Edit tour

Windows Analysis Report
SelfService.exe

Overview

General Information

Sample Name:	SelfService.exe
Analysis ID:	1347492
MD5:	9f68b5c096445ebc64eca54843415a77
SHA1:	35fe3260d7e7d762d5114de157e338d966576d60
SHA256:	9cbfaff0aa427e248a325bb430f3e0a7ec420d7ecf03efdab9d29eaddac44f01
Infos:

Detection

Score:	36
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Yara detected Generic Downloader

.NET source code references suspicious native API functions

Uses 32bit PE files

AV process strings found (often used to terminate AV products)

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Checks if the current process is being debugged

Classification

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Source:	Binary string: symbols\exe\SelfService.pdb source: SelfService.exe, 00000000.00000002.2323818822.00000000010F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\exe\SelfService.pdb2h source: SelfService.exe, 00000000.00000002.2323904511.0000000001288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER58BA.tmp.dmp.4.dr
Source:	Binary string: @(n.pdb% source: SelfService.exe, 00000000.00000002.2323818822.00000000010F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\symbols\exe\SelfService.pdb source: SelfService.exe, 00000000.00000002.2323904511.00000000012BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n8C:\Windows\SelfService.pdb source: SelfService.exe, 00000000.00000002.2323818822.00000000010F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER58BA.tmp.dmp.4.dr
Source:	Binary string: E:\work\317eef72ebe6dc03\SSP\src\Dazzle\obj\Release\SelfService.pdbramework\v4.0.30319\diasymreader.dllNN, source: SelfService.exe, 00000000.00000002.2323904511.00000000012BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ?(nC:\Users\user\Desktop\SelfService.pdb source: SelfService.exe, 00000000.00000002.2323818822.00000000010F8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: SelfService.pdb source: WER58BA.tmp.dmp.4.dr
Source:	Binary string: E:\work\317eef72ebe6dc03\SSP\src\Dazzle\obj\Release\SelfService.pdb source: SelfService.exe
Source:	Binary string: \??\C:\Windows\exe\SelfService.pdbntXhTQ= source: SelfService.exe, 00000000.00000002.2323904511.0000000001288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER58BA.tmp.dmp.4.dr
Source:	Binary string: \??\C:\Windows\SelfService.pdb source: SelfService.exe, 00000000.00000002.2323904511.0000000001288000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\SelfService.pdbpdbice.pdb' source: SelfService.exe, 00000000.00000002.2323904511.0000000001273000.00000004.00000020.00020000.00000000.sdmp

Source: Yara match	File source: SelfService.exe, type: SAMPLE
Source: Yara match	File source: 0.0.SelfService.exe.7d0000.0.unpack, type: UNPACKEDPE

Source: SelfService.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SelfService.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: SelfService.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: SelfService.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: SelfService.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SelfService.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: SelfService.exe	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SelfService.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SelfService.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: SelfService.exe	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SelfService.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: SelfService.exe	String found in binary or memory: http://ocsp.digicert.com0N
Source: SelfService.exe	String found in binary or memory: http://ocsp.digicert.com0O
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: SelfService.exe	String found in binary or memory: http://www.citrix.com/ServiceRecord
Source: SelfService.exe	String found in binary or memory: https://server.domain.com
Source: SelfService.exe	String found in binary or memory: https://www.digicert.com/CPS0

Source: SelfService.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\SelfService.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SelfService.exe C:\Users\user\Desktop\SelfService.exe
Source: C:\Users\user\Desktop\SelfService.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 816

Source: SelfService.exe	String found in binary or memory: +-launchDefaultDesktop
Source: SelfService.exe	String found in binary or memory: -launch
Source: SelfService.exe	String found in binary or memory: store_usernameaSoftware\Citrix\ICA Client\CEIP\Data\Launch Type%-startmenuShortcut
Source: SelfService.exe	String found in binary or memory: -startedbycf
Source: SelfService.exe	String found in binary or memory: p%-stopfakeradeerror
Source: SelfService.exe	String found in binary or memory: ;-InstallConfigMgrApplications
Source: SelfService.exe	String found in binary or memory: \loading.html_/SelfService;component/wpfui/loadingwindow.xaml
Source: SelfService.exe	String found in binary or memory: -StartPos = i={0} o={1};Internal Children.Count = {0}7for item={0} nr={1} idx={2}GVTP.MeasureRequiredTileSize idx={0}!ArrangeOverrides#No Children = {0}Ochild {0} maps item {1} at position {2}
Source: SelfService.exe	String found in binary or memory: AddApps-AddAppsButton_ShortCut+AddAppsButton_tooltip
Source: SelfService.exe	String found in binary or memory: #D4D4D4CInitiate file open for file : {0}iError in opening file : {0} with error message : {1}{/SelfService;component/wpfui/usercontrols/downloadbutton.xamlCOnMouseWheel scroll by {0} to {1}/Launching from Green UIaunexpected error from launch in UI code (ignore))ContextMenuItemStyle7AutoScrollOnDrag pt={0},{1}#Scroll up on drag'Scroll down on drag+ExtendScroll down={0}?desiredOffset {0} vo={1} ex={2}ACreate opacity mask on first use9Animate margin to {0} in {1}/Scroller_MouseUp = left=Scroller_MouseUp - start timer
Source: SelfService.exe	String found in binary or memory: \DefaultIcon[Exit DefaultFTAHelper:createSubKeyDefaultIconSEnter DefaultFTAHelper:getInstallLocationESOFTWARE\Citrix\Install\ICA ClientQExit DefaultFTAHelper:getInstallLocation/CreateDefaultFTAEntriesCGet list of existing default FTAs9FTA File Extension Count {0}KFTA provider File Extension Count {0}?Get list of default FTAs needed5Remove default FTA for {0}=SelfServicePlugin\Receiver.ico/Add default FTA for {0}!DazzleDefaultFTA-UseDefaultFTA file={0}[Ask user whether to use Dazzle to find an app'user response = {0}?Async invoke skip Dazzle launch%CleanupTechPreview9Software\Citrix\Dazzle\Sites
Source: SelfService.exe	String found in binary or memory: Error: QStore ({0}), Message ({1}), Status ({2})kAvailable App Id ({0}), Name ({1}), Description ({2})-Installed App Id ({0})?TraceEnumerationResponse failed7TraceInstallResponse startsSTraceInstallResponse the response is nullWTraceInstallResponse InstallResponse Time: sInstallResponse for id ({0}), Status ({1}), Message ({2})3TraceInstallResponse ends7TraceInstallResponse failedcThe following applications are already installed:
Source: SelfService.exe	String found in binary or memory: wCan only retry a download after a cancelled/temporary error%MarkForUpdate({0})/AddNewProvider({0},{1})file
Source: SelfService.exe	String found in binary or memory: Store could not be added due to security policy; policy={0} url={1}oEnsuring that store name is unique , friendlyName = {0}sEnsureStoreNameIsUnique returned with friendlyName = {0} 3Entering GetAllStoreNames/Adding name {0} to list
Source: SelfService.exe	String found in binary or memory: Dwpfui/images/addaccount_button.png
Source: SelfService.exe	String found in binary or memory: Lwpfui/images/addaccount_buttondown.pngg
Source: SelfService.exe	String found in binary or memory: Hwpfui/images/addaccount_disabled.png
Source: SelfService.exe	String found in binary or memory: 6wpfui/images/addapp_rjh.png
Source: SelfService.exe	String found in binary or memory: @wpfui/images/added_checkmark.png
Source: SelfService.exe	String found in binary or memory: Pwpfui/images/addeditaccounts_flat_s1.pngX
Source: SelfService.exe	String found in binary or memory: S50wpfui/loadingwindow.baml
Source: SelfService.exe	String found in binary or memory: ../images/Added_checkMark.png

Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SelfService.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SelfService.exe	Process queried: DebugPort			Jump to behavior

Source: SelfService.exe, ResourceMessageBox.cs	Reference to suspicious API methods: ((FrameworkElement)this).FindResource((object)"BottomButtons")
Source: SelfService.exe, Controller.cs	Reference to suspicious API methods: GetProcAddress(moduleHandleW, "IsWow64Process")
Source: SelfService.exe, ShareFileController.cs	Reference to suspicious API methods: new Thread((ThreadStart)delegate{//IL_000c: Unknown result type (might be due to invalid IL or missing references)//IL_0016: Expected O, but got Unknownwhile (bRunCFListner){try{CtxServerPipe ctxPipe = new CtxServerPipe();ctxServerPipes.Add(ctxPipe);ctxPipe.Listen();ThreadPool.QueueUserWorkItem(delegate{try{IntPtr hProcess = NativeMethods.OpenProcess(4096u, bInheritHandle: false, ctxPipe.GetClientConnectedPId());bool flag = true;int lpdwSize = 1024;StringBuilder stringBuilder = new StringBuilder(lpdwSize);NativeMethods.QueryFullProcessImageName(hProcess, 0, stringBuilder, ref lpdwSize);string text = stringBuilder.ToString(0, lpdwSize);FileSignatureVerifier fileSignatureVerifier = FileSignatureVerifier.GetFileSignatureVerifier(text);bool flag2 = fileSignatureVerifier.IsValidSignature();bool flag3 = fileSignatureVerifier.IsCitrixOnline();if ((flag2 && flag3) \|\| Config.RequiredSigned_SSOClient){ctxPipe.RcvData((Action<CtxServerPipe, string>)RcvSharefileData);}else{Tracer.Misc.Error("Client Signature are not valid, rejecting the connection: {0}", new object[1] { text });ctxServerPipes.RemoveAt(ctxServerPipes.Count - 1);ctxPipe.Dispose();}}catch (Exception ex2){Tracer.Misc.Error("{0}", new object[1] { ex2 });}});}catch (Exception ex){Tracer.Misc.Trace("CF Server is closing {0} value for bRunCFListner is {1} ", new object[2]{ex.Message.ToString(),bRunCFListner});}}}).Start()
Source: SelfService.exe, WebControl.cs	Reference to suspicious API methods: GetAsyncKeyState(162)
Source: SelfService.exe, Program.cs	Reference to suspicious API methods: LoadLibrary(Path.GetDirectoryName(Assembly.GetEntryAssembly().Location) + "\\..\\Receiver\\PackageIdentification.dll")

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	2 Command and Scripting Interpreter	Path Interception	1 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	11 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography			Data Encrypted for Impact	DNS Server	Email Addresses

Source	Detection	Scanner	Label	Link
SelfService.exe	0%	ReversingLabs
SelfService.exe	0%	Virustotal		Browse

Name	Source	Malicious	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false	high
http://www.citrix.com/ServiceRecord	SelfService.exe	false	high
https://server.domain.com	SelfService.exe	false	high

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1347492
Start date and time:	2023-11-24 16:24:46 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	SelfService.exe
Detection:	SUS
Classification:	sus36.troj.evad.winEXE@2/5@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8562300225687745
Encrypted:	false
SSDEEP:	96:znFrEJoSECosMjzzxTMbTdQXIDcQvc6QcEVcw3cE/n+BHUHZopAnQHdE7HeS9+P2:rbUobT0BU/KaKDzuiFWZ24IO8Uv
MD5:	5A24B37A04A96E218CEACF95A86C6D47
SHA1:	E5BC84CE3BB485C8074B73F7E314017339241E40
SHA-256:	6956E73EC38C0A9EA94A2F13A3F98C6476D45A92318AE08495EA132623DBAC8D
SHA-512:	114817DB2114A3CC6FAE6E431FEC969BC3EC73DAE531FB5214EBAB897C6F9C177326CCB1C5D4A65A94CA6D10EA43D34E06BF2C0DE438F1C76BB6DAD1B1F2E78D
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.4.5.3.1.3.1.3.1.3.2.5.2.5.2.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.4.5.3.1.3.1.3.1.9.1.9.0.0.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.f.f.5.2.1.4.-.b.1.1.2.-.4.c.2.d.-.b.6.0.4.-.2.b.2.0.0.f.d.f.5.5.2.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.8.3.5.b.7.8.-.2.2.8.a.-.4.8.c.5.-.9.4.f.2.-.c.3.b.e.3.2.e.9.4.9.9.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.l.f.S.e.r.v.i.c.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.e.l.f.S.e.r.v.i.c.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.4.0.-.0.0.0.1.-.0.0.1.4.-.2.d.0.0.-.a.e.7.5.e.a.1.e.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.6.5.6.4.c.7.8.f.0.8.e.c.0.4.4.8.0.8.4.d.5.f.f.7.c.4.6.7.9.a.f.0.0.0.0.0.0.0.0.!.0.0.0.0.3.5.f.e.3.2.6.0.d.7.e.7.d.7.6.2.d.5.1.1.4.d.e.1.5.7.e.3.3.8.d.

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.927824079777427
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SelfService.exe
File size:	5'268'576 bytes
MD5:	9f68b5c096445ebc64eca54843415a77
SHA1:	35fe3260d7e7d762d5114de157e338d966576d60
SHA256:	9cbfaff0aa427e248a325bb430f3e0a7ec420d7ecf03efdab9d29eaddac44f01
SHA512:	425e2b7e46e28d4e3fe01ffd628a1f479cb47041b6cb79c0b3fa3a0022d5a2c5dd99c37e9056ea2fc7bf73aa31cbcd65e79781427601e3d0082e03d068954dbe
SSDEEP:	98304:Thj0OcytalUPvzEmgmyM3tO+xcQjEHstOb8:Thj0OcykyXzEY53Tx3jEM4g
TLSH:	5F36BE1036B49409E4BBCA7C54A946400F397C829DADDA4D3D6E7C8E1F73B428E15FAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`..............0..@L.........2^L.. ...`L...@.. ........................P.......P...`................................

Entrypoint:	0x8c5e32
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6082991B [Fri Apr 23 09:53:31 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Signature Valid:	true
Signature Issuer:	CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	18/06/2020 02:00:00 23/06/2021 14:00:00
Subject Chain	CN="Citrix Systems, Inc.", OU=XenApp(Server SHA256), O="Citrix Systems, Inc.", L=Fort Lauderdale, S=Florida, C=US
Version:	3
Thumbprint MD5:	175095A8F0748B275DBC0C10EBBB533A
Thumbprint SHA-1:	EBAF02C39126534EE4196667B92283860CEED095
Thumbprint SHA-256:	A88C7898F592CAD490236D05D9E04965B69B33214227A47D424CDDA9DBE6DEF6
Serial:	09C3B1EA2097AED1E243D9024C13C15A

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4c5de0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4c6000	0x3e854	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x502e00	0x3660
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x506000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4c5ca8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SelfService.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SelfService.exe_8848f2e3178fdc26196c2286414cc099d07aa361_3afe7f00_95ff5214-b112-4c2d-b604-2b200fdf5524\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER58BA.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER59C5.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER59F5.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
SelfService.exe

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4c3e60	0x4c4000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4c6000	0x3e854	0x3ea00	False	0.21703468063872255	data	4.192502909219041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x506000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x4c6280	0x148	Device independent bitmap graphic, 8 x 16 x 32, image size 0	0.6585365853658537
RT_ICON	0x4c63d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.5549645390070922
RT_ICON	0x4c6850	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	0.4558139534883721
RT_ICON	0x4c6f18	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.4155737704918033
RT_ICON	0x4c78b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.37171669793621015
RT_ICON	0x4c8968	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	0.2834319526627219
RT_ICON	0x4ca3e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.24730290456431536
RT_ICON	0x4cc998	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	0.18463627775153518
RT_ICON	0x4d0bd0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 0	0.16478743068391866
RT_ICON	0x4d6068	0xe8a8	Device independent bitmap graphic, 120 x 240 x 32, image size 0	0.08138012088650101
RT_ICON	0x4e4920	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 0	0.1339604792936725
RT_ICON	0x4eddd8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	0.11492961078906896
RT_ICON	0x4fe610	0x5766	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	1.0003128631447216
RT_GROUP_ICON	0x503d88	0xbc	data	0.6914893617021277
RT_VERSION	0x503e54	0x3ea	data	0.41317365269461076
RT_MANIFEST	0x504250	0x600	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.3717447916666667

Target ID:	0
Start time:	16:25:30
Start date:	24/11/2023
Path:	C:\Users\user\Desktop\SelfService.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SelfService.exe
Imagebase:	0x7d0000
File size:	5'268'576 bytes
MD5 hash:	9F68B5C096445EBC64ECA54843415A77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low
Has exited:	true

Target ID:	4
Start time:	16:25:31
Start date:	24/11/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 816
Imagebase:	0x110000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high
Has exited:	true

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre