exegadu-gadu.exetlen.exegadu.exeakuku.exeskype.exeaqq.exeicq.exeICQLite.exepowergg.exe%c%c\Program Files\Internet Explorer\iexplore.exe \%c%c\Program Files\Internet Explorer\IEXPLORE.EXE \SeDebugPrivilege%s\system\win32out.dll%s\system\win32in.dll%s\system\geturladres.txt%s\system\geturlplik.txt%s\system\inicadres.dll%s\system\inidccport.dllrw[autorun]
Source: svchost.exe, 00000002.00000002.611920729.0000000000401000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Shellexecute=explore.exeShellexecute=explore.exe%c:\%sautorun.inf%sexplore.exer+bw+b
Source: svchost.exe, 00000002.00000002.611920729.0000000000401000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: tc:\autorun.inf
Source: svchost.exe, 00000002.00000002.611920729.0000000000401000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: tc:\autorun.infc:\explore.exeC:\WindowsC:\Windows\system\svchost.exe
Source: 000002.exe	Binary or memory string: AutoRun.inf
Source: 000002.exe	Binary or memory string: [autorun]
Source: winlogon.dll.0.dr	Binary or memory string: AutoRun.inf
Source: winlogon.dll.0.dr	Binary or memory string: [autorun]
Source: explore.exe.0.dr	Binary or memory string: AutoRun.inf
Source: explore.exe.0.dr	Binary or memory string: [autorun]
Source: svchost.exe.0.dr	Binary or memory string: AutoRun.inf
Source: svchost.exe.0.dr	Binary or memory string: [autorun]
Source: autorun.inf.0.dr	Binary or memory string: [autorun]

Source: C:\Windows\system\svchost.exe	File opened: z:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: x:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: v:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: t:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: r:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: p:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: n:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: l:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: j:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: h:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: f:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: b:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: y:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: w:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: u:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: s:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: q:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: o:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: m:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: k:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: i:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: g:	Jump to behavior
Source: C:\Windows\system\svchost.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: c:

Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32\config\systemprofile\AppData	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32\config	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32\config\systemprofile\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32\config\systemprofile	Jump to behavior

Source: rundll32.exe, 0000000B.00000003.600834144.0000000002D60000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: http://www.macromedia.com

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low

Source: C:\Windows\System32\rundll32.exe

Windows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dll

Clears Internet Explorer cache and cookies (likely to cover tracks)

Source: C:\Windows\system\wupdmgr.exe

Code function: 3_2_004012A4 time,GetForegroundWindow,fopen,ctime,sprintf,fputs,fclose,Sleep,GetAsyncKeyState,fopen,GetForegroundWindow,GetWindowTextA,strcmp,sprintf,fputs,GetWindowTextA,fputc,fclose,fputc,fclose,fclose,

3_2_004012A4

System Summary

Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:264 WinX:0 WinY:0 IEFrame:0000000000000000
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:65800 WinX:0 WinY:0 IEFrame:0000000000000000
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:65800 WinX:0 WinY:0 IEFrame:0000000000000000
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:264 WinX:0 WinY:0 IEFrame:0000000000000000	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:65800 WinX:0 WinY:0 IEFrame:0000000000000000	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:65800 WinX:0 WinY:0 IEFrame:0000000000000000	Jump to behavior

Source: 000002.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Program Files\Internet Explorer\iexplore.exe

File deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6E6BDFD5-6CCE-11EE-8F38-ECF4BBB5915B}.dat

Source: C:\Users\user\Desktop\000002.exe

File created: C:\Windows\SysWOW64\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}

Source: C:\Windows\system\wupdmgr.exe

Code function: String function: 00402120 appears 31 times

Source: 000002.exe	Binary or memory string: OriginalFilename vs 000002.exe
Source: 000002.exe, 00000000.00000002.351583858.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewupdmgr.exel& vs 000002.exe
Source: 000002.exe, 00000000.00000000.344208370.00000000018A9000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesvchost.exej% vs 000002.exe
Source: 000002.exe, 00000000.00000002.351787858.00000000018C0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesvchost.exej% vs 000002.exe
Source: 000002.exe	Binary or memory string: OriginalFilenamesvchost.exej% vs 000002.exe
Source: 000002.exe	Binary or memory string: OriginalFilenameEXPLORER.EXE vs 000002.exe

Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Users\user\Desktop\000002.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\000002.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Windows\system\svchost.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\system\svchost.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior
Source: C:\Windows\system\wupdmgr.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\system\wupdmgr.exe	Memory allocated: 771D0000 page execute and read and write	Jump to behavior

Source: 000002.exe

Virustotal: Detection: 68%

Source: C:\Users\user\Desktop\000002.exe

File read: C:\Users\user\Desktop\000002.exe

Source: C:\Users\user\Desktop\000002.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\000002.exe C:\Users\user\Desktop\000002.exe
Source: unknown	Process created: C:\Windows\system\svchost.exe C:\Windows\system\svchost.exe
Source: C:\Windows\system\svchost.exe	Process created: C:\Windows\system\wupdmgr.exe C:\Windows\system\wupdmgr.exe
Source: C:\Windows\system\svchost.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\IEXPLORE.EXE" \
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\ie4uinit.exe "C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:264 WinX:0 WinY:0 IEFrame:0000000000000000
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:65800 WinX:0 WinY:0 IEFrame:0000000000000000
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:65800 WinX:0 WinY:0 IEFrame:0000000000000000
Source: C:\Windows\system\svchost.exe	Process created: C:\Windows\system\wupdmgr.exe C:\Windows\system\wupdmgr.exe	Jump to behavior
Source: C:\Windows\system\svchost.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\IEXPLORE.EXE" \	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\ie4uinit.exe "C:\Windows\System32\ie4uinit.exe" -ShowQLIcon	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:264 WinX:0 WinY:0 IEFrame:0000000000000000	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:65800 WinX:0 WinY:0 IEFrame:0000000000000000	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:65800 WinX:0 WinY:0 IEFrame:0000000000000000	Jump to behavior

