Edit tour

Windows Analysis Report
simaris-suite-installer.exe

Overview

General Information

Sample name:	simaris-suite-installer.exe
Analysis ID:	1367988
MD5:	283c02361ea45d1c7db39c334b94b503
SHA1:	722037a9c26b269cd3c1b7988a43c887bdf757f2
SHA256:	2fb1fd57fda10c661806f8fa38bf303bb5c20a01d5a2ed1cc2be53aa7b7ae62a
Infos:

Detection

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Allocates memory in foreign processes

Changes memory attributes in foreign processes to executable or writable

Sets file extension default program settings to executables

Writes to foreign memory regions

Creates a process in suspended mode (likely to inject code)

DLL planting / hijacking vulnerabilities found

Drops PE files

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Tries to load missing DLLs

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

simaris-suite-installer.exe (PID: 5944 cmdline: C:\Users\user\Desktop\simaris-suite-installer.exe MD5: 283C02361EA45D1C7DB39C334B94B503)

cmd.exe (PID: 6104 cmdline: cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq SIMARIS Suite.exe" | %SYSTEMROOT%\System32\find.exe "SIMARIS Suite.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6460 cmdline: tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq SIMARIS Suite.exe" MD5: 0A4448B31CE7F83CB7691A2657F330F1)

find.exe (PID: 5532 cmdline: C:\Windows\System32\find.exe "SIMARIS Suite.exe" MD5: 15B158BC998EEF74CFDD27C44978AEA0)

SIMARIS Suite.exe (PID: 3112 cmdline: "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" MD5: 61FE3AE7F216D906024280616CE2A151)

SIMARIS Suite.exe (PID: 7100 cmdline: "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: 61FE3AE7F216D906024280616CE2A151)

explorer.exe (PID: 3904 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

SIMARIS Suite.exe (PID: 6728 cmdline: "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" MD5: 61FE3AE7F216D906024280616CE2A151)

SIMARIS Suite.exe (PID: 6312 cmdline: "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --mojo-platform-channel-handle=1904 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: 61FE3AE7F216D906024280616CE2A151)

SIMARIS Suite.exe (PID: 5960 cmdline: "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --app-path="C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar" --no-sandbox --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5632609578 --mojo-platform-channel-handle=2140 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1 MD5: 61FE3AE7F216D906024280616CE2A151)

SIMARIS Suite.exe (PID: 7148 cmdline: "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --app-path="C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar" --enable-sandbox --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5634098685 --mojo-platform-channel-handle=2300 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1 MD5: 61FE3AE7F216D906024280616CE2A151)

cleanup

Joe Sandbox Signatures

• Privilege Escalation
• Compliance
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: WINSTA.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: MSIMG32.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: WINHTTP.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: WINMM.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: WTSAPI32.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: PROPSYS.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: Secur32.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: SSPICLI.DLL
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\d3dcompiler_47.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: MSASN1.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: VERSION.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: USERENV.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: mfplat.dll
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\vulkan-1.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: CRYPTSP.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: CRYPTBASE.DLL
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: ColorAdapterClient.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: UMPDC.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: IPHLPAPI.DLL
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\libEGL.dll
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: mscms.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: UIAutomationCore.DLL
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\vk_swiftshader.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: dhcpcsvc.DLL
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: RTWorkQ.DLL
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: OLEACC.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: msmpeg2vdec.dll
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\libGLESv2.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: Wldp.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: DPAPI.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: mf.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: DWrite.dll

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\7zip-bin\win\ia32\7za.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\src\bin\elevate.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\simaris-suite-app-updater\installer.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\7zip-bin\win\x64\7za.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\Uninstall SIMARIS Suite.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\electron-sudo\dist\bin\elevate.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\electron-sudo\src\bin\elevate.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\7zip-bin\win\arm64\7za.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: cmd.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\elevate.exe

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: WINSTA.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: MSIMG32.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: WINHTTP.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: WINMM.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: WTSAPI32.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: PROPSYS.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: Secur32.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: SSPICLI.DLL
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\d3dcompiler_47.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: profapi.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: MSASN1.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: VERSION.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: dxva2.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: powrprof.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: kbdus.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: dwmapi.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: USERENV.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: mfplat.dll
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\vulkan-1.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: CRYPTSP.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: CRYPTBASE.DLL
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: ColorAdapterClient.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: UMPDC.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: IPHLPAPI.DLL
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\libEGL.dll
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\ffmpeg.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: mscms.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: UIAutomationCore.DLL
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\vk_swiftshader.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: dhcpcsvc.DLL
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: dxgi.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: RTWorkQ.DLL
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: OLEACC.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: dbghelp.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: msmpeg2vdec.dll
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	DLL: C:\Users\user\AppData\Local\Programs\simaris-suite-app\libGLESv2.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: msvproc.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: Wldp.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: DPAPI.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: mf.dll
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	DLL: DWrite.dll

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\7zip-bin\win\ia32\7za.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\src\bin\elevate.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\simaris-suite-app-updater\installer.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\7zip-bin\win\x64\7za.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\Uninstall SIMARIS Suite.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\electron-sudo\dist\bin\elevate.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\electron-sudo\src\bin\elevate.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\7zip-bin\win\arm64\7za.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: cmd.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	EXE: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\elevate.exe

Source: simaris-suite-installer.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\24074280-fd41-565e-991e-d48a07b3c328

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\LICENSE.electron.txt
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\LICENSE.txt
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\LICENSE.electron.txt
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\7zip-bin\LICENSE.txt

Source: simaris-suite-installer.exe

Static PE information: certificate valid

Source: simaris-suite-installer.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: chrome.cloudflare-dns.com

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

Process token adjusted: Security

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Section loaded: sxs.dll
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Section loaded: onecorecommonproxystub.dll

Source: simaris-suite-installer.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal42.evad.winEXE@17/146@1/3

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

File created: C:\Users\user\AppData\Local\Programs

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\simaris-suite-appProcessSingletonStartup
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5316:120:WilError_03
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Mutant created: \Sessions\1\BaseNamedObjects\24074280-fd41-565e-991e-d48a07b3c328

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

File created: C:\Users\user\AppData\Local\Temp\nsp2765.tmp

Source: simaris-suite-installer.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SIMARIS SUITE.EXE'

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

File read: C:\Users\user\Desktop\simaris-suite-installer.exe

Source: unknown	Process created: C:\Users\user\Desktop\simaris-suite-installer.exe C:\Users\user\Desktop\simaris-suite-installer.exe
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq SIMARIS Suite.exe" \| %SYSTEMROOT%\System32\find.exe "SIMARIS Suite.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq SIMARIS Suite.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "SIMARIS Suite.exe"
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq SIMARIS Suite.exe" \| %SYSTEMROOT%\System32\find.exe "SIMARIS Suite.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq SIMARIS Suite.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "SIMARIS Suite.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe"
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe"
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --app-path="C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar" --no-sandbox --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5632609578 --mojo-platform-channel-handle=2140 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --app-path="C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar" --enable-sandbox --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5634098685 --mojo-platform-channel-handle=2300 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --app-path="C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar" --no-sandbox --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5632609578 --mojo-platform-channel-handle=2140 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --app-path="C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar" --enable-sandbox --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5634098685 --mojo-platform-channel-handle=2300 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq SIMARIS Suite.exe"

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\24074280-fd41-565e-991e-d48a07b3c328

Source: simaris-suite-installer.exe

Static PE information: certificate valid

Source: simaris-suite-installer.exe

Static file information: File size 79156408 > 1048576

Source: simaris-suite-installer.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\SIMARIS Suite.exe	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\arm64\7za.exe	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\SpiderBanner.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\nsis7z.dll	Jump to dropped file

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\LICENSE.electron.txt
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\LICENSE.txt
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\LICENSE.electron.txt
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\7zip-bin\LICENSE.txt

Boot Survival

Sets file extension default program settings to executables

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

Registry value created: HKEY_CURRENT_USER_Classes\suite\shell\open\command C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe %1

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe

Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Spelling

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\arm64\7za.exe	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	File Volume queried: C:\Users\user\AppData\Roaming\simaris-suite-app\Code Cache\wasm FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	File Volume queried: C:\Users\user\AppData\Roaming\simaris-suite-app\Code Cache\js FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	File Volume queried: C:\Users\user\AppData\Roaming\simaris-suite-app\blob_storage\652c4440-e9a6-42f8-9a59-9392f544a8db FullSizeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	File Volume queried: C:\Users\user\AppData\Roaming\simaris-suite-app\Cache\Cache_Data FullSizeInformation

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources
Source: C:\Users\user\Desktop\simaris-suite-installer.exe	File opened: C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked

Source: C:\Users\user\Desktop\simaris-suite-installer.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\tasklist.exe

Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory allocated: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C5080000 protect: page read and write
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory allocated: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C5090000 protect: page read and write
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory allocated: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A0000 protect: page no access
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory allocated: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A1000 protect: page execute and read and write
Source: C:\Windows\explorer.exe	Memory allocated: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 1803C740000 protect: page read and write

Changes memory attributes in foreign processes to executable or writable

Writes to foreign memory regions

Source: C:\Users\user\Desktop\simaris-suite-installer.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq SIMARIS Suite.exe" \| %SYSTEMROOT%\System32\find.exe "SIMARIS Suite.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist /FI "USERNAME eq user" /FI "IMAGENAME eq SIMARIS Suite.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\find.exe C:\Windows\System32\find.exe "SIMARIS Suite.exe"
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --app-path="C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar" --no-sandbox --no-zygote --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5632609578 --mojo-platform-channel-handle=2140 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\simaris-suite-app" --app-path="C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar" --enable-sandbox --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5634098685 --mojo-platform-channel-handle=2300 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "c:\users\user\appdata\local\programs\simaris-suite-app\simaris suite.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\simaris-suite-app" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1516 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "c:\users\user\appdata\local\programs\simaris-suite-app\simaris suite.exe" --type=renderer --user-data-dir="c:\users\user\appdata\roaming\simaris-suite-app" --app-path="c:\users\user\appdata\local\programs\simaris-suite-app\resources\app.asar" --no-sandbox --no-zygote --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5632609578 --mojo-platform-channel-handle=2140 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "c:\users\user\appdata\local\programs\simaris-suite-app\simaris suite.exe" --type=renderer --user-data-dir="c:\users\user\appdata\roaming\simaris-suite-app" --app-path="c:\users\user\appdata\local\programs\simaris-suite-app\resources\app.asar" --enable-sandbox --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5634098685 --mojo-platform-channel-handle=2300 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "c:\users\user\appdata\local\programs\simaris-suite-app\simaris suite.exe" --type=renderer --user-data-dir="c:\users\user\appdata\roaming\simaris-suite-app" --app-path="c:\users\user\appdata\local\programs\simaris-suite-app\resources\app.asar" --no-sandbox --no-zygote --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=5632609578 --mojo-platform-channel-handle=2140 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:1
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Process created: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe "c:\users\user\appdata\local\programs\simaris-suite-app\simaris suite.exe" --type=renderer --user-data-dir="c:\users\user\appdata\roaming\simaris-suite-app" --app-path="c:\users\user\appdata\local\programs\simaris-suite-app\resources\app.asar" --enable-sandbox --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=5634098685 --mojo-platform-channel-handle=2300 --field-trial-handle=1648,i,3982303759987223075,14234584191073094306,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:1

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\simaris-suite-app VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\electron-logs.log VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\7zip-bin\package.json VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar.unpacked\node_modules\7zip-bin\index.js VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\simaris-suite-app VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar VolumeInformation
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	311 Process Injection	311 Process Injection	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	2 DLL Search Order Hijacking	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	2 DLL Search Order Hijacking	2 DLL Search Order Hijacking	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	Protocol Impersonation			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information

Source	Detection	Scanner	Label	Link
simaris-suite-installer.exe	0%	ReversingLabs
simaris-suite-installer.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\SIMARIS Suite.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\SIMARIS Suite.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\d3dcompiler_47.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\ffmpeg.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\libEGL.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\7x.sh	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\7x.sh	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm64\7za	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm64\7za	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm\7za	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\arm\7za	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\ia32\7za	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\ia32\7za	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\7za	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\7za	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\build.sh	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\build.sh	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\do-build.sh	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\linux\x64\do-build.sh	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\arm64\7za	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\arm64\7za	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\x64\7za	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\mac\x64\7za	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\arm64\7za.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\7zip-bin\win\arm64\7za.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\electron-sudo\src\bin\applet.app\Contents\MacOS\applet	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\resources\app.asar.unpacked\node_modules\electron-sudo\src\bin\applet.app\Contents\MacOS\applet	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\SpiderBanner.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsp289E.tmp\SpiderBanner.dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
chrome.cloudflare-dns.com	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.61.3	chrome.cloudflare-dns.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1367988
Start date and time:	2023-12-29 15:00:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	simaris-suite-installer.exe
Detection:	MAL
Classification:	mal42.evad.winEXE@17/146@1/3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2DA90 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2DA90 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D650 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D650 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D790 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D790 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2F8A0 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2F8A0 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2F5A0 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2F5A0 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D4B0 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D4B0 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2F4E0 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2F4E0 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D190 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D190 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D470 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D470 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D5F0 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D5F0 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D5D0 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D5D0 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D4F0 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D4F0 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D530 protect: page write copy
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D530 protect: page execute read
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory protected: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A1000 protect: page execute read

Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C5080000
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: FBC2CE52D8
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C5090000
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A1020
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2DA90
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A1060
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D650
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A10A0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D790
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A10E0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2F8A0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A1120
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2F5A0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A1160
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D4B0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A11A0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2F4E0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A11E0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D190
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A1220
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D470
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A1260
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D5F0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A12A0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D5D0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A12E0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D4F0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A1320
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FFDF4D2D530
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 2C2C50A1000
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FF686F2EDD0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FF686F36238
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FF686C41EF0
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FF686C42020
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FF686C42028
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FF686C41EE8
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FF686B4AF98
Source: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 7FF686C41EC0
Source: C:\Windows\explorer.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 1803C740000
Source: C:\Windows\explorer.exe	Memory written: C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe base: 69281112D8

Process:	C:\Users\user\AppData\Local\Programs\simaris-suite-app\SIMARIS Suite.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	865
Entropy (8bit):	5.099851752282522
Encrypted:	false
SSDEEP:
MD5:	1276C05B6D64FC23ACAE7DB61557A947
SHA1:	69A4047D982ACF52BEE7965C2F9556BC48A80658
SHA-256:	48627E54DF7E955D22856D23B379D05E69A3046E86EE14C4DB6883903D3C70C8
SHA-512:	42303A702FFF2C3007901240B5DEB224BFCD07AB301410FCB49D8121F228126C6CCA80ED150A1E34448DA76F40406AE880B427644D66098C1B5FE6DB4CBAD7BB
Malicious:	false
Reputation:	low
Preview:	[2023-12-29 15:02:27.045 (+01:00)] [info] Log to C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\electron-logs.log..[2023-12-29 15:02:27.214 (+01:00)] [info] load language en C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\app.asar\src\assets\i18n\locale-en.json..[2023-12-29 15:02:27.218 (+01:00)] [info] Log to C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\electron-logs.log..[2023-12-29 15:02:27.344 (+01:00)] [info] Log Level = debug..[2023-12-29 15:02:27.348 (+01:00)] [info] asar..[2023-12-29 15:02:27.353 (+01:00)] [info] App starting.....[2023-12-29 15:02:27.478 (+01:00)] [info] App ready.....[2023-12-29 15:02:27.481 (+01:00)] [info] App locale on startup en-GB..[2023-12-29 15:03:00.736 (+01:00)] [info] Register custom protocol.....[2023-12-29 15:03:00.740 (+01:00)] [info] ... succeeded..