Source: C:\Windows\System32\ie4uinit.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\InProcServer32

Source: Launch Internet Explorer Browser.lnk.6.dr

LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Internet Explorer\iexplore.exe

Source: C:\Program Files\Internet Explorer\iexplore.exe

File created: C:\Windows\TEMP\Low

Source: classification engine

Classification label: mal100.spre.evad.winEXE@16/19@0/0

Source: C:\Program Files\Internet Explorer\iexplore.exe

File read: C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

Source: C:\Program Files\Internet Explorer\iexplore.exe

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:264 WinX:0 WinY:0 IEFrame:0000000000000000

Source: 000002.exe, winlogon.dll.0.dr, explore.exe.0.dr, svchost.exe.0.dr

Binary or memory string: z1\EXPLORER.vbp

Source: C:\Program Files\Internet Explorer\iexplore.exe

File written: C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

Detected unpacking (changes PE section rights)

Source: 000002.exe

Static file information: File size 21759708 > 1048576

Data Obfuscation

Source: C:\Windows\system\wupdmgr.exe

Unpacked PE file: 3.2.wupdmgr.exe.400000.0.unpack code:EW;text:EW;.rsrc:W; vs code:ER;text:ER;.rsrc:W;

Source: C:\Windows\system\wupdmgr.exe	Code function: 3_2_0040C953 pushad ; ret		3_2_0040C8F3
Source: C:\Windows\system\wupdmgr.exe	Code function: 3_2_0040C8C6 pushad ; ret		3_2_0040C8F3

Source: wupdmgr.exe.0.dr

Static PE information: section name: text

Source: C:\Users\user\Desktop\000002.exe

Code function: 0_2_018BF770 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_018BF770

Source: initial sample

Static PE information: section where entry point is pointing to: text

Source: initial sample

Static PE information: section name: text entropy: 7.396129849490653

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\Favorites	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\Favorites\desktop.ini	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Adobe	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Adobe\Flash Player	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Adobe\Flash Player\NativeCache	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tracking Protection	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\PlayReady	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6E6BDFD5-6CCE-11EE-8F38-ECF4BBB5915B}.dat	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033	Jump to behavior
Source: C:\Program Files\Internet Explorer\iexplore.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File created: C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low\History.IE5	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Adobe\Flash Player\NativeCache\NativeCache.directory	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Adobe\Flash Player\AssetCache
Source: C:\Windows\System32\rundll32.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Roaming\Adobe\Flash Player\AssetCache\YY5BP89L

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown	Executable created and started: C:\Windows\system\svchost.exe
Source: C:\Windows\system\svchost.exe	Executable created and started: C:\Windows\system\wupdmgr.exe			Jump to behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\000002.exe

File created: C:\Windows\system\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\000002.exe	File created: C:\Windows\system\svchost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\000002.exe	File created: C:\Windows\system\wupdmgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\000002.exe	File created: C:\Windows\SysWOW64\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}\winlogon.dll	Jump to dropped file
Source: C:\Users\user\Desktop\000002.exe	File created: C:\explore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\000002.exe	File created: C:\Windows\SysWOW64\explorxp.exe	Jump to dropped file

Source: C:\Users\user\Desktop\000002.exe	File created: C:\Windows\system\svchost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\000002.exe	File created: C:\Windows\system\wupdmgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\000002.exe	File created: C:\Windows\SysWOW64\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}\winlogon.dll	Jump to dropped file
Source: C:\Users\user\Desktop\000002.exe	File created: C:\Windows\SysWOW64\explorxp.exe	Jump to dropped file

Source: C:\Users\user\Desktop\000002.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CreateProcess

Source: C:\Windows\system\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\system\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\system\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\system\svchost.exe TID: 2592	Thread sleep count: 743 > 30	Jump to behavior
Source: C:\Windows\system\svchost.exe TID: 2592	Thread sleep time: -74300s >= -30000s	Jump to behavior
Source: C:\Windows\system\svchost.exe TID: 2592	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\system\wupdmgr.exe TID: 2468	Thread sleep count: 7777 > 30	Jump to behavior
Source: C:\Windows\system\wupdmgr.exe TID: 2468	Thread sleep time: -77770s >= -30000s	Jump to behavior

Source: C:\Windows\system\wupdmgr.exe

Thread sleep count: Count: 7777 delay: -10

Source: C:\Windows\system\svchost.exe	Last function: Thread delayed
Source: C:\Windows\system\svchost.exe	Last function: Thread delayed
Source: C:\Windows\system\wupdmgr.exe	Last function: Thread delayed
Source: C:\Windows\system\wupdmgr.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\000002.exe

Dropped PE file which has not been started: C:\Windows\SysWOW64\explorxp.exe

Jump to dropped file

Source: C:\Windows\system\svchost.exe	Window / User API: threadDelayed 743			Jump to behavior
Source: C:\Windows\system\wupdmgr.exe	Window / User API: threadDelayed 7777			Jump to behavior

Source: C:\Windows\system\wupdmgr.exe

API coverage: 6.0 %

Source: C:\Windows\system\wupdmgr.exe

Code function: time,GetForegroundWindow,fopen,ctime,sprintf,fputs,fclose,Sleep,GetAsyncKeyState,fopen,GetForegroundWindow,GetWindowTextA,strcmp,sprintf,fputs,GetWindowTextA,fputc,fclose,fputc,fclose,fclose,

3_2_004012A4

Source: C:\Windows\system\svchost.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\000002.exe	API call chain: ExitProcess graph end node	graph_0-53
Source: C:\Windows\system\svchost.exe	API call chain: ExitProcess graph end node	graph_2-53
Source: C:\Windows\system\wupdmgr.exe	API call chain: ExitProcess graph end node	graph_3-950
Source: C:\Windows\system\wupdmgr.exe	API call chain: ExitProcess graph end node	graph_3-971

Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32\config\systemprofile\AppData	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32\config	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32\config\systemprofile\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	File opened: C:\Windows\System32\config\systemprofile	Jump to behavior

Source: C:\Users\user\Desktop\000002.exe

Code function: 0_2_018BF770 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_018BF770

Source: C:\Windows\system\svchost.exe

Process token adjusted: Debug

Writes to foreign memory regions

Source: C:\Windows\system\wupdmgr.exe

Code function: 3_2_00401100 SetUnhandledExceptionFilter,__getmainargs,74EB2900,74EB2900,_setmode,74EB2900,74EB2900,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,74EB2900,_setmode,74EB2900,

3_2_00401100

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\system\svchost.exe	Memory written: C:\Program Files\Internet Explorer\iexplore.exe base: 20C0000	Jump to behavior
Source: C:\Windows\system\svchost.exe	Memory written: C:\Program Files\Internet Explorer\iexplore.exe base: 20D0000	Jump to behavior
Source: C:\Windows\system\svchost.exe	Memory written: C:\Program Files\Internet Explorer\iexplore.exe base: 20E0000	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\system\svchost.exe	Memory allocated: C:\Program Files\Internet Explorer\iexplore.exe base: 20C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\system\svchost.exe	Memory allocated: C:\Program Files\Internet Explorer\iexplore.exe base: 20D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\system\svchost.exe	Memory allocated: C:\Program Files\Internet Explorer\iexplore.exe base: 20E0000 protect: page read and write	Jump to behavior

Source: C:\Windows\system\svchost.exe	Process created: C:\Windows\system\wupdmgr.exe C:\Windows\system\wupdmgr.exe			Jump to behavior
Source: C:\Windows\system\svchost.exe	Process created: C:\Program Files\Internet Explorer\iexplore.exe "C:\Program Files\Internet Explorer\IEXPLORE.EXE" \			Jump to behavior

Source: C:\Windows\System32\ie4uinit.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\ie4uinit.exe	Queries volume information: C:\Program Files\Internet Explorer\iexplore.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\System32\Macromed\Flash\activex.vch VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\System32\Macromed\Flash\activex.vch VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\System32\Macromed\Flash\activex.vch VolumeInformation

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
12 Replication Through Removable Media	1 Native API	1 Windows Service	1 Windows Service	32 Masquerading	21 Input Capture	11 Security Software Discovery	12 Replication Through Removable Media	1 Email Collection	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	211 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	21 Input Capture	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	211 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	31 Obfuscated Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Rundll32	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Software Packing	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
000002.exe	68%	Virustotal		Browse
000002.exe	100%	Avira	W32/VB.BU
000002.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\SysWOW64\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}\winlogon.dll	100%	Avira	W32/VB.BU
C:\Windows\system\wupdmgr.exe	100%	Avira	TR/Crypt.FKM.Gen
C:\explore.exe	100%	Avira	W32/VB.BU
C:\Windows\system\svchost.exe	100%	Avira	W32/VB.BU
C:\Windows\SysWOW64\explorxp.exe	100%	Avira	TR/Agent.afvz
C:\Windows\SysWOW64\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}\winlogon.dll	100%	Joe Sandbox ML
C:\Windows\system\wupdmgr.exe	100%	Joe Sandbox ML
C:\explore.exe	100%	Joe Sandbox ML
C:\Windows\system\svchost.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}\winlogon.dll	68%	Virustotal		Browse
C:\Windows\SysWOW64\explorxp.exe	57%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\SysWOW64\explorxp.exe	47%	Virustotal		Browse
C:\Windows\system\svchost.exe	68%	Virustotal		Browse
C:\Windows\system\wupdmgr.exe	88%	ReversingLabs	Win32.Backdoor.GrayBird
C:\Windows\system\wupdmgr.exe	74%	Virustotal		Browse
C:\explore.exe	68%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.macromedia.com	rundll32.exe, 0000000B.00000003.600834144.0000000002D60000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1327116
Start date and time:	2023-10-17 11:17:54 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	000002.exe
Detection:	MAL
Classification:	mal100.spre.evad.winEXE@16/19@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): UI0Detect.exe, dllhost.exe, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 209.197.3.8, 72.21.81.240, 23.35.30.151
Excluded domains from analysis (whitelisted): e11290.dspg.akamaiedge.net, go.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, go.microsoft.com.edgekey.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, wu-bg-shim.trafficmanager.net, wu.azureedge.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:18:44	API Interceptor	1x Sleep call for process: 000002.exe modified
11:18:45	API Interceptor	716x Sleep call for process: svchost.exe modified
11:19:32	API Interceptor	4776x Sleep call for process: wupdmgr.exe modified
11:20:38	API Interceptor	2x Sleep call for process: ie4uinit.exe modified
11:20:41	API Interceptor	34x Sleep call for process: rundll32.exe modified

Process:	C:\Users\user\Desktop\000002.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	21759708
Entropy (8bit):	1.9436428734025761
Encrypted:	false
SSDEEP:	196608:xkjkKk68hA6dv/z/LsI1gsI1esI1FqsI1xMsI1tsI1qsI15sI1gsI1:xSzIhA6dv/z/
MD5:	A205A6202F91DAAB00D4CFB555CBCD0E
SHA1:	9C5EEF29AE538B14E805BFC234290EE0062BA76B
SHA-256:	39E66194E9D181D8CDA1ECD48F18B95D644DD89000251268EAF118F432C47F60
SHA-512:	250D5FA9FF0F6A6AEAE53442A69B192C06E3DE70EA8B06D5703F6864CC9D832BEC6CA7906FAC314C485421F50B2E9886C9DA4E0CB391D01B73FE062B55285702
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 68%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$./G.>.............8.p........J.p.K...J...L...@...........................L............... ...............................L.......L.............................................................................................................UPX0......J.............................UPX1.....p....J..j..................@....rsrc...X.....L.X....l.............. ...3.01.UPX!....UT6f..;Y..K.Wg..X...&.......U.....]..U.1.u...1...=....wC=...w.r[.....$.1..D$........,...tl..t*.......7w..FQ..]..I.t.f{a.=.....v..3 ..u.A.\..t4.`.Y..\.g.....}.\(..t...\\|..;{./.$.L).n`..O.....S..v..$.7..@.)....Rw....E.E...@C.U.s....k..@,...T.[.8......b\......X.P%............E...t =m......K0..$:L,$.f.m<..%\...o.QP...<.]...k...(.......E..........6....#.g.......o.B.#.a..$.g...'...7....N...!B&.w,.....&........%]..t2U. .....]r...,.Ox..?...{.s.e_.y..........=..u.E... ..E..8

C:\Windows\SysWOW64\Panel sterowania.{21EC2020-3AEA-1069-A2DD-08002B30309D}\winlogon.dll:Zone.Identifier

Process:	C:\Users\user\Desktop\000002.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\explorxp.exe

Process:	C:\Users\user\Desktop\000002.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137729
Entropy (8bit):	6.3620679511258
Encrypted:	false
SSDEEP:	3072:xvsZpk7sToiFgQNNjDBX05Wti5yWHFA9m068Q5:x6kIoiFXNRX05qi8yFA9368m
MD5:	AB7C80B08FB806F943B8E22A7363FD4B
SHA1:	B954EA878F9B9BD9052ADE4FC14D9AE61670FAEB
SHA-256:	EC64740391869236C167227874EB9CB1C9C0DE08F253A92B9C9F46D15F48437F
SHA-512:	4974A7D5871D482A372E5D8B716F4CB8DCB4E5641E83342531B4CC3B061FCF9F5C19691073600E05EEB86482E38FB2A203369F8DEB8FFE3FC63DA95BFE2FC172
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 57% Antivirus: Virustotal, Detection: 47%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........j..r..r..r...n..r...n..r...P..r...P..r...P..r..wm..r..eQ..r..r...r...P..r..Rich.r..........................PE..L...GF.=.....................N....../.............@..............._..........@.......................................................................................................................................................................text............................... ..`.rdata..f).......*..................@..@.data...."..........................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\settings.dll

Process:	C:\Users\user\Desktop\000002.exe
File Type:	Generic INItialization configuration [Logging]
Category:	modified
Size (bytes):	1409
Entropy (8bit):	5.166661958914264
Encrypted:	false
SSDEEP:	24:1Gx+gxDRskU1yoXDZbLLHqZZ7sMro7FUIJQXY/5C6FRGPrK:1ZgvUxVPaCpZ
MD5:	0002F4B62BD98411F889A8C4653B9B9A
SHA1:	CFF91171F8E30B8015AC871E2E79C6BCCF1058A2
SHA-256:	77A1AC5C5DA6217ACC7A50D723C5A050C3106EE3403503EA532475B56E4F16C6
SHA-512:	F224B0F8114566E0ABE2D26254592AAE602565402296BDDE4C8992475BB277A693B7F6C9B5FD46320DFA3F05D206E687F8EAF6E442CA2517B089CD172CF64A74
Malicious:	false
Reputation:	low
Preview:	[General]..FileVersion=2..[Logging]..Log=0..LogFileRules=14336..[NetworkSystem]..ServerPort=21..MaxUsers=10..LaunchBoot=1..PreviousStatus=25..[USER=root]..GroupName= ""..Activated=1..LoginType=2..Password= "dupa"..Login= "root"..Name= "root"..DefaultDirectory= ""..FSysModification_Path1= "/"..FSysModification_RealPath1= ""..FSysModification_AccessRight1=9642999..FSysModification_Path2= "/C:"..FSysModification_RealPath2= "C:"..FSysModification_AccessRight2=1062400..FSysModification_Path3= "/D:"..FSysModification_RealPath3= "D:"..FSysModification_AccessRight3=1062400..FSysModification_Path4= "/E:"..FSysModification_RealPath4= "E:"..FSysModification_AccessRight4=1062400..FSysModification_Path5= "/F:"..FSysModification_RealPath5= "F:"..FSysModification_AccessRight5=1062400..FSysModification_Path6= "/A:"..FSysModification_RealPath6= "A:"..FSysModification_AccessRight6=1062400..FSysModification_Path7= "/G:"..FSysModification_RealPath7= "G:"..FSysModification_AccessRight7=1062400..FSysModific

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6E6BDFD5-6CCE-11EE-8F38-ECF4BBB5915B}.dat

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	1.734216510667583
Encrypted:	false
SSDEEP:	12:rl0YmGF11DrEgmf+IaCyo6F8ADrEgmf+IaCyoqgNNlTqZvZhZ1zdTZtQJl/:r9Gv/QGv//NNlWZ1gj
MD5:	B8AD6EBE65917008CC114784534FB4C5
SHA1:	FBCD4CCA81E618236B6EDE5DBB01302563E23AB1
SHA-256:	271E26C60C9BBD1183F9405691A29886E63C50EF6178B7C0639D8B45006C51E9
SHA-512:	F8E92A6BBE8B95732DECBF8A8172ABDD002CE6CE29484F686DC6A04A7FCDD45716EA9AEEDDB84E5B8FD16C15A3587AE769C6F38E02D975BA748B2527E0A3F928
Malicious:	false
Preview:	......................>.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.........................................................................................`..1..................K.j.j.a.q.f.a.j.N.2.c.0.u.z.g.v.1.l.4.q.y.5.n.f.W.e...........8...............................................................F.r.a.m.e.L.i.s.t.......................................................................................................0...............................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	298032
Entropy (8bit):	5.297553497908716
Encrypted:	false
SSDEEP:	3072:wJSeGFgPDjVbaYAxsCNev1ZlVYYqyqv+1fDFmyoi:wSeGFgPDIY4sCNev1ZlVVqjqFmy9
MD5:	4E016F45211AF98239AD32BBAF75E5D9
SHA1:	FC2DCBF22936C9848731FD45D2EC04F04BAFDA20
SHA-256:	9880A4BD68834D20A08FA538033AA89393418C70CD2C640196786B78420C8551
SHA-512:	8481AB3FDEFA040D8AABC9C7F45B349065F28D92DB38A5CF22D75A04C740B3001B5C6A9B38671C59BCFEA76E109668067B6CC72245DC1B9520F079B43D5DA7F3
Malicious:	false
Preview:	...P........,...j...&...........6.......>...i...........,...System.StructuredQueryType.Action.System.StructuredQueryType.AllBitsSet.System.StructuredQueryType.AnyBitsSet.System.StructuredQueryType.Blurb.System.StructuredQueryType.Boolean.=TRUE.=FALSE.System.StructuredQueryType.ByteUnit.=1.=1024.=1048576.=1073741824.=1099511627776.=1125899906842624.=1152921504606846976.=1000.=1000000.=1000000000.=1000000000000.=1000000000000000.=1000000000000000000.System.StructuredQueryType.DateTime.N00UUUUUUUK7ZZNNU.N00UUUUUUUK1ZZNNU.N00UUUUUUUK2ZZNNU.N00UUUUUUUK3ZZNNU.N00UUUUUUUK4ZZNNU.N00UUUUUUUK5ZZNNU.N00UUUUUUUK6ZZNNU.N00UK1UUUUUUZZNNU.N00UK2UUUUUUZZNNU.N00UK3UUUUUUZZNNU.N00UK4UUUUUUZZNNU.N00UK5UUUUUUZZNNU.N00UK6UUUUUUZZNNU.N00UK7UUUUUUZZNNU.N00UK8UUUUUUZZNNU.N00UK9UUUUUUZZNNU.N00UK10UUUUUUZZNNU.N00UK11UUUUUUZZNNU.N00UK12UUUUUUZZNNU.R00UUUUUUUUZDNNU.R00UUUUUUUUD-1DNNU.R00UUUUUUUUD1DNNU.R00UUUUUUUUZZXD-1NU.R00UUUUUUUUZZXD1NU.R00UUUUUUUUZWNNU.R00UUUUUUUUW-1WNNU.R00UUUUUUUUW1WNNU.R00UUUUUUUUZZXW-1NU.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

Process:	C:\Windows\System32\ie4uinit.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Archive, ctime=Thu Mar 23 14:50:06 2017, mtime=Thu Mar 23 14:50:06 2017, atime=Thu Mar 23 14:50:06 2017, length=814288, window=hide
Category:	dropped
Size (bytes):	1347
Entropy (8bit):	4.45937951709948
Encrypted:	false
SSDEEP:	24:8G44YeldfxonEMtvHCbd/ANkcSgdCEMBCaBJP7YHtIX8EEZzevnyaxy:8kdmnvZYdIAgdCvBCsAIX/jvjxy
MD5:	444FFE43CBC21C4263BB70D6986C49FC
SHA1:	B27962C1E36322036C3AD80BA49F5D08E69F951F
SHA-256:	1A84081496CCCEEC9F01A9DA4145C567DDA7AAE4A2C2E3CB4104264CFB58192C
SHA-512:	23420BE77E3CCD5F614754945E524BCFB81AEFDF86BFDB275906CBDE1E34F5D07F06DB116EF88CC822141D280302E1290D0F7C87D92BCC52DE4A19C2629AEC50
Malicious:	false
Preview:	L..................F.... ....b.$....b.$....b.$....l...........................P.O. .:i.....+00.../C:\.....................1......W.v..PROGRA~1..p.......:...W.v...<...............F.....P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....h.1.....wJ.~..INTERN~1..P.......:..wJ.~.........................I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.....b.2..l..wJD~ .iexplore.exe..F......wJD~wJD~*....H....................i.e.x.p.l.o.r.e...e.x.e.......^...............-.......]............7.e.....C:\Program Files\Internet Explorer\iexplore.exe..&.@.".%.w.i.n.d.i.r.%.\.S.y.s.t.e.m.3.2.\.i.e.4.u.i.n.i.t...e.x.e.".,.-.7.3.2.G.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.I.n.t.e.r.n.e.t. .E.x.p.l.o.r.e.r.\.i.e.x.p.l.o.r.e...e.x.e...%.H.O.M.E.D.R.I.V.E.%.%.H.O.M.E.P.A.T.H.%.........&................c^...NI..e.2.......\|...........1SPSU(L.y.9K....-....................Y............#...M.i.c.r.o.s.o.f.t...I.n.t.e.r.n.e.t.E.x.p.l.o.r.e.r...D.e.f.a.u.l.t

C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

Process:	C:\Windows\System32\ie4uinit.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	97
Entropy (8bit):	5.027755937250173
Encrypted:	false
SSDEEP:	3:dCoVMEhAgeWlYAs1NLOIASw5vtZ4RPAn:qcnlYb1ZV3uv46n
MD5:	45746B5317D380078FEBE04385B81405
SHA1:	E6B9A47DEAB744C12125936C5E5ABB3E07B87FE8
SHA-256:	A42B05C8BA93F4F590F5F367118F4850DFF4F3EC3A4A5E1AECCE87A9AE4D5511
SHA-512:	CAF91351C5590922A9A3FAA41F5EBC82B450208A486A7A1CEE32C140C2290F8890BCDD216371CFE5135E5CC0CFECA323B1D3A09973CD415239B1F7959AF28098
Malicious:	true
Preview:	[LocalizedFileNames]..Launch Internet Explorer Browser.lnk=@%windir%\System32\ie4uinit.exe,-733..

C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	3.5061348430835744
Encrypted:	false
SSDEEP:	12:QZsiL5wmHOlDmo0qmTgclLwr2FlDmo0IWFkpklrgl2FlDmo0qjKAGlc9:QCGwv4o0plLwiF4o0hUsF4o01Ayc9
MD5:	881DFAC93652EDB0A8228029BA92D0F5
SHA1:	5B317253A63FECB167BF07BEFA05C5ED09C4CCEA
SHA-256:	A45E345556901CD98B9BF8700B2A263F1DA2B2E53DBDF69B9E6CFAB6E0BD3464
SHA-512:	592B24DEB837D6B82C692DA781B8A69D9FA20BBAA3041D6C651839E72F45AC075A86CB967EA2DF08FA0635AE28D6064A900F5D15180B9037BB8BA02F9E8E1810
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.9.6.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.1.5.....I.c.o.n.F.i.l.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.....I.c.o.n.I.n.d.e.x.=.-.1.7.3.....

C:\Windows\Temp\~DF113CA722E08891AD.TMP

Process:	C:\Program Files\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.09235269762233589
Encrypted:	false
SSDEEP:	3:FrJAqL4on/lgV//lluUfilclllv/nt+lybltll1lRslkhlEkllpqL0qL4ovjrF08:FrJTZtQ/+UuUFAlkx2vZvjrFvZ1iWCh
MD5:	4DC24114FADA8ADAB5130B0E2DD4B286
SHA1:	A7F5D9DF8E91B72BB458D09305C1E4430A45E37C
SHA-256:	CEB46E0FF07EE85C47ACEE322C09049F1EF6EE87CBAA4D4145F0613957136B8C
SHA-512:	4E87832D3ADF89282E7361E7085A79124408C36A66829A335DBB922D007B5AE745F984CB67033F557F185AF88CA6A2AB0967EB58F6B173E60568A0A9A6CB8FB7
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\system\mmtaskclean.log

Process:	C:\Windows\system\wupdmgr.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	54
Entropy (8bit):	4.4650451974523
Encrypted:	false
SSDEEP:	3:vowSs+23FFHToSUdPX0Wl4fn:Qfs+Qb4dPkWl4f
MD5:	A76212E31E415F8EC1D7FCFE46B8B4D6
SHA1:	F4F9789302D14EA16F9E2EB8AB9EF3A4CBE67D5F
SHA-256:	F9AD66CF1B083606EC8D579ED86A73EA1AC39E240CF233AE7478B0D75E764914
SHA-512:	22743B88F57D3C0E7B34D2727730C08EF8D2080DE4079DB9E7F702F89E4BF37F2DEEEA67BD04BB81752ECEF588F3C81087CF051F5E8FCCAB2AAB35B95BEAF71C
Malicious:	false
Preview:	.....@.....@....... Tue Oct 17 11:18:46 2023.. .....

C:\Windows\system\svchost.exe

Process:	C:\Users\user\Desktop\000002.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	21759708
Entropy (8bit):	1.9436428734025761
Encrypted:	false
SSDEEP:	196608:xkjkKk68hA6dv/z/LsI1gsI1esI1FqsI1xMsI1tsI1qsI15sI1gsI1:xSzIhA6dv/z/
MD5:	A205A6202F91DAAB00D4CFB555CBCD0E
SHA1:	9C5EEF29AE538B14E805BFC234290EE0062BA76B
SHA-256:	39E66194E9D181D8CDA1ECD48F18B95D644DD89000251268EAF118F432C47F60
SHA-512:	250D5FA9FF0F6A6AEAE53442A69B192C06E3DE70EA8B06D5703F6864CC9D832BEC6CA7906FAC314C485421F50B2E9886C9DA4E0CB391D01B73FE062B55285702
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$./G.>.............8.p........J.p.K...J...L...@...........................L............... ...............................L.......L.............................................................................................................UPX0......J.............................UPX1.....p....J..j..................@....rsrc...X.....L.X....l.............. ...3.01.UPX!....UT6f..;Y..K.Wg..X...&.......U.....]..U.1.u...1...=....wC=...w.r[.....$.1..D$........,...tl..t*.......7w..FQ..]..I.t.f{a.=.....v..3 ..u.A.\..t4.`.Y..\.g.....}.\(..t...\\|..;{./.$.L).n`..O.....S..v..$.7..@.)....Rw....E.E...@C.U.s....k..@,...T.[.8......b\......X.P%............E...t =m......K0..$:L,$.f.m<..%\...o.QP...<.]...k...(.......E..........6....#.g.......o.B.#.a..$.g...'...7....N...!B&.w,.....&........%]..t2U. .....]r...,.Ox..?...{.s.e_.y..........=..u.E... ..E..8

C:\Windows\system\svchost.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\000002.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\system\wupdmgr.exe

Process:	C:\Users\user\Desktop\000002.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	20708
Entropy (8bit):	4.877252981445995
Encrypted:	false
SSDEEP:	384:hf6WHkMW2WrHkvAJ082eOyH+2hQVijNxapJu+uWzO1+Uqh+2yav1ghcVwZsEdMNu:hyWSLEAJ082eOyH+2hQVijNxapJu+uWk
MD5:	EAF804ADBB753C761F7101C4DB14C0FB
SHA1:	16867ACE9459E97C7577DECF7F487952625853A4
SHA-256:	71C54A1B8B657DF81CDB1ED5B01375371472562863B44B24D78E2FA763555C30
SHA-512:	8794B739891662650280A42DADF8D1D12E94BF5CFE046D2442B79198635722331D5DB43896F466919F9A7E6D9AAD6DE0C1A1286057CF8316CCFFE7801D7A427E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 74%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....,G.<.............8............0.............@........................................... .............................\|...........\|...........................................................................................................code....................................text................................@....rsrc...............................@...3.01........j.H...9..........t..&..@....U.....]..U.1.u...1...=....wC=...w.r[.....$.1..D$........l...tl..t.......7w..FQ..]..I.Bt.n{a.=.....v...3 ..u.A.\..t47.-X..\.g...v..\(..t....\|....`/.$.L).....O.....S...v$..7..@.J........R.E.....`..U.s..}... @...T..[k.p..8........+..X.0%..L.....QG...~...t =....K0..$.B.}:.,$O......F.m%QP....}\|.]...\|.......\....E......~........#L..E..`g....B.#...w.$.g...'.....n..N..D.I......M.&.....~.m.\3e]..t2U...0dP._]r.\|..,..ob...E....[......H.`.....f...

C:\autorun.inf

Process:	C:\Users\user\Desktop\000002.exe
File Type:	Microsoft Windows Autorun file
Category:	dropped
Size (bytes):	35
Entropy (8bit):	3.8645783739023827
Encrypted:	false
SSDEEP:	3:It12NApYdVJMlAn:e12ddVsAn
MD5:	0552B41955455B159B21FB6978A15136
SHA1:	238442041BEFEBD01FB3E371DBD7EDFB592C4B29
SHA-256:	724E3B4FD3F51D72C8C1B1D4FE25EEB2DD8D40EAA297D74FF807D8F742D84443
SHA-512:	BB14B46DBC2B8275873B82F3028AEA66A5B6183C7CD810ABF35A2B1BEC17C3649F706358E1FFF9307D263CCAF74A91D3C25FB0F5EA52D3ED8133F38EC2D689D5
Malicious:	false
Preview:	[autorun]..Shellexecute=explore.exe

C:\explore.exe

Process:	C:\Users\user\Desktop\000002.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	21759708
Entropy (8bit):	1.9436428734025761
Encrypted:	false
SSDEEP:	196608:xkjkKk68hA6dv/z/LsI1gsI1esI1FqsI1xMsI1tsI1qsI15sI1gsI1:xSzIhA6dv/z/
MD5:	A205A6202F91DAAB00D4CFB555CBCD0E
SHA1:	9C5EEF29AE538B14E805BFC234290EE0062BA76B
SHA-256:	39E66194E9D181D8CDA1ECD48F18B95D644DD89000251268EAF118F432C47F60
SHA-512:	250D5FA9FF0F6A6AEAE53442A69B192C06E3DE70EA8B06D5703F6864CC9D832BEC6CA7906FAC314C485421F50B2E9886C9DA4E0CB391D01B73FE062B55285702
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$./G.>.............8.p........J.p.K...J...L...@...........................L............... ...............................L.......L.............................................................................................................UPX0......J.............................UPX1.....p....J..j..................@....rsrc...X.....L.X....l.............. ...3.01.UPX!....UT6f..;Y..K.Wg..X...&.......U.....]..U.1.u...1...=....wC=...w.r[.....$.1..D$........,...tl..t*.......7w..FQ..]..I.t.f{a.=.....v..3 ..u.A.\..t4.`.Y..\.g.....}.\(..t...\\|..;{./.$.L).n`..O.....S..v..$.7..@.)....Rw....E.E...@C.U.s....k..@,...T.[.8......b\......X.P%............E...t =m......K0..$:L,$.f.m<..%\...o.QP...<.]...k...(.......E..........6....#.g.......o.B.#.a..$.g...'...7....N...!B&.w,.....&........%]..t2U. .....]r...,.Ox..?...{.s.e_.y..........=..u.E... ..E..8

C:\explore.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\000002.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Entropy (8bit):	1.9436428734025761
TrID:	Win32 Executable (generic) a (10002005/4) 98.59% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02%
File name:	000002.exe
File size:	21'759'708 bytes
MD5:	a205a6202f91daab00d4cfb555cbcd0e
SHA1:	9c5eef29ae538b14e805bfc234290ee0062ba76b
SHA256:	39e66194e9d181d8cda1ecd48f18b95d644dd89000251268eaf118f432c47f60
SHA512:	250d5fa9ff0f6a6aeae53442a69b192c06e3de70ea8b06d5703f6864cc9d832bec6ca7906fac314c485421f50b2e9886c9da4e0cb391d01b73fe062b55285702
SSDEEP:	196608:xkjkKk68hA6dv/z/LsI1gsI1esI1FqsI1xMsI1tsI1qsI15sI1gsI1:xSzIhA6dv/z/
TLSH:	D3271292FE958E5CD5E34B7C5D82BE81443EFCB116A29B4730A97F196E77C042D8230A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$./G.>.............8.p........J.p.K...J...L...@...........................L............... ............................

File Icon


Icon Hash:	aaf3e3e3918382a0

Static PE Info

General

Entrypoint:	0x18bf770
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x472F9B24 [Mon Nov 5 22:37:24 2007 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	fa9b478be79e2475ccb2af2645153d7d

Entrypoint Preview

Instruction
pushad
mov esi, 018A9015h
lea edi, dword ptr [esi-014A8015h]
push edi
jmp 00007FE57D7DFC7Dh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007FE57D7DFC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FE57D7DFC5Fh
mov eax, 00000001h
add ebx, ebx
jne 00007FE57D7DFC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007FE57D7DFC61h
jne 00007FE57D7DFC7Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FE57D7DFC56h
xor ecx, ecx
sub eax, 03h
jc 00007FE57D7DFC7Fh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007FE57D7DFCE6h
mov ebp, eax
add ebx, ebx
jne 00007FE57D7DFC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007FE57D7DFC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007FE57D7DFC92h
inc ecx
add ebx, ebx
jne 00007FE57D7DFC79h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007FE57D7DFC61h
jne 00007FE57D7DFC7Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FE57D7DFC56h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007FE57D7DFC81h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007FE57D7DFC69h
jmp 00007FE57D7DFBD8h
nop
mov eax, dword ptr [edx]
add edx, 04h
mov dword ptr [edi], eax
add edi, 04h
sub ecx, 04h
jnbe 00007FE57D7DFC63h
add edi, ecx
jmp 00007FE57D7EFBC1h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14c0498	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14c0000	0x498	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x14a8000	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x14a9000	0x17000	0x16a00	False	0.9005956491712708	data	7.829910750829017	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14c0000	0x8d58	0x8d58	False	0.23960866681406146	data	4.243599811678561	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x14c005c	0x43c	data	English	United States	0.4280442804428044

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.DLL	RegCloseKey
msvcrt.dll	_iob
PSAPI.DLL	EnumProcesses
SHELL32.DLL	ShellExecuteA
WSOCK32.DLL	htons

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

• 000002.exe
• svchost.exe
• wupdmgr.exe
• iexplore.exe
• ie4uinit.exe
• iexplore.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe

Click to jump to process

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Behavior

• 000002.exe
• svchost.exe
• wupdmgr.exe
• iexplore.exe
• ie4uinit.exe
• iexplore.exe
• rundll32.exe
• rundll32.exe
• rundll32.exe

Click to jump to process

Target ID:	0
Start time:	11:18:42
Start date:	17/10/2023
Path:	C:\Users\user\Desktop\000002.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\000002.exe
Imagebase:	0x400000
File size:	21'759'708 bytes
MD5 hash:	A205A6202F91DAAB00D4CFB555CBCD0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	11:18:45
Start date:	17/10/2023
Path:	C:\Windows\system\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system\svchost.exe
Imagebase:	0x400000
File size:	21'759'708 bytes
MD5 hash:	A205A6202F91DAAB00D4CFB555CBCD0E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	11:18:45
Start date:	17/10/2023
Path:	C:\Windows\system\wupdmgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system\wupdmgr.exe
Imagebase:	0x400000
File size:	20'708 bytes
MD5 hash:	EAF804ADBB753C761F7101C4DB14C0FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 74%, Virustotal, Browse
Reputation:	low
Has exited:	false

Target ID:	5
Start time:	11:20:37
Start date:	17/10/2023
Path:	C:\Program Files\Internet Explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Internet Explorer\IEXPLORE.EXE" \
Imagebase:	0x13fb20000
File size:	814'288 bytes
MD5 hash:	4EB098135821348270F27157F7A84E65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	11:20:37
Start date:	17/10/2023
Path:	C:\Windows\System32\ie4uinit.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
Imagebase:	0x13f950000
File size:	725'504 bytes
MD5 hash:	AB5576121AEC5386E15E6DCE469BB3C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	11:20:38
Start date:	17/10/2023
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
Imagebase:	0x10e0000
File size:	815'304 bytes
MD5 hash:	8A590F790A98F3D77399BE457E01386A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	11:20:40
Start date:	17/10/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:264 WinX:0 WinY:0 IEFrame:0000000000000000
Imagebase:	0xff580000
File size:	45'568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	11:20:40
Start date:	17/10/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:65800 WinX:0 WinY:0 IEFrame:0000000000000000
Imagebase:	0xff580000
File size:	45'568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true