Process:	C:\Users\user\Desktop\simaris-suite-installer.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Reputation:	low
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999502802445704
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	simaris-suite-installer.exe
File size:	79'156'408 bytes
MD5:	283c02361ea45d1c7db39c334b94b503
SHA1:	722037a9c26b269cd3c1b7988a43c887bdf757f2
SHA256:	2fb1fd57fda10c661806f8fa38bf303bb5c20a01d5a2ed1cc2be53aa7b7ae62a
SHA512:	84fabfd1c58c1619a731aa0a8431f75b7246461824e0efdba9792d2767c47257837e8f9be46750fc842f281aa8fc2cba9da5b02b3a0993834d3918617a7d7377
SSDEEP:	1572864:QhR5Vz+K+I1AbG1uETeBsWZc0HhRO3zYxF9A8:QhReK31AmBKHDODp8
TLSH:	02083310A855AEF2EAE75B7181C0D72C00ADEE304F609B92C6FA77ED233DE1D6745690
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Signature Valid:	true
Signature Issuer:	CN=QuoVadis Code Signing CA G1, O=QuoVadis Limited, C=BM
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	10/09/2020 11:20:03 10/09/2023 11:30:00
Subject Chain	CN=Siemens AG, O=Siemens AG, L=Muenchen, S=Bayern, C=DE
Version:	3
Thumbprint MD5:	A699905DFA7B78DFDA9842B3BDD40661
Thumbprint SHA-1:	2539592D995F97774727D78139DD971A38457BA8
Thumbprint SHA-256:	9563D1CDBDA1E7F86FDD53588E2B5F24387196150DF64666FC78721AF85A1412
Serial:	0FAB6C64B551473DC2F6EE0BE07F0763A09D171A

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19f000	0x44228	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4b79720	0x3d98
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x124000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x19f000	0x44228	0x44400	False	0.07486979166666667	data	4.345753667083271	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19f4a8	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.06960307127851584
RT_DIALOG	0x1e14d0	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x1e16d8	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x1e17d0	0xee	data	English	United States	0.6260504201680672
RT_DIALOG	0x1e18c0	0x1fa	data	English	United States	0.40118577075098816
RT_DIALOG	0x1e1ac0	0xf0	data	English	United States	0.6666666666666666
RT_DIALOG	0x1e1bb0	0xe6	data	English	United States	0.6565217391304348
RT_DIALOG	0x1e1c98	0x1ee	data	English	United States	0.38866396761133604
RT_DIALOG	0x1e1e88	0xe4	data	English	United States	0.6447368421052632
RT_DIALOG	0x1e1f70	0xda	data	English	United States	0.6422018348623854
RT_DIALOG	0x1e2050	0x1ee	data	English	United States	0.3866396761133603
RT_DIALOG	0x1e2240	0xe4	data	English	United States	0.6359649122807017
RT_DIALOG	0x1e2328	0xda	data	English	United States	0.6376146788990825
RT_DIALOG	0x1e2408	0x1f2	data	English	United States	0.39759036144578314
RT_DIALOG	0x1e2600	0xe8	data	English	United States	0.6508620689655172
RT_DIALOG	0x1e26e8	0xde	data	English	United States	0.6486486486486487
RT_DIALOG	0x1e27c8	0x202	data	English	United States	0.42217898832684825
RT_DIALOG	0x1e29d0	0xf8	data	English	United States	0.6653225806451613
RT_DIALOG	0x1e2ac8	0xee	data	English	United States	0.6512605042016807
RT_GROUP_ICON	0x1e2bb8	0x14	data	English	United States	1.1
RT_VERSION	0x1e2bd0	0x228	data	English	United States	0.4945652173913043
RT_MANIFEST	0x1e2df8	0x42e	XML 1.0 document, ASCII text, with very long lines (1070), with no line terminators	English	United States	0.5158878504672897

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net .
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report simaris-suite-installer.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Privilege Escalation

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Programs\simaris-suite-app\resources\electron-logs.log

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\LICENSE.electron.txt

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\LICENSES.chromium.html

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\SIMARIS Suite.exe

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\chrome_100_percent.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\chrome_200_percent.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\ffmpeg.dll

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\icudtl.dat

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\installerIcon.ico

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\libEGL.dll

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\af.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\am.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\ar.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\bg.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\bn.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\ca.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\cs.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\da.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\de.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\el.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\en-GB.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\en-US.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\es-419.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\es.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\et.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\fa.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\fi.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\fil.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\fr.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\gu.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\he.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\hi.pak

C:\Users\user\AppData\Local\Temp\nsp289E.tmp\7z-out\locales\hr.pak

Windows Analysis Report
simaris-suite-installer.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre