Edit tour

Windows Analysis Report
Sysmon64.exe

Overview

General Information

Sample name:	Sysmon64.exe
Analysis ID:	1397930
MD5:	dbb70df036b6811f1328bb06bf8671fe
SHA1:	52ac1d0b90182e7f4c6667026ecbea5bd82974b8
SHA256:	373061d73b6743651050749dba958090a954939109fc51dd27e548b0d71cd75c
Infos:

Detection

Score:	36
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Found evasive API chain (may stop execution after checking mutex)

Sigma detected: Suspicious New Service Creation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Classification

Analysis Advice

Initial sample is implementing a service and should be registered / started as service

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

cmd.exe (PID: 7728 cmdline: cmd /c sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" >> C:\servicereg.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7780 cmdline: sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 7860 cmdline: cmd /c sc start CNVkE >> C:\servicestart.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7912 cmdline: sc start CNVkE MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

Sysmon64.exe (PID: 7944 cmdline: C:\Users\user\Desktop\Sysmon64.exe MD5: DBB70DF036B6811F1328BB06BF8671FE)

unsecapp.exe (PID: 7976 cmdline: C:\Windows\system32\wbem\unsecapp.exe -Embedding MD5: 9B782B1E1D7A2C28302755F963EAC907)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" , CommandLine: sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: cmd /c sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" >> C:\servicereg.log 2>&1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7728, ParentProcessName: cmd.exe, ProcessCommandLine: sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" , ProcessId: 7780, ProcessName: sc.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" , CommandLine: sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: cmd /c sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" >> C:\servicereg.log 2>&1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7728, ParentProcessName: cmd.exe, ProcessCommandLine: sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" , ProcessId: 7780, ProcessName: sc.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Data Obfuscation
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Source: Sysmon64.exe

Static PE information: certificate valid

Source: Sysmon64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\agent\1\s\sys\x64\Public_Release\sysmondrv.pdb source: Sysmon64.exe
Source:	Binary string: C:\agent\1\s\exe\x64\Public_Release\Sysmon64.pdb source: Sysmon64.exe

Source: Sysmon64.exe	String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: Sysmon64.exe	String found in binary or memory: http://relaxng.org/ns/structure/1.0allocating
Source: Sysmon64.exe	String found in binary or memory: https://www.sysinternals.com0

Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873CC870	6_2_00007FF7873CC870
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF787517848	6_2_00007FF787517848
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873D40E0	6_2_00007FF7873D40E0
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873DA8A0	6_2_00007FF7873DA8A0
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF787546098	6_2_00007FF787546098
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF787409F30	6_2_00007FF787409F30
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873D4F30	6_2_00007FF7873D4F30
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7875187EC	6_2_00007FF7875187EC
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF787405FB0	6_2_00007FF787405FB0
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873DAE60	6_2_00007FF7873DAE60
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873D5EB0	6_2_00007FF7873D5EB0
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873DED70	6_2_00007FF7873DED70
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873D4550	6_2_00007FF7873D4550
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873C4DE0	6_2_00007FF7873C4DE0
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF787536E04	6_2_00007FF787536E04
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873E2C30	6_2_00007FF7873E2C30
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873DCC40	6_2_00007FF7873DCC40
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873D2510	6_2_00007FF7873D2510
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873DFB60	6_2_00007FF7873DFB60
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873D1B70	6_2_00007FF7873D1B70
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873D8380	6_2_00007FF7873D8380
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF78740C270	6_2_00007FF78740C270
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF787518218	6_2_00007FF787518218
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873C5240	6_2_00007FF7873C5240
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873C22A0	6_2_00007FF7873C22A0
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF787518ACC	6_2_00007FF787518ACC
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873C2920	6_2_00007FF7873C2920
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873CC940	6_2_00007FF7873CC940
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873D5940	6_2_00007FF7873D5940
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7873C7150	6_2_00007FF7873C7150

Source: C:\Users\user\Desktop\Sysmon64.exe

Code function: String function: 00007FF7873CF0A0 appears 51 times

Source: Sysmon64.exe

Static PE information: Resource name: BINRES type: PE32+ executable (DLL) (native) x86-64, for MS Windows

Source: Sysmon64.exe	Binary or memory string: ing" /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> <data name="CommandLine" inT vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: OriginalFileName vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: ny" inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:s vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: ring" /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> <data name="CommandLine" inTy vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> <data name="CommandLine" inType="wi vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: > <data name="Company" inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:Uni vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: <data name="Company" inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:Unic vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: a name="Company" inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: odeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> <dat vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: :UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: ersion: %6!s!%n Description: %7!s!%n Product: %8!s!%n Company: %9!s!%n OriginalFileName: %10!s!%n CommandLine: %11! vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: " inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:str vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: ame="Company" inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" out vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: : %7!s!%nDescription: %8!s!%nProduct: %9!s!%nCompany: %10!s!%nOriginalFileName: %11!s!%nHashes: %12!s!%nSigned: %13!s!%nSignature: vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: deString" outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> <data vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: on: %7!s!%nProduct: %8!s!%nCompany: %9!s!%nOriginalFileName: %10!s!%nCommandLine: %11!s!%nCurrentDirectory: %12!s!%nUser: %13!s!%n vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: nDescription: %7!s!%nProduct: %8!s!%nCompany: %9!s!%nOriginalFileName: %10!s!%nCommandLine: %11!s!%nCurrentDirectory: %12!s!%nUser vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: me="Company" inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" outT vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: aded: %6!s!%n FileVersion: %7!s!%n Description: %8!s!%n Product: %9!s!%n Company: %10!s!%n OriginalFileName: %11!s! vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> <data name="Hashes" inType="win:Unic vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: pe="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> <data name="CommandL vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> <data name="Ha vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: <data name="Company" inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:Unico vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: nType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: %9!s!%nCompany: %10!s!%nOriginalFileName: %11!s!%nHashes: %12!s!%nSigned: %13!s!%nSignature: %14!s!%nSignatureStatus: %15!s!%nUse vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: /> <data name="Company" inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:U vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: OriginalFilename vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: e="Company" inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" inType="win:UnicodeString" outTy vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: ="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> <data name="Hashes" inType="win:UnicodeString" outType vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: me="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> <data name="Hashes" inType="win:UnicodeString" outTy vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: e="xs:string" /> <data name="Company" inType="win:UnicodeString" outType="xs:string" /> <data name="OriginalFileName" vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000000.1355215817.00007FF787575000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SYSTEM\SelectCurrent%03d@\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENTHKCC\SOFTWARE\CLASSESHKCR\SYSTEM\ControlSetHKLM\System\CurrentControlSetHKLMUSERHKULowMediumHighSystemProtected ProcessOriginalFileNameUnavailableEventTime: %I64x vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SYSTEM\SelectCurrent%03d@\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENTHKCC\SOFTWARE\CLASSESHKCR\SYSTEM\ControlSetHKLM\System\CurrentControlSetHKLMUSERHKULowMediumHighSystemProtected ProcessOriginalFileNameUnavailableEventTime: %I64x vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName: %10!s!%n vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName: %11!s!%n vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: Image loaded:%nRuleName: %1!s!%nUtcTime: %2!s!%nProcessGuid: %3!s!%nProcessId: %4!s!%nImage: %5!s!%nImageLoaded: %6!s!%nFileVersion: %7!s!%nDescription: %8!s!%nProduct: %9!s!%nCompany: %10!s!%nOriginalFileName: %11!s!%nHashes: %12!s!%nSigned: %13!s!%nSignature: %14!s!%nSignatureStatus: %15!s!%nUser: %16!s! vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: Process Create:%nRuleName: %1!s!%nUtcTime: %2!s!%nProcessGuid: %3!s!%nProcessId: %4!s!%nImage: %5!s!%nFileVersion: %6!s!%nDescription: %7!s!%nProduct: %8!s!%nCompany: %9!s!%nOriginalFileName: %10!s!%nCommandLine: %11!s!%nCurrentDirectory: %12!s!%nUser: %13!s!%nLogonGuid: %14!s!%nLogonId: %15!s!%nTerminalSessionId: %16!s!%nIntegrityLevel: %17!s!%nHashes: %18!s!%nParentProcessGuid: %19!s!%nParentProcessId: %20!s!%nParentImage: %21!s!%nParentCommandLine: %22!s!%nParentUser: %23!s! vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: Company(OriginalFileName vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: <string id="event.str_SYSMONEVENT_CREATE_PROCESS" value="Process Create:%nRuleName: %1!s!%nUtcTime: %2!s!%nProcessGuid: %3!s!%nProcessId: %4!s!%nImage: %5!s!%nFileVersion: %6!s!%nDescription: %7!s!%nProduct: %8!s!%nCompany: %9!s!%nOriginalFileName: %10!s!%nCommandLine: %11!s!%nCurrentDirectory: %12!s!%nUser: %13!s!%nLogonGuid: %14!s!%nLogonId: %15!s!%nTerminalSessionId: %16!s!%nIntegrityLevel: %17!s!%nHashes: %18!s!%nParentProcessGuid: %19!s!%nParentProcessId: %20!s!%nParentImage: %21!s!%nParentCommandLine: %22!s!%nParentUser: %23!s!" /> vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: <string id="event.str_SYSMONEVENT_IMAGE_LOAD" value="Image loaded:%nRuleName: %1!s!%nUtcTime: %2!s!%nProcessGuid: %3!s!%nProcessId: %4!s!%nImage: %5!s!%nImageLoaded: %6!s!%nFileVersion: %7!s!%nDescription: %8!s!%nProduct: %9!s!%nCompany: %10!s!%nOriginalFileName: %11!s!%nHashes: %12!s!%nSigned: %13!s!%nSignature: %14!s!%nSignatureStatus: %15!s!%nUser: %16!s!" /> vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: (Default)Unknown Event typeCreateKeyDeleteKeyRenameKeyCreateValueDeleteValueRenameValueSetValueBinary Data(Empty)SHA1MD5SHA256IMPHASH_?@$()UtcTimeIDDescriptionSYSMONEVENT_ERRORError reportRuleNameProcessGuidProcessIdImageFileVersionProductCompanyOriginalFileNameCommandLineCurrentDirectoryUserLogonGuidLogonIdTerminalSessionIdIntegrityLevelHashesParentProcessGuidParentProcessIdParentImageParentCommandLineParentUserSYSMONEVENT_CREATE_PROCESSProcess CreateProcessCreateTargetFilenameCreationUtcTimePreviousCreationUtcTimeSYSMONEVENT_FILE_TIMEFile creation time changedFileCreateTimeProtocolInitiatedSourceIsIpv6SourceIpSourceHostnameSourcePortSourcePortNameDestinationIsIpv6DestinationIpDestinationHostnameDestinationPortDestinationPortNameSYSMONEVENT_NETWORK_CONNECTNetwork connection detectedNetworkConnectStateVersionSchemaVersionSYSMONEVENT_SERVICE_STATE_CHANGESysmon service state changedSYSMONEVENT_PROCESS_TERMINATEProcess terminatedProcessTerminateImageLoadedSignedSignatureSignatureStatusSYSMONEVENT_DRIVER_LOADDriver loadedDriverLoadSYSMONEVENT_IMAGE_LOADImage loadedImageLoadSourceProcessGuidSourceProcessIdSourceImageTargetProcessGuidTargetProcessIdTargetImageNewThreadIdStartAddressStartModuleStartFunctionSourceUserTargetUserSYSMONEVENT_CREATE_REMOTE_THREADCreateRemoteThread detectedCreateRemoteThreadDeviceSYSMONEVENT_RAWACCESS_READRawAccessRead detectedRawAccessReadSourceProcessGUIDSourceThreadIdTargetProcessGUIDGrantedAccessCallTraceSYSMONEVENT_ACCESS_PROCESSProcess accessedProcessAccessSYSMONEVENT_FILE_CREATEFile createdFileCreateEventTypeTargetObjectSYSMONEVENT_REG_KEYRegistry object added or deletedRegistryEventDetailsSYSMONEVENT_REG_SETVALUERegistry value setNewNameSYSMONEVENT_REG_NAMERegistry object renamedHashContentsSYSMONEVENT_FILE_CREATE_STREAM_HASHFile stream createdFileCreateStreamHashConfigurationConfigurationFileHashSYSMONEVENT_SERVICE_CONFIGURATION_CHANGESysmon config state changedPipeNameSYSMONEVENT_CREATE_NAMEDPIPEPipe CreatedPipeEventSYSMONEVENT_CONNECT_NAMEDPIPEPipe ConnectedOperationEventNamespaceNameQuerySYSMONEVENT_WMI_FILTERWmiEventFilter activity detectedWmiEventTypeDestinationSYSMONEVENT_WMI_CONSUMERWmiEventConsumer activity detectedConsumerFilterSYSMONEVENT_WMI_BINDINGWmiEventConsumerToFilter activity detectedQueryNameQueryStatusQueryResultsSYSMONEVENT_DNS_QUERYDns queryDnsQueryIsExecutableArchivedSYSMONEVENT_FILE_DELETEFile Delete archivedFileDeleteSessionClientInfoSYSMONEVENT_CLIPBOARDClipboard changedClipboardChangeSYSMONEVENT_PROCESS_IMAGE_TAMPERINGProcess TamperingProcessTamperingSYSMONEVENT_FILE_DELETE_DETECTEDFile Delete loggedFileDeleteDetectedQ vs Sysmon64.exe
Source: Sysmon64.exe, 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSysmondrv.sysH vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: SYSTEM\SelectCurrent%03d@\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENTHKCC\SOFTWARE\CLASSESHKCR\SYSTEM\ControlSetHKLM\System\CurrentControlSetHKLMUSERHKULowMediumHighSystemProtected ProcessOriginalFileNameUnavailableEventTime: %I64x vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: OriginalFileName: %10!s!%n vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: OriginalFileName: %11!s!%n vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: Image loaded:%nRuleName: %1!s!%nUtcTime: %2!s!%nProcessGuid: %3!s!%nProcessId: %4!s!%nImage: %5!s!%nImageLoaded: %6!s!%nFileVersion: %7!s!%nDescription: %8!s!%nProduct: %9!s!%nCompany: %10!s!%nOriginalFileName: %11!s!%nHashes: %12!s!%nSigned: %13!s!%nSignature: %14!s!%nSignatureStatus: %15!s!%nUser: %16!s! vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: Process Create:%nRuleName: %1!s!%nUtcTime: %2!s!%nProcessGuid: %3!s!%nProcessId: %4!s!%nImage: %5!s!%nFileVersion: %6!s!%nDescription: %7!s!%nProduct: %8!s!%nCompany: %9!s!%nOriginalFileName: %10!s!%nCommandLine: %11!s!%nCurrentDirectory: %12!s!%nUser: %13!s!%nLogonGuid: %14!s!%nLogonId: %15!s!%nTerminalSessionId: %16!s!%nIntegrityLevel: %17!s!%nHashes: %18!s!%nParentProcessGuid: %19!s!%nParentProcessId: %20!s!%nParentImage: %21!s!%nParentCommandLine: %22!s!%nParentUser: %23!s! vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: OriginalFileName vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: Company(OriginalFileName vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: <string id="event.str_SYSMONEVENT_CREATE_PROCESS" value="Process Create:%nRuleName: %1!s!%nUtcTime: %2!s!%nProcessGuid: %3!s!%nProcessId: %4!s!%nImage: %5!s!%nFileVersion: %6!s!%nDescription: %7!s!%nProduct: %8!s!%nCompany: %9!s!%nOriginalFileName: %10!s!%nCommandLine: %11!s!%nCurrentDirectory: %12!s!%nUser: %13!s!%nLogonGuid: %14!s!%nLogonId: %15!s!%nTerminalSessionId: %16!s!%nIntegrityLevel: %17!s!%nHashes: %18!s!%nParentProcessGuid: %19!s!%nParentProcessId: %20!s!%nParentImage: %21!s!%nParentCommandLine: %22!s!%nParentUser: %23!s!" /> vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: <string id="event.str_SYSMONEVENT_IMAGE_LOAD" value="Image loaded:%nRuleName: %1!s!%nUtcTime: %2!s!%nProcessGuid: %3!s!%nProcessId: %4!s!%nImage: %5!s!%nImageLoaded: %6!s!%nFileVersion: %7!s!%nDescription: %8!s!%nProduct: %9!s!%nCompany: %10!s!%nOriginalFileName: %11!s!%nHashes: %12!s!%nSigned: %13!s!%nSignature: %14!s!%nSignatureStatus: %15!s!%nUser: %16!s!" /> vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: <data name="OriginalFileName" inType="win:UnicodeString" outType="xs:string" /> vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: (Default)Unknown Event typeCreateKeyDeleteKeyRenameKeyCreateValueDeleteValueRenameValueSetValueBinary Data(Empty)SHA1MD5SHA256IMPHASH_?@$()UtcTimeIDDescriptionSYSMONEVENT_ERRORError reportRuleNameProcessGuidProcessIdImageFileVersionProductCompanyOriginalFileNameCommandLineCurrentDirectoryUserLogonGuidLogonIdTerminalSessionIdIntegrityLevelHashesParentProcessGuidParentProcessIdParentImageParentCommandLineParentUserSYSMONEVENT_CREATE_PROCESSProcess CreateProcessCreateTargetFilenameCreationUtcTimePreviousCreationUtcTimeSYSMONEVENT_FILE_TIMEFile creation time changedFileCreateTimeProtocolInitiatedSourceIsIpv6SourceIpSourceHostnameSourcePortSourcePortNameDestinationIsIpv6DestinationIpDestinationHostnameDestinationPortDestinationPortNameSYSMONEVENT_NETWORK_CONNECTNetwork connection detectedNetworkConnectStateVersionSchemaVersionSYSMONEVENT_SERVICE_STATE_CHANGESysmon service state changedSYSMONEVENT_PROCESS_TERMINATEProcess terminatedProcessTerminateImageLoadedSignedSignatureSignatureStatusSYSMONEVENT_DRIVER_LOADDriver loadedDriverLoadSYSMONEVENT_IMAGE_LOADImage loadedImageLoadSourceProcessGuidSourceProcessIdSourceImageTargetProcessGuidTargetProcessIdTargetImageNewThreadIdStartAddressStartModuleStartFunctionSourceUserTargetUserSYSMONEVENT_CREATE_REMOTE_THREADCreateRemoteThread detectedCreateRemoteThreadDeviceSYSMONEVENT_RAWACCESS_READRawAccessRead detectedRawAccessReadSourceProcessGUIDSourceThreadIdTargetProcessGUIDGrantedAccessCallTraceSYSMONEVENT_ACCESS_PROCESSProcess accessedProcessAccessSYSMONEVENT_FILE_CREATEFile createdFileCreateEventTypeTargetObjectSYSMONEVENT_REG_KEYRegistry object added or deletedRegistryEventDetailsSYSMONEVENT_REG_SETVALUERegistry value setNewNameSYSMONEVENT_REG_NAMERegistry object renamedHashContentsSYSMONEVENT_FILE_CREATE_STREAM_HASHFile stream createdFileCreateStreamHashConfigurationConfigurationFileHashSYSMONEVENT_SERVICE_CONFIGURATION_CHANGESysmon config state changedPipeNameSYSMONEVENT_CREATE_NAMEDPIPEPipe CreatedPipeEventSYSMONEVENT_CONNECT_NAMEDPIPEPipe ConnectedOperationEventNamespaceNameQuerySYSMONEVENT_WMI_FILTERWmiEventFilter activity detectedWmiEventTypeDestinationSYSMONEVENT_WMI_CONSUMERWmiEventConsumer activity detectedConsumerFilterSYSMONEVENT_WMI_BINDINGWmiEventConsumerToFilter activity detectedQueryNameQueryStatusQueryResultsSYSMONEVENT_DNS_QUERYDns queryDnsQueryIsExecutableArchivedSYSMONEVENT_FILE_DELETEFile Delete archivedFileDeleteSessionClientInfoSYSMONEVENT_CLIPBOARDClipboard changedClipboardChangeSYSMONEVENT_PROCESS_IMAGE_TAMPERINGProcess TamperingProcessTamperingSYSMONEVENT_FILE_DELETE_DETECTEDFile Delete loggedFileDeleteDetectedQ vs Sysmon64.exe
Source: Sysmon64.exe	Binary or memory string: OriginalFilenameSysmondrv.sysH vs Sysmon64.exe

Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Sysmon64.exe	Section loaded: dsparse.dll	Jump to behavior
Source: C:\Windows\System32\wbem\unsecapp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\unsecapp.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: Sysmon64.exe	Binary string: \Device\NamedPipe
Source: Sysmon64.exe	Binary string: M\Device\Mup\Device\\SystemRoot\\Device\LanmanRedirector\
Source: Sysmon64.exe	Binary string: \Device\SysmonPipeFilter
Source: Sysmon64.exe	Binary string: \Device\
Source: Sysmon64.exe	Binary string: \Device\Mailslot
Source: Sysmon64.exe	Binary string: Unable to attach to \device\namedpipe

Source: classification engine

Classification label: sus36.evad.winEXE@10/2@0/0

Source: C:\Users\user\Desktop\Sysmon64.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03

Source: Sysmon64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\sc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Sysmon64.exe

String found in binary or memory: The service logs events immediately and the driver installs as a boot-start driver to capture activity from early in the boot that the service will write to the event log when it starts.

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" >> C:\servicereg.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe"
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c sc start CNVkE >> C:\servicestart.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start CNVkE
Source: unknown	Process created: C:\Users\user\Desktop\Sysmon64.exe C:\Users\user\Desktop\Sysmon64.exe
Source: unknown	Process created: C:\Windows\System32\wbem\unsecapp.exe C:\Windows\system32\wbem\unsecapp.exe -Embedding
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start CNVkE	Jump to behavior

Source: C:\Users\user\Desktop\Sysmon64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Sysmon64.exe

Static PE information: certificate valid

Source: initial sample

Static PE information: Valid certificate with Microsoft Issuer

Source: Sysmon64.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Sysmon64.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Sysmon64.exe

Static file information: File size 3925928 > 1048576

Source: Sysmon64.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1b3a00
Source: Sysmon64.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x119400

Source: Sysmon64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Sysmon64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Sysmon64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Sysmon64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Sysmon64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Sysmon64.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Sysmon64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Sysmon64.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\agent\1\s\sys\x64\Public_Release\sysmondrv.pdb source: Sysmon64.exe
Source:	Binary string: C:\agent\1\s\exe\x64\Public_Release\Sysmon64.pdb source: Sysmon64.exe

Source: Sysmon64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Sysmon64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Sysmon64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Sysmon64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Sysmon64.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Sysmon64.exe

Static PE information: section name: _RDATA

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe"

Source: C:\Users\user\Desktop\Sysmon64.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\Sysmon64.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_6-22023

Source: C:\Users\user\Desktop\Sysmon64.exe

API coverage: 8.1 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: Sysmon64.exe, 00000006.00000002.1358568852.0000022BA2F2A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllff

Source: C:\Users\user\Desktop\Sysmon64.exe

Code function: 6_2_00007FF7874FA3F0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

6_2_00007FF7874FA3F0

Source: C:\Users\user\Desktop\Sysmon64.exe

Code function: 6_2_00007FF7874FA3F0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

6_2_00007FF7874FA3F0

Source: C:\Users\user\Desktop\Sysmon64.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF78753ABD0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		6_2_00007FF78753ABD0
Source: C:\Users\user\Desktop\Sysmon64.exe	Code function: 6_2_00007FF7874C7140 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		6_2_00007FF7874C7140

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start CNVkE			Jump to behavior

Source: C:\Users\user\Desktop\Sysmon64.exe

Code function: 6_2_00007FF7874C8878 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00007FF7874C8878

Source: C:\Users\user\Desktop\Sysmon64.exe

Code function: 6_2_00007FF7873C1F30 GetVersionExW,

6_2_00007FF7873C1F30

Source: C:\Users\user\Desktop\Sysmon64.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	11 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	4 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Sysmon64.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://relaxng.org/ns/structure/1.0	0%	URL Reputation	safe
https://www.sysinternals.com0	0%	Avira URL Cloud	safe
http://relaxng.org/ns/structure/1.0allocating	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://relaxng.org/ns/structure/1.0	Sysmon64.exe	false	URL Reputation: safe	unknown
https://www.sysinternals.com0	Sysmon64.exe	false	Avira URL Cloud: safe	unknown
http://relaxng.org/ns/structure/1.0allocating	Sysmon64.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1397930
Start date and time:	2024-02-23 20:50:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run as Windows Service
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Sysmon64.exe
Detection:	SUS
Classification:	sus36.evad.winEXE@10/2@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: Sysmon64.exe

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	28
Entropy (8bit):	3.678439190827718
Encrypted:	false
SSDEEP:	3:4A4AnXjzSv:4HAnXjg
MD5:	A8F4D690C5BDE96AD275C7D4ABE0E3D3
SHA1:	7C62C96EFD2CA4F3C3EBF0B24C9B5B4C04A4570A
SHA-256:	596CCC911C1772735AAC6A6B756A76D3D55BCECD006B980CF147090B2243FA7B
SHA-512:	A875EBE3C5CDF222FF9D08576F4D996AF827A1C86B3E758CE23F6B33530D512A82CE8E39E519837512080C6212A0A19B3385809BE5F5001C4E488DD79550B852
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	[SC] CreateService SUCCESS..

C:\servicestart.log

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	421
Entropy (8bit):	3.504739706684328
Encrypted:	false
SSDEEP:	6:lg3D/8F1ggVKBRjGxVVLvH2s/u8qLLFmLaZnsHgm66//V+Nm5CWfq:lgAMgV0qVbH2suZLQqOVKm5Ckq
MD5:	F4E84FF92F9469A5F8F6DC3A45D19127
SHA1:	7F9FDAD2D5837859859730A881F7744C16C0C7B7
SHA-256:	5ED4699AB9E51523FFDAFEF74D4F84AEB03FE48616098F0582178138F93F0B08
SHA-512:	C1B3692F3EC62DDF6213DC81DF67E0FC3D97C22F56B4E6E234341B084A00AC46E427F9B1239C6629E85747CA5B87E956F085899EC2A05DD65ACD02F57AAFC9C8
Malicious:	false
Reputation:	low
Preview:	..SERVICE_NAME: CNVkE .. TYPE : 10 WIN32_OWN_PROCESS .. STATE : 2 START_PENDING .. (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN).. WIN32_EXIT_CODE : 0 (0x0).. SERVICE_EXIT_CODE : 0 (0x0).. CHECKPOINT : 0x0.. WAIT_HINT : 0x7d0.. PID : 7944.. FLAGS : ..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.8648590295705905
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Sysmon64.exe
File size:	3'925'928 bytes
MD5:	dbb70df036b6811f1328bb06bf8671fe
SHA1:	52ac1d0b90182e7f4c6667026ecbea5bd82974b8
SHA256:	373061d73b6743651050749dba958090a954939109fc51dd27e548b0d71cd75c
SHA512:	d0f492c92985704ec4a0f0c65003e4ce0cea38c7804814ba11ae630c0914be8cd0be64ee91568de4bacfddde07a10d23ed3af5dd0537376484b7baa42c1070cc
SSDEEP:	49152:xp/QdKTO7CsQCR0or2t+RR38MZOCZ0M9v5rgtqDTmnu:cWTqi+OCDsamu
TLSH:	3006720267FC0458F6F36B789B3A8841DA37BC660B34E59F01581D5D0B73A928DB6B72
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........T...5...5...5...^...5...^..L5...^...5...Z...5...@...5...@...5...@...5...^...5..6@...5..5@...5...^...5...5...4..1@...5..1@...5.

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140108150
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x627B1AC2 [Wed May 11 02:09:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	92ac089e4b4a4fa0eda7b74b4ba55881

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	02/09/2021 20:32:59 01/09/2022 20:32:59
Subject Chain	CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	D15B2B9631F8B37BA8D83A5AE528A8BB
Thumbprint SHA-1:	8740DF4ACB749640AD318E4BE842F72EC651AD80
Thumbprint SHA-256:	2EB421FBB33BBF9C8F6B58C754B0405F40E02CB6328936AAE39DB7A24880EA21
Serial:	33000002528B33AAF895F339DB000000000252

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F3080E89754h
dec eax
add esp, 28h
jmp 00007F3080E88E17h
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F3080E89042h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F3080E89045h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F3080E8903Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F3080E87F76h
int3
and dword ptr [001842E9h], 00000000h
ret
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
lea ebp, dword ptr [esp-000004C0h]
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [000AD36Eh]
test eax, eax
je 00007F3080E89036h
mov ecx, ebx
int 29h
mov ecx, 00000003h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x284220	0x168	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a9000	0x1193d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x291000	0x16638	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3bc000	0x27a8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3c3000	0x1984	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x25d850	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x25da10	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x25d8c0	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b5000	0xb28	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1b39bc	0x1b3a00	446dc4c3d5be6936c4d3d3575db79178	False	0.44435471215925393	data	6.448278764027017	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b5000	0xd180e	0xd1a00	2678644501720baa3cc241aa80e6f52b	False	0.19737859645199762	data	4.794316875907376	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x287000	0x9788	0x5000	a0dd407eeb6a51a78b45acb59f6245c3	False	0.204150390625	DOS executable (block device driver \377\3)	3.7686805630056863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x291000	0x16638	0x16800	b3e8e8659e2f026794c00e599f0b26ab	False	0.48553602430555554	data	6.246519866550825	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x2a8000	0xf4	0x200	ae7a6011637c8a816ca96b93a156a46f	False	0.31640625	data	2.460670788995041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2a9000	0x1193d8	0x119400	983b5f783759ee3433e65c72dad8279d	False	0.11414149305555556	data	4.185874405563766	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3c3000	0x1984	0x1a00	a953ec41a7d91f6580402d9a4614777d	False	0.35697115384615385	data	5.417177664326332	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BINRES	0x39a6c8	0x27b90	PE32+ executable (DLL) (native) x86-64, for MS Windows	English	United States	0.46228734388828796
WEVT_TEMPLATE	0x2af818	0x89a2	data	English	United States	0.14951467332690016
XML	0x2ced48	0xcb97a	exported SGML document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators	English	United States	0.04946793074585629
RT_MESSAGETABLE	0x2a9270	0x65a4	data	English	United States	0.10288239815526518
RT_VERSION	0x2b81c0	0x400	data	English	United States	0.458984375
RT_HTML	0x2b85c0	0x16784	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (399), with CRLF line terminators	English	United States	0.06426832978399756
RT_MANIFEST	0x3c2258	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
tdh.dll	TdhGetEventInformation, TdhGetEventMapInformation
USERENV.dll	ExpandEnvironmentStringsForUserW
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeExW, GetFileVersionInfoExW
NETAPI32.dll	NetServerEnum, NetApiBufferFree
WS2_32.dll	ntohs, gethostbyname, WSAStartup, inet_ntoa, gethostname, htons, getnameinfo
MPR.dll	WNetCancelConnection2W, WNetAddConnection2W
WTSAPI32.dll	WTSQuerySessionInformationW, WTSFreeMemory, WTSQueryUserToken, WTSEnumerateSessionsW
ole32.dll	CoCreateInstance, CoUninitialize, CoInitializeEx, IIDFromString, StringFromGUID2, CoSetProxyBlanket, CoInitializeSecurity
KERNEL32.dll	RaiseException, DecodePointer, AcquireSRWLockShared, DeviceIoControl, OpenProcess, CreateToolhelp32Snapshot, Module32FirstW, K32EnumProcesses, SystemTimeToFileTime, GetSystemTime, SizeofResource, LockResource, LoadResource, FindResourceW, CreateDirectoryW, GetConsoleScreenBufferInfo, lstrlenW, RemoveDirectoryW, GetTempPathW, CreateFileW, GetFileAttributesW, GetSystemDirectoryW, Process32NextW, SetEvent, DeleteFileW, Process32FirstW, GetSystemInfo, VerSetConditionMask, GetComputerNameW, CreateProcessW, VerifyVersionInfoW, GetSystemTimeAsFileTime, GetTickCount, ConnectNamedPipe, GetExitCodeProcess, ExpandEnvironmentStringsW, ProcessIdToSessionId, ExitProcess, GetCurrentProcessId, CopyFileW, SetConsoleCtrlHandler, GetFileSizeEx, WaitForMultipleObjects, SetThreadPriority, UnmapViewOfFile, CreateEventW, GetOverlappedResult, CreateFileMappingW, MapViewOfFile, QueryDosDeviceW, GetFullPathNameW, WriteFile, AcquireSRWLockExclusive, GetWindowsDirectoryW, GetTempFileNameW, K32GetMappedFileNameW, QueryPerformanceFrequency, ResetEvent, QueryPerformanceCounter, CreateThread, FindFirstFileW, FindNextFileW, FindClose, LoadLibraryW, K32GetModuleBaseNameW, WideCharToMultiByte, TerminateProcess, SetFileAttributesW, GlobalSize, FreeConsole, GlobalLock, GlobalUnlock, GetEnabledXStateFeatures, GetDriveTypeW, FreeLibraryAndExitThread, ResumeThread, ExitThread, GetConsoleCP, GetModuleHandleExW, SetStdHandle, TlsFree, InterlockedFlushSList, InterlockedPushEntrySList, RtlPcToFileHeader, RtlUnwindEx, OutputDebugStringW, GetCPInfo, CompareStringEx, GetLocaleInfoEx, LCMapStringEx, EncodePointer, GetStringTypeW, FormatMessageA, InitializeSListHead, GetStartupInfoW, IsDebuggerPresent, WaitForSingleObjectEx, InitializeCriticalSectionAndSpinCount, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlUnwind, ReleaseSRWLockExclusive, InitializeCriticalSectionEx, InitializeSRWLock, GetLastError, FormatMessageW, ReleaseSRWLockShared, GetDateFormatW, FreeLibrary, GetTimeFormatW, FileTimeToSystemTime, MultiByteToWideChar, TlsGetValue, DeleteCriticalSection, CloseHandle, TlsAlloc, GetCurrentThread, Sleep, DuplicateHandle, ReleaseMutex, GetCurrentThreadId, WaitForSingleObject, CreateMutexW, InitializeCriticalSection, LeaveCriticalSection, GetCurrentProcess, EnterCriticalSection, TlsSetValue, GetModuleHandleW, LocalFree, GetProcAddress, LocalAlloc, GetStdHandle, GetCommandLineW, LoadLibraryExW, GetVersionExW, SetLastError, GetFileType, GetModuleFileNameW, GetFileInformationByHandle, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, GetCommandLineA, ReadFile, GetConsoleMode, ReadConsoleW, GetConsoleOutputCP, HeapFree, HeapAlloc, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, SetConsoleMode, GetNumberOfConsoleInputEvents, ReadConsoleInputW, PeekConsoleInputA, SetFilePointerEx, HeapReAlloc, SetCurrentDirectoryW, GetCurrentDirectoryW, HeapSize, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, GetProcessHeap, GetTimeZoneInformation, WriteConsoleW, SetEndOfFile, GetLogicalDriveStringsW
USER32.dll	ChangeClipboardChain, CloseClipboard, RegisterClassW, TranslateMessage, GetClipboardData, GetClipboardOwner, MessageBoxW, UnregisterClassW, InflateRect, OpenClipboard, EndDialog, SetWindowTextW, DialogBoxIndirectParamW, LoadCursorW, SetCursor, GetDlgItem, GetSysColorBrush, SetClipboardViewer, GetMessageW, GetWindowThreadProcessId, GetPriorityClipboardFormat, DispatchMessageW, SendMessageW, CreateWindowExW, GetClipboardSequenceNumber, DefWindowProcW
GDI32.dll	StartPage, EndDoc, GetDeviceCaps, SetMapMode, StartDocW, EndPage
COMDLG32.dll	PrintDlgW
ADVAPI32.dll	RevertToSelf, RegQueryValueExW, RegOpenKeyW, RegCreateKeyW, RegOpenKeyExW, RegCloseKey, SetFileSecurityW, CryptAcquireContextW, CryptGenRandom, CreateProcessAsUserW, ConvertStringSecurityDescriptorToSecurityDescriptorW, DuplicateTokenEx, CryptReleaseContext, DeregisterEventSource, GetSidSubAuthorityCount, GetSidSubAuthority, CopySid, RegisterEventSourceW, RegNotifyChangeKeyValue, RegisterServiceCtrlHandlerExW, SetSecurityDescriptorDacl, RegDeleteKeyW, SetServiceStatus, ChangeServiceConfig2W, SetEntriesInAclW, RegCreateKeyExW, InitializeSecurityDescriptor, RegGetValueW, StartServiceCtrlDispatcherW, QueryServiceConfigW, RegDeleteValueW, LookupAccountSidW, LookupAccountNameW, LookupPrivilegeValueW, AdjustTokenPrivileges, ConvertSidToStringSidW, CreateServiceW, QueryServiceStatus, EqualSid, CloseServiceHandle, OpenSCManagerW, AllocateAndInitializeSid, DeleteService, ControlService, ImpersonateLoggedOnUser, LogonUserW, OpenProcessToken, FreeSid, StartServiceW, RegConnectRegistryW, OpenServiceW, GetTokenInformation, GetLengthSid, GetSecurityDescriptorLength, ReportEventW, StartTraceW, ProcessTrace, CloseTrace, ControlTraceW, OpenTraceW, EnableTraceEx2, RegSetValueExW
OLEAUT32.dll	SafeArrayGetElement, VariantChangeType, VariantClear, VariantInit, SysAllocStringByteLen, SysStringLen, SafeArrayUnaccessData, SafeArrayDestroy, SafeArrayGetLBound, SafeArrayGetUBound, GetErrorInfo, SetErrorInfo, SysStringByteLen, SafeArrayAccessData, CreateErrorInfo, SysAllocString, SysFreeString, SysAllocStringLen
CRYPT32.dll	CertDuplicateCertificateContext, CryptFindOIDInfo, CertGetNameStringW, CertGetCertificateChain
Secur32.dll	LsaGetLogonSessionData, LsaFreeReturnBuffer
RPCRT4.dll	RpcServerUseProtseqEpW, NdrServerCallAll, NdrClientCall3, RpcServerRegisterIfEx, RpcStringFreeW, I_RpcBindingInqLocalClientPID, RpcBindingFromStringBindingW, RpcStringBindingComposeW, RpcServerUnregisterIf, NdrServerCall2

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

• cmd.exe
• conhost.exe
• sc.exe
• cmd.exe
• conhost.exe
• sc.exe
• Sysmon64.exe
• unsecapp.exe

Click to jump to process

Memory Usage

• cmd.exe
• conhost.exe
• sc.exe
• cmd.exe
• conhost.exe
• sc.exe
• Sysmon64.exe
• unsecapp.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Click to jump to process

Target ID:	0
Start time:	20:51:04
Start date:	23/02/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe" >> C:\servicereg.log 2>&1
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:51:04
Start date:	23/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:51:04
Start date:	23/02/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc create CNVkE binpath= "C:\Users\user\Desktop\Sysmon64.exe"
Imagebase:	0x980000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:51:05
Start date:	23/02/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c sc start CNVkE >> C:\servicestart.log 2>&1
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:51:05
Start date:	23/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	20:51:05
Start date:	23/02/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc start CNVkE
Imagebase:	0x980000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:51:05
Start date:	23/02/2024
Path:	C:\Users\user\Desktop\Sysmon64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Sysmon64.exe
Imagebase:	0x7ff7873c0000
File size:	3'925'928 bytes
MD5 hash:	DBB70DF036B6811F1328BB06BF8671FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:51:06
Start date:	23/02/2024
Path:	C:\Windows\System32\wbem\unsecapp.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\unsecapp.exe -Embedding
Imagebase:	0x7ff744710000
File size:	54'272 bytes
MD5 hash:	9B782B1E1D7A2C28302755F963EAC907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.7%
Total number of Nodes:	275
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF7873C1760 Relevance: 28.2, APIs: 6, Strings: 10, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE ref: 00007FF7873C1894
GetModuleFileNameW.KERNEL32 ref: 00007FF7873C1901
GetFileVersionInfoSizeW.KERNELBASE ref: 00007FF7873C1911
GetFileVersionInfoW.KERNELBASE ref: 00007FF7873C1930
GetStdHandle.KERNEL32 ref: 00007FF7873C1995
GetFileType.KERNEL32 ref: 00007FF7873C199E

Part of subcall function 00007FF787522054: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787522071

Strings

%s v%s - %s%s%s, xrefs: 00007FF7873C19B6, 00007FF7873C19F7
FileDescription, xrefs: 00007FF7873C1957
LegalCopyright, xrefs: 00007FF7873C1969
FileVersion, xrefs: 00007FF7873C1945
-accepteula, xrefs: 00007FF7873C185A
/nobanner, xrefs: 00007FF7873C17B8
-nobanner, xrefs: 00007FF7873C17CB
CompanyName, xrefs: 00007FF7873C197B
InternalName, xrefs: 00007FF7873C1936
/accepteula, xrefs: 00007FF7873C1843

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: File$InfoTypeVersion$HandleModuleNameSize_invalid_parameter_noinfo
String ID: %s v%s - %s%s%s$-accepteula$-nobanner$/accepteula$/nobanner$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright
API String ID: 2281649930-2075756908
Opcode ID: 3ccc81dfc057be7565abd70e9777c02c00c592ac5447d7527f099a2fa1c642fd
Instruction ID: 673dce24835be299905d3bc8801bfdf361e35747ef0bb0a8536ae30bc164a8d8
Opcode Fuzzy Hash: 3ccc81dfc057be7565abd70e9777c02c00c592ac5447d7527f099a2fa1c642fd
Instruction Fuzzy Hash: 39819165A5878286EB14FB51E9452B9E3A1BF84B90FE44039DA4F47B92DF3CE443C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873E56A0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 113
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873E56E7
GetCurrentThreadId.KERNEL32 ref: 00007FF7873E570F

Part of subcall function 00007FF7873F8400: TlsGetValue.KERNEL32 ref: 00007FF7873F840F
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F

InitializeCriticalSection.KERNEL32(?,?,?,?,00007FF7873E36AE), ref: 00007FF7873E574A
DeleteCriticalSection.KERNEL32(?,?,?,?,00007FF7873E36AE), ref: 00007FF7873E576A

Part of subcall function 00007FF7873F87D0: TlsAlloc.KERNEL32(?,?,?,?,00007FF7873CAE69), ref: 00007FF7873F87F1
Part of subcall function 00007FF7873F87D0: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F87FD

EnterCriticalSection.KERNEL32(?,?,?,?,00007FF7873E36AE), ref: 00007FF7873E577F
CreateMutexW.KERNELBASE(?,?,?,?,00007FF7873E36AE), ref: 00007FF7873E57B5
GetCurrentThreadId.KERNEL32 ref: 00007FF7873E57CA
GetCurrentThreadId.KERNEL32 ref: 00007FF7873E57F9
GetCurrentThreadId.KERNEL32 ref: 00007FF7873E5822
LeaveCriticalSection.KERNEL32(?,?,?,?,00007FF7873E36AE), ref: 00007FF7873E58AA

Strings

xmlGlobalInitMutexLock: out of memory, xrefs: 00007FF7873E5720, 00007FF7873E5736

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread$CriticalSection$AllocCreateDeleteEnterInitializeLeaveMutexValue
String ID: xmlGlobalInitMutexLock: out of memory
API String ID: 1695213902-1530804309
Opcode ID: bcadb6ae93e9033c280cbd39ff5508c125ef861292225ef5489397a39ba8f1d9
Instruction ID: dcb96ca7102f6f7c4fff1caa91416fdbb8ea67d5b547f25de006444934f6b9c5
Opcode Fuzzy Hash: bcadb6ae93e9033c280cbd39ff5508c125ef861292225ef5489397a39ba8f1d9
Instruction Fuzzy Hash: F8512971E89A8786FE50FB10D845378A3A2BF41B94FF04039D50F06AA1DF2CA587C632

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C3460 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7873C33C0: RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF7873C34B5), ref: 00007FF7873C33E2
Part of subcall function 00007FF7873C33C0: RegQueryValueExW.ADVAPI32 ref: 00007FF7873C341F
Part of subcall function 00007FF7873C33C0: RegCloseKey.ADVAPI32 ref: 00007FF7873C342C

RegOpenKeyExW.KERNELBASE ref: 00007FF7873C3502
RegQueryValueExW.ADVAPI32 ref: 00007FF7873C3542
RegCloseKey.ADVAPI32 ref: 00007FF7873C354F

Strings

System Monitor, xrefs: 00007FF7873C3479
%s\%s, xrefs: 00007FF7873C3491
Software\Sysinternals, xrefs: 00007FF7873C3485, 00007FF7873C34A2, 00007FF7873C34BD
EulaAccepted, xrefs: 00007FF7873C351B

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: %s\%s$EulaAccepted$Software\Sysinternals$System Monitor
API String ID: 3677997916-2404948253
Opcode ID: 380eb7a0a6d6afbe527a0b89254ac627e43f9efc555af19f5538d89fd5f33fad
Instruction ID: 0785abc046fa0c7b9df7e8941bad765080607de66f0bfb2dc5f5afa0772dfada
Opcode Fuzzy Hash: 380eb7a0a6d6afbe527a0b89254ac627e43f9efc555af19f5538d89fd5f33fad
Instruction Fuzzy Hash: 42314471A5CB8191EB50EB10E4447A6B3A0FB84764FD01235EA8F43B99DF3CD146DB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78752460C Relevance: 9.1, APIs: 6, Instructions: 56
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF787524628
CreateThread.KERNELBASE ref: 00007FF78752466C
GetLastError.KERNEL32 ref: 00007FF78752467A
CloseHandle.KERNEL32 ref: 00007FF787524699
FreeLibrary.KERNEL32 ref: 00007FF7875246A8
ResumeThread.KERNELBASE ref: 00007FF7875246CB

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: f4f04a94952ec9d5ee23abf7e405d8d08d4a5e84ec13bb1696ce4217a8ad4bee
Instruction ID: 18c328aac8cec0e6f6bfe8e734470ce29b67761308d4fcda55e1444390083a68
Opcode Fuzzy Hash: f4f04a94952ec9d5ee23abf7e405d8d08d4a5e84ec13bb1696ce4217a8ad4bee
Instruction Fuzzy Hash: 6C216F61A99B8246EF14FB60E404278A291BF44BA4FF40734DA3F863D1DF3CE806C624

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C3830 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VerQueryValueW.KERNELBASE ref: 00007FF7873C387A
VerQueryValueW.VERSION ref: 00007FF7873C38BE

Strings

\VarFileInfo\Translation, xrefs: 00007FF7873C386B
\StringFileInfo\%04X%04X\%s, xrefs: 00007FF7873C3885

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: QueryValue
String ID: \StringFileInfo\%04X%04X\%s$\VarFileInfo\Translation
API String ID: 3660427363-755172729
Opcode ID: 57cc24774d0a32f36b5e0b39b2f80a1e35cf3aab8a7005dfc59e5376bd82053b
Instruction ID: 07fd516d374057c747f798f0d2f7ba1427165b006479d37e9b9c965c69c53b52
Opcode Fuzzy Hash: 57cc24774d0a32f36b5e0b39b2f80a1e35cf3aab8a7005dfc59e5376bd82053b
Instruction Fuzzy Hash: E4113062618B8581DB50DB55F8843AAB361FBC8B95F944032EB8E43B28DF3CC155CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787411C50 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?,?,?,00007FF7873E5844,?,?,?,?,00007FF7873E36AE), ref: 00007FF787411C8F

Strings

XML_MEM_BREAKPOINT, xrefs: 00007FF787411C98
XML_MEM_TRACE, xrefs: 00007FF787411CC4
%ud, xrefs: 00007FF787411CB8

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CreateMutex
String ID: %ud$XML_MEM_BREAKPOINT$XML_MEM_TRACE
API String ID: 1964310414-2307360426
Opcode ID: ea0eef1bfb83916a2fc019b946aa80ed0743e135317c2bff8cf9fb799e75e737
Instruction ID: 5ece1419e9018798f4f3770b6a0dbff59e3810c528f528d2eece0064ad3045a4
Opcode Fuzzy Hash: ea0eef1bfb83916a2fc019b946aa80ed0743e135317c2bff8cf9fb799e75e737
Instruction Fuzzy Hash: 2C011B24E99A4281FB15BB25E8512B5B2927F44340FF44236D50F473A6EF6CE546C270

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C33C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,?,00007FF7873C34B5), ref: 00007FF7873C33E2
RegQueryValueExW.ADVAPI32 ref: 00007FF7873C341F
RegCloseKey.ADVAPI32 ref: 00007FF7873C342C

Strings

EulaAccepted, xrefs: 00007FF7873C33FB

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: EulaAccepted
API String ID: 3677997916-921354838
Opcode ID: 72ed33bf021fb8c596a286bdf7b6bd4e30994008709b55f99afafc4d6c7b669f
Instruction ID: d95e47ee1b0b900bb6eb1b4c0d738f0473244fd098baee1bfde579b66a4695bf
Opcode Fuzzy Hash: 72ed33bf021fb8c596a286bdf7b6bd4e30994008709b55f99afafc4d6c7b669f
Instruction Fuzzy Hash: 6A018C32A18B8287EB50AB11F840A5AB3A0FB84794F901135EA8E43F18EF3CE545CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787552C78 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FF787558E01,?,?,00000000,00007FF7875418EB,?,?,?,00007FF78754614F,?,?,?,00007FF787545F09), ref: 00007FF787552CB6

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 983c8f18d9730b8f715ce8d393a003e851784625f4d648167007a789e2ea83ef
Instruction ID: 7b7366de5c8f3f6e948377dc66f7d23184d6feaee132ccf34b85ecc0a0021990
Opcode Fuzzy Hash: 983c8f18d9730b8f715ce8d393a003e851784625f4d648167007a789e2ea83ef
Instruction Fuzzy Hash: 07F03A81E9C20261FB587761694267491806F847A0FF80A30E92FCA3C2DE6CA482C630

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7873C2920 Relevance: 72.1, APIs: 18, Strings: 23, Instructions: 388
registrymemorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyW.ADVAPI32 ref: 00007FF7873C29B5
RegQueryValueExW.ADVAPI32 ref: 00007FF7873C29EB
RegCloseKey.ADVAPI32 ref: 00007FF7873C2A13
RegCloseKey.ADVAPI32 ref: 00007FF7873C2A7D
RegOpenKeyW.ADVAPI32 ref: 00007FF7873C2AAB
RegQueryValueExW.ADVAPI32 ref: 00007FF7873C2ADD
RegCloseKey.ADVAPI32 ref: 00007FF7873C2AFE
GetStdHandle.KERNEL32 ref: 00007FF7873C2B09
GetFileType.KERNEL32 ref: 00007FF7873C2B12
LocalAlloc.KERNEL32 ref: 00007FF7873C2B3B
DialogBoxIndirectParamW.USER32 ref: 00007FF7873C2DD4
LocalFree.KERNEL32 ref: 00007FF7873C2DE1

Part of subcall function 00007FF787522054: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787522071

RegCreateKeyW.ADVAPI32 ref: 00007FF7873C2E00
RegSetValueExW.ADVAPI32 ref: 00007FF7873C2E31
RegCloseKey.ADVAPI32 ref: 00007FF7873C2E3C

Part of subcall function 00007FF7873C3460: RegOpenKeyExW.KERNELBASE ref: 00007FF7873C3502
Part of subcall function 00007FF7873C3460: RegQueryValueExW.ADVAPI32 ref: 00007FF7873C3542
Part of subcall function 00007FF7873C3460: RegCloseKey.ADVAPI32 ref: 00007FF7873C354F

RegCloseKey.ADVAPI32 ref: 00007FF7873C2E77
GetProcAddress.KERNEL32 ref: 00007FF7873C2EB1
GetCommandLineW.KERNEL32 ref: 00007FF7873C2ECC

Strings

NanoServer, xrefs: 00007FF7873C2AD1
Accept Eula (Y/N)?, xrefs: 00007FF7873C2A30
You can also use the /accepteula command-line switch to accept the EULA., xrefs: 00007FF7873C2BD9
-accepteula, xrefs: 00007FF7873C2F1B
Software\Microsoft\windows nt\currentversion, xrefs: 00007FF7873C299B
SYSINTERNALS SOFTWARE LICENSE TERMSThese license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microso, xrefs: 00007FF7873C2A19
&Print, xrefs: 00007FF7873C2CF3
Riched32.dll, xrefs: 00007FF7873C2B41
%c, xrefs: 00007FF7873C2A44
Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels, xrefs: 00007FF7873C2A8D
ProductName, xrefs: 00007FF7873C29DF
/accepteula, xrefs: 00007FF7873C2F08
EulaAccepted, xrefs: 00007FF7873C2E1C
RICHEDIT, xrefs: 00007FF7873C2D69
MS Shell Dlg, xrefs: 00007FF7873C2B95
&Agree, xrefs: 00007FF7873C2C23
System Monitor, xrefs: 00007FF7873C2950, 00007FF7873C2DB5
&Decline, xrefs: 00007FF7873C2C7D
License Agreement, xrefs: 00007FF7873C2B50
CommandLineToArgvW, xrefs: 00007FF7873C2EAA
iotuap, xrefs: 00007FF7873C29FE
Software\Sysinternals\%s, xrefs: 00007FF7873C2959
Shell32.dll, xrefs: 00007FF7873C2E99

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: Close$Value$OpenQuery$Local$AddressAllocCommandCreateDialogFileFreeHandleIndirectLineParamProcType_invalid_parameter_noinfo
String ID: %c$&Agree$&Decline$&Print$-accepteula$/accepteula$Accept Eula (Y/N)?$CommandLineToArgvW$EulaAccepted$License Agreement$MS Shell Dlg$NanoServer$ProductName$RICHEDIT$Riched32.dll$SYSINTERNALS SOFTWARE LICENSE TERMSThese license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microso$Shell32.dll$Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels$Software\Microsoft\windows nt\currentversion$Software\Sysinternals\%s$System Monitor$You can also use the /accepteula command-line switch to accept the EULA.$iotuap
API String ID: 3918631088-2397820593
Opcode ID: b8534927536c01f52f1b808f7ab5d72032ef3f9774a7e31bca6668a8727f5151
Instruction ID: a7bf1e2a61aa11b6faf57067d8a12454f4e609b9f0ca50915c7af93a6e06a4a1
Opcode Fuzzy Hash: b8534927536c01f52f1b808f7ab5d72032ef3f9774a7e31bca6668a8727f5151
Instruction Fuzzy Hash: C402A47265878286DB10EF14E4402BAB3B0FB84BA4FE04236DB5E57AA4DF7CD54AC711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C22A0 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 149
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7873C22FB
PrintDlgW.COMDLG32 ref: 00007FF7873C2313
LoadCursorW.USER32 ref: 00007FF7873C2358
SetCursor.USER32 ref: 00007FF7873C2361
GetDeviceCaps.GDI32 ref: 00007FF7873C2374
GetDeviceCaps.GDI32 ref: 00007FF7873C2387
GetDeviceCaps.GDI32 ref: 00007FF7873C2399
GetDeviceCaps.GDI32 ref: 00007FF7873C23AB
SetMapMode.GDI32 ref: 00007FF7873C23D3
InflateRect.USER32 ref: 00007FF7873C241B
StartDocW.GDI32 ref: 00007FF7873C2447
SendMessageW.USER32 ref: 00007FF7873C245A
StartPage.GDI32 ref: 00007FF7873C2468
SendMessageW.USER32 ref: 00007FF7873C247E
EndPage.GDI32 ref: 00007FF7873C248C
StartPage.GDI32 ref: 00007FF7873C24BF
SendMessageW.USER32 ref: 00007FF7873C24D7
EndPage.GDI32 ref: 00007FF7873C24E4
SendMessageW.USER32 ref: 00007FF7873C24FC
EndDoc.GDI32 ref: 00007FF7873C2507
SetCursor.USER32 ref: 00007FF7873C2510

Strings

Sysinternals License, xrefs: 00007FF7873C2426
x, xrefs: 00007FF7873C22DB

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CapsDeviceMessagePageSend$CursorStart$HandleInflateLoadModeModulePrintRect
String ID: Sysinternals License$x
API String ID: 2115769042-2333083431
Opcode ID: 817dd3d3b5faff4e33389c2e5aee8211649ac3e1af66e5274e9013bcecd06c33
Instruction ID: 719f7147ace1f1ca9d2629d44ae6f2e26d9d9144c94b3cda85e82f99956e4165
Opcode Fuzzy Hash: 817dd3d3b5faff4e33389c2e5aee8211649ac3e1af66e5274e9013bcecd06c33
Instruction Fuzzy Hash: AE715B36A18B8186E710DF61E8442AEB370F7C9798FA05225DE8E57B58DF3DD685CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873DFB60 Relevance: 31.1, Strings: 24, Instructions: 1100COMMON

Download Yara Rule

Strings

xml namespace prefix mapped to wrong URI, xrefs: 00007FF7873E02BA
xmlParseStartTag: problem parsing attributes, xrefs: 00007FF7873E0707
attributes construct error, xrefs: 00007FF7873E071B
dictionary allocation failure, xrefs: 00007FF7873E0669
xmlns:%s: Empty XML namespace is not allowed, xrefs: 00007FF7873E0514
xmlns: URI %s is not absolute, xrefs: 00007FF7873E0100
d, xrefs: 00007FF7873E0497
xml namespace URI cannot be the default namespace, xrefs: 00007FF7873DFF54
c, xrefs: 00007FF7873DFF10
redefinition of the xmlns prefix is forbidden, xrefs: 00007FF7873E030A
reuse of the xmlns namespace name is forbidden, xrefs: 00007FF7873E01CB
Namespace prefix %s on %s is not defined, xrefs: 00007FF7873E0D17
http://www.w3.org/2000/xmlns/, xrefs: 00007FF7873E0183, 00007FF7873E0320
Namespaced Attribute %s in '%s' redefined, xrefs: 00007FF7873E0B26
xmlns: '%s' is not a valid URI, xrefs: 00007FF7873DFEAA
gfff, xrefs: 00007FF7873E0E07
xmlns:%s: URI %s is not absolute, xrefs: 00007FF7873E0445
Memory allocation failed : %s, xrefs: 00007FF7873E0682
Unexpected change of input, xrefs: 00007FF7873E0757
Namespace prefix %s for %s on %s is not defined, xrefs: 00007FF7873E0B77
standalone: attribute %s on %s defaulted from external subset, xrefs: 00007FF7873E0AA5
StartTag: invalid element name, xrefs: 00007FF7873DFCAD
xml namespace URI mapped to wrong prefix, xrefs: 00007FF7873E02E0
xmlns:%s: '%s' is not a valid URI, xrefs: 00007FF7873E039B

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: Memory allocation failed : %s$Namespace prefix %s for %s on %s is not defined$Namespace prefix %s on %s is not defined$Namespaced Attribute %s in '%s' redefined$StartTag: invalid element name$Unexpected change of input$attributes construct error$c$d$dictionary allocation failure$gfff$http://www.w3.org/2000/xmlns/$redefinition of the xmlns prefix is forbidden$reuse of the xmlns namespace name is forbidden$standalone: attribute %s on %s defaulted from external subset$xml namespace URI cannot be the default namespace$xml namespace URI mapped to wrong prefix$xml namespace prefix mapped to wrong URI$xmlParseStartTag: problem parsing attributes$xmlns: '%s' is not a valid URI$xmlns: URI %s is not absolute$xmlns:%s: '%s' is not a valid URI$xmlns:%s: Empty XML namespace is not allowed$xmlns:%s: URI %s is not absolute
API String ID: 0-2465701963
Opcode ID: 4e2ea5ac40a3d037b9a069a0149efe1d29642291ef33ec0930be7fc7a8bb9482
Instruction ID: 9e6ef679062eb94dcc63d0e5be4580f647a13d9d50ed8a35d95fa88c3bfb17c4
Opcode Fuzzy Hash: 4e2ea5ac40a3d037b9a069a0149efe1d29642291ef33ec0930be7fc7a8bb9482
Instruction Fuzzy Hash: 22B27333649BC685E760AF15E4403A9B7A4FB84B94FA4413ADA9E47F98CF3CD442CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873D1B70 Relevance: 23.2, APIs: 6, Strings: 7, Instructions: 470
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873D1D9F
GetCurrentThreadId.KERNEL32 ref: 00007FF7873D1DC7
GetCurrentThreadId.KERNEL32 ref: 00007FF7873D1DEF

Part of subcall function 00007FF7873F8400: TlsGetValue.KERNEL32 ref: 00007FF7873F840F
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F

Part of subcall function 00007FF7873F8400: ReleaseMutex.KERNEL32 ref: 00007FF7873F86A6
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F86C3

Part of subcall function 00007FF7873F8400: CreateMutexW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7873CAE85), ref: 00007FF7873F84D3
Part of subcall function 00007FF7873F8400: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7873CAE85), ref: 00007FF7873F84EB

Strings

Detected an entity reference loop, xrefs: 00007FF7873D1C01
Y, xrefs: 00007FF7873D1C5B
predefined entity has no content, xrefs: 00007FF7873D2300
not validating will not read content for PE entity %s, xrefs: 00007FF7873D2132
String decoding PE Reference: %.30s, xrefs: 00007FF7873D20BD
%s, xrefs: 00007FF7873D1C1D
String decoding Entity Reference: %.30s, xrefs: 00007FF7873D1E14

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread$Mutex$CreateObjectReleaseSingleValueWait
String ID: %s$Detected an entity reference loop$String decoding Entity Reference: %.30s$String decoding PE Reference: %.30s$Y$not validating will not read content for PE entity %s$predefined entity has no content
API String ID: 2259964185-1842065348
Opcode ID: da8702a973b8fd27d9df8c0aae266b3d33484292a40c548091de3d58f9aa4244
Instruction ID: a0cff00da31f47c93298d501c201439440c523eb67e46daf1300050215312591
Opcode Fuzzy Hash: da8702a973b8fd27d9df8c0aae266b3d33484292a40c548091de3d58f9aa4244
Instruction Fuzzy Hash: 0912D621A8C6C285EBA5BB1194883B9AA91BF447C4FE54039D94F17F95DF3CE487C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787409F30 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 262threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF78740A216
GetCurrentThreadId.KERNEL32 ref: 00007FF78740A23E

Part of subcall function 00007FF7873F8400: TlsGetValue.KERNEL32 ref: 00007FF7873F840F
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F

Part of subcall function 00007FF7873F8400: ReleaseMutex.KERNEL32 ref: 00007FF7873F86A6
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F86C3

Strings

xmlAddRef: Reference list insertion failed!, xrefs: 00007FF78740A26F
xmlAddRef: Table creation failed!, xrefs: 00007FF78740A0B3
Memory allocation failed : %s, xrefs: 00007FF78740A001
xmlAddRef: Reference list creation failed!, xrefs: 00007FF78740A161
Cannot initialize memory for new link, xrefs: 00007FF78740A263
malloc failed, xrefs: 00007FF787409FF2

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread$MutexReleaseValue
String ID: Cannot initialize memory for new link$Memory allocation failed : %s$malloc failed$xmlAddRef: Reference list creation failed!$xmlAddRef: Reference list insertion failed!$xmlAddRef: Table creation failed!
API String ID: 2840059946-3576115945
Opcode ID: 045b73912309d244f97d1ca342f6139a67ee07d70027e05b8a3734c6b01b8496
Instruction ID: 9c08271b344aa94def12bc2ae220f777c803db46d29d32f7017831b26b29380b
Opcode Fuzzy Hash: 045b73912309d244f97d1ca342f6139a67ee07d70027e05b8a3734c6b01b8496
Instruction Fuzzy Hash: 48B19032B49B8285EB94AF25E550379F3A0FB84B80FA44035DA8E87B55DF7CE456D310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873DAE60 Relevance: 13.1, Strings: 10, Instructions: 567COMMON

Download Yara Rule

Strings

xmlParseElementChildrenContentDecl : depth %d too deep, use XML_PARSE_HUGE, xrefs: 00007FF7873DAEA4
7, xrefs: 00007FF7873DB61F
xmlParseElementChildrenContentDecl : '%c' expected, xrefs: 00007FF7873DB493
Memory allocation failed : %s, xrefs: 00007FF7873DB40E, 00007FF7873DB568
ContentDecl : ',' '|' or ')' expected, xrefs: 00007FF7873DB5C5
7, xrefs: 00007FF7873DB5CC
malloc failed, xrefs: 00007FF7873DB3FC, 00007FF7873DB556
Element content declaration doesn't start and stop in the same entity, xrefs: 00007FF7873DB3AA
ContentDecl : Name or '(' expected, xrefs: 00007FF7873DAF70, 00007FF7873DB4C2
%s, xrefs: 00007FF7873DAF8C, 00007FF7873DB4DE, 00007FF7873DB5E1

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: %s$7$7$ContentDecl : ',' '|' or ')' expected$ContentDecl : Name or '(' expected$Element content declaration doesn't start and stop in the same entity$Memory allocation failed : %s$malloc failed$xmlParseElementChildrenContentDecl : '%c' expected$xmlParseElementChildrenContentDecl : depth %d too deep, use XML_PARSE_HUGE
API String ID: 2882836952-2217689941
Opcode ID: 1a5bfe4d520b2727bdd329406285862909d135eba6ac080968b328e8d7ee101c
Instruction ID: 516f37b1e0cee45ca0140530f7e5c2b6d186cf4424e89d76e0417706873a2e24
Opcode Fuzzy Hash: 1a5bfe4d520b2727bdd329406285862909d135eba6ac080968b328e8d7ee101c
Instruction Fuzzy Hash: 8242717294878296EB60EF25E484379BBA4FB44B48FA44039DA8E17F95CF3CD442D721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873D8380 Relevance: 12.7, Strings: 10, Instructions: 229COMMON

Download Yara Rule

Strings

Space required after '<!NOTATION', xrefs: 00007FF7873D8480
Space required after the NOTATION name', xrefs: 00007FF7873D863B
'>' required to close NOTATION declaration, xrefs: 00007FF7873D86F5
Notation declaration doesn't start and stop in the same entity, xrefs: 00007FF7873D8685
OITATON!, xrefs: 00007FF7873D86D1
1, xrefs: 00007FF7873D86FC
NOTATION: Name expected here, xrefs: 00007FF7873D84E1
colons are forbidden from notation names '%s', xrefs: 00007FF7873D85B1
%s, xrefs: 00007FF7873D84F6, 00007FF7873D8711
1, xrefs: 00007FF7873D874F

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: %s$'>' required to close NOTATION declaration$1$1$NOTATION: Name expected here$Notation declaration doesn't start and stop in the same entity$OITATON!$Space required after '<!NOTATION'$Space required after the NOTATION name'$colons are forbidden from notation names '%s'
API String ID: 0-2762222150
Opcode ID: 14423f58f61c29379fd758bc3c248154913fbf9f7402afda922c9102d1c548e7
Instruction ID: acf358e17cf527519603ad5021a8b5404beb8b83c078e1fd805ead2bc4662797
Opcode Fuzzy Hash: 14423f58f61c29379fd758bc3c248154913fbf9f7402afda922c9102d1c548e7
Instruction Fuzzy Hash: 52C1937294CBC185E760AF15E4843A9FBE4FB81B94FA44139D68E07A94CF7CE486CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873DCC40 Relevance: 11.9, Strings: 9, Instructions: 645COMMON

Download Yara Rule

Strings

Detected an entity reference loop, xrefs: 00007FF7873DCFE9, 00007FF7873DD2C0
Y, xrefs: 00007FF7873DD31A
#x%X, xrefs: 00007FF7873DCD17
Entity '%s' failed to parse, xrefs: 00007FF7873DD1C5
#%d, xrefs: 00007FF7873DCD0A
invalid entity type found, xrefs: 00007FF7873DCE20
nbktext, xrefs: 00007FF7873DD53D
%s, xrefs: 00007FF7873DD005, 00007FF7873DD2DC
Y, xrefs: 00007FF7873DD2C7

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: #%d$#x%X$%s$Detected an entity reference loop$Entity '%s' failed to parse$Y$Y$invalid entity type found$nbktext
API String ID: 0-3591411778
Opcode ID: 604d2df9044f1b6fac00568d86bdf29cfaf32aae773ffba9fb1152d3b7595164
Instruction ID: 1a2d68cc5c60f43f88810bffc47b9729e825bdb2af2203eafbae98c1210a461d
Opcode Fuzzy Hash: 604d2df9044f1b6fac00568d86bdf29cfaf32aae773ffba9fb1152d3b7595164
Instruction Fuzzy Hash: 2152847265C7C186EB64AF21D484379BBA0FB44B84FA8413ADA8E47F54CF38E452C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873DA8A0 Relevance: 11.6, Strings: 9, Instructions: 327COMMON

Download Yara Rule

Strings

MixedContentDecl : '#PCDATA' expected, xrefs: 00007FF7873DADA6
Memory allocation failed : %s, xrefs: 00007FF7873DAA12
MixedContentDecl : '|' or ')*' expected, xrefs: 00007FF7873DACFF
malloc failed, xrefs: 00007FF7873DAA00
Element content declaration doesn't start and stop in the same entity, xrefs: 00007FF7873DA9D2, 00007FF7873DAC72
E, xrefs: 00007FF7873DAE00
E, xrefs: 00007FF7873DADAD
xmlParseElementMixedContentDecl : Name expected, xrefs: 00007FF7873DACB9
%s, xrefs: 00007FF7873DAD1B, 00007FF7873DADC2

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: %s$E$E$Element content declaration doesn't start and stop in the same entity$Memory allocation failed : %s$MixedContentDecl : '#PCDATA' expected$MixedContentDecl : '|' or ')*' expected$malloc failed$xmlParseElementMixedContentDecl : Name expected
API String ID: 0-2556748111
Opcode ID: 9bf76fa8126e906ebf3fb8c614a8b0c9b67c776d86e4724efe3749f2e2798eb4
Instruction ID: 380db030f639bd03b468c79561b1ffa3c0ac6e9a41dcf534c39fe6c391000f82
Opcode Fuzzy Hash: 9bf76fa8126e906ebf3fb8c614a8b0c9b67c776d86e4724efe3749f2e2798eb4
Instruction Fuzzy Hash: 77F1C172948BC18AE7609F10E584769BBE4FB84B84FA44138DE8E07B95CF3CD852D761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873D5EB0 Relevance: 11.5, Strings: 9, Instructions: 276COMMON

Download Yara Rule

Strings

Unfinished System or Public ID " or ' expected, xrefs: 00007FF7873D613A
+, xrefs: 00007FF7873D6343
Public ID, xrefs: 00007FF7873D61FA
Name too long use XML_PARSE_HUGE option, xrefs: 00007FF7873D620C
+, xrefs: 00007FF7873D62F0
SystemLiteral " or ' expected, xrefs: 00007FF7873D62E9
%s: %s, xrefs: 00007FF7873D621E
2, xrefs: 00007FF7873D6019
%s, xrefs: 00007FF7873D6156, 00007FF7873D6305

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: %s$%s: %s$+$+$2$Name too long use XML_PARSE_HUGE option$Public ID$SystemLiteral " or ' expected$Unfinished System or Public ID " or ' expected
API String ID: 0-1568619456
Opcode ID: 2199bdc79e52f5ef61badbc6bf9a020bfd06743070bcd4f856994e81c2b22385
Instruction ID: a256f6b9cc95d36205fe445fb796a64c5d6800db848f18e0500436f56fdad3b0
Opcode Fuzzy Hash: 2199bdc79e52f5ef61badbc6bf9a020bfd06743070bcd4f856994e81c2b22385
Instruction Fuzzy Hash: 82D1C1325487C1C6EB609F25E4843ADBBA4F746B84FA44139EA8E07B95CF3CD586CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873D4F30 Relevance: 10.6, Strings: 8, Instructions: 607COMMON

Download Yara Rule

Strings

', xrefs: 00007FF7873D58D2
Memory allocation failed, xrefs: 00007FF7873D571D
invalid character in attribute value, xrefs: 00007FF7873D57FB
AttValue length too long, xrefs: 00007FF7873D56ED, 00007FF7873D5833
AttValue: " or ' expected, xrefs: 00007FF7873D5878
Unescaped '<' not allowed in attributes values, xrefs: 00007FF7873D52FA
AttValue: ' expected, xrefs: 00007FF7873D5811
%s, xrefs: 00007FF7873D530F, 00007FF7873D5894

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: %s$'$AttValue length too long$AttValue: " or ' expected$AttValue: ' expected$Memory allocation failed$Unescaped '<' not allowed in attributes values$invalid character in attribute value
API String ID: 0-698441893
Opcode ID: 2fcd9bfdac137e2bf46f62490538c9dcdff5323e361b72439ea4c857055f0e8e
Instruction ID: 01016674ac39da5924d3cacb10cca5fc9f31c6f68835c9e482936fccd868dbe1
Opcode Fuzzy Hash: 2fcd9bfdac137e2bf46f62490538c9dcdff5323e361b72439ea4c857055f0e8e
Instruction Fuzzy Hash: 8042E532A4E6C186EB60EB15D0883B9BBD1FB45784FE44139DA8E42B84EF7CD546C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873D5940 Relevance: 10.3, Strings: 8, Instructions: 320COMMON

Download Yara Rule

Strings

Unfinished System or Public ID " or ' expected, xrefs: 00007FF7873D5D77
+, xrefs: 00007FF7873D5E1E
+, xrefs: 00007FF7873D5E71
Name too long use XML_PARSE_HUGE option, xrefs: 00007FF7873D5C26
SystemLiteral " or ' expected, xrefs: 00007FF7873D5E17
%s: %s, xrefs: 00007FF7873D5C38
SystemLiteral, xrefs: 00007FF7873D5C14
%s, xrefs: 00007FF7873D5D8C, 00007FF7873D5E33

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: %s$%s: %s$+$+$Name too long use XML_PARSE_HUGE option$SystemLiteral$SystemLiteral " or ' expected$Unfinished System or Public ID " or ' expected
API String ID: 0-3796757011
Opcode ID: bde0e636a5d9ed29cb633d751c949b0749b099de2826396e07d0495536cab9dc
Instruction ID: d14ad925e4a6705401ccb5924fde7d3fb7983822e46a25aece9db5c9b35473d3
Opcode Fuzzy Hash: bde0e636a5d9ed29cb633d751c949b0749b099de2826396e07d0495536cab9dc
Instruction Fuzzy Hash: 7BE1A332A4978186E760EF15D0843BDBBA4FB84744FB40139DA8E47A95CF7CE496CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78740C270 Relevance: 9.2, Strings: 7, Instructions: 431COMMON

Download Yara Rule

Strings

building QName, xrefs: 00007FF78740C3C4
Value for attribute %s of %s is different from default "%s", xrefs: 00007FF78740C67F
Value "%s" for attribute %s of %s is not among the enumerated set, xrefs: 00007FF78740C852
Value "%s" for attribute %s of %s is not among the enumerated notations, xrefs: 00007FF78740C80D
Value for attribute %s of %s must be "%s", xrefs: 00007FF78740C8D1
No declaration for attribute %s of element %s, xrefs: 00007FF78740C57E
Value "%s" for attribute %s of %s is not a declared Notation, xrefs: 00007FF78740C72B

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: No declaration for attribute %s of element %s$Value "%s" for attribute %s of %s is not a declared Notation$Value "%s" for attribute %s of %s is not among the enumerated notations$Value "%s" for attribute %s of %s is not among the enumerated set$Value for attribute %s of %s is different from default "%s"$Value for attribute %s of %s must be "%s"$building QName
API String ID: 0-1675084365
Opcode ID: 44596e3b82a7af38f12895bb026e6e4b98f998e8bdb6b7037274866a01f89c5a
Instruction ID: 72832e4f50669351ee612a024c4ffd8e291365865db96c0fb57c2a6211c288b0
Opcode Fuzzy Hash: 44596e3b82a7af38f12895bb026e6e4b98f998e8bdb6b7037274866a01f89c5a
Instruction Fuzzy Hash: C202B262B89B86C2EAA4EF2194506B9A391FF45BC5FA44435DE4F07B85DF3CE402D320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF78753ABD0 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF78753AC49
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78753AC61
RtlVirtualUnwind.KERNEL32 ref: 00007FF78753AC9C
IsDebuggerPresent.KERNEL32 ref: 00007FF78753ACD5
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78753ACDF
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78753ACEA

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 94b72c7a668df9febbccddd268a292bb738cdee44e718c57e73d112e7d317cd2
Instruction ID: 72453bd7a61a3486df7f87e18d346b04a12a10378b8dd1cd96af0c9ba6eeefa7
Opcode Fuzzy Hash: 94b72c7a668df9febbccddd268a292bb738cdee44e718c57e73d112e7d317cd2
Instruction Fuzzy Hash: CF31AB32654F8186D760DF25E8402ADB3A4FB85794FE40135EA8E47B55DF3CD546C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873E2C30 Relevance: 9.0, Strings: 7, Instructions: 267COMMON

Download Yara Rule

Strings

String not started expecting ' or ", xrefs: 00007FF7873E308C
!, xrefs: 00007FF7873E30D2
expected '=', xrefs: 00007FF7873E2D1C
standalone accepts only 'yes' or 'no', xrefs: 00007FF7873E2E2B, 00007FF7873E2FCA
!, xrefs: 00007FF7873E3082
String not closed expecting " or ', xrefs: 00007FF7873E2ED3
%s, xrefs: 00007FF7873E2D2B, 00007FF7873E2D9E, 00007FF7873E2F3D, 00007FF7873E309B

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: !$!$%s$String not closed expecting " or '$String not started expecting ' or "$expected '='$standalone accepts only 'yes' or 'no'
API String ID: 0-1553304489
Opcode ID: 8604505bd627378029169a71a0161d1c940d4e907bfd7350effc7091bf89dd40
Instruction ID: 2c908b1680c522e01c31f54a6ed45d761f9be163c15b98629d3ec3a65f5aa23b
Opcode Fuzzy Hash: 8604505bd627378029169a71a0161d1c940d4e907bfd7350effc7091bf89dd40
Instruction Fuzzy Hash: E4E17D73848BC186E7609F25E440369FBE4FB90B58F648139D68E06EA4CF7CD896CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873D4550 Relevance: 7.8, Strings: 6, Instructions: 279COMMON

Download Yara Rule

Strings

n, xrefs: 00007FF7873D495A
Memory allocation failed, xrefs: 00007FF7873D4700
NmToken, xrefs: 00007FF7873D48F1
Name too long use XML_PARSE_HUGE option, xrefs: 00007FF7873D490A
%s: %s, xrefs: 00007FF7873D491C
n, xrefs: 00007FF7873D48F8

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: %s: %s$Memory allocation failed$Name too long use XML_PARSE_HUGE option$NmToken$n$n
API String ID: 0-2032728247
Opcode ID: a79e2d7193fbd1b5bd6efb855e67a608ef4dae53a8966eda43b02c934f521380
Instruction ID: 0749b2e2d8fc87b26dd4a0c444cb1e9cc0bca94555dcf5e296999588961e5cc1
Opcode Fuzzy Hash: a79e2d7193fbd1b5bd6efb855e67a608ef4dae53a8966eda43b02c934f521380
Instruction Fuzzy Hash: 8CC1C472A487C185EB60AF15E4843B9ABA4FB85B84FA00039DE8F47B95DF3CD442C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873D40E0 Relevance: 7.8, Strings: 6, Instructions: 263COMMON

Download Yara Rule

Strings

Memory allocation failed, xrefs: 00007FF7873D420E
Name too long use XML_PARSE_HUGE option, xrefs: 00007FF7873D438B, 00007FF7873D4497
n, xrefs: 00007FF7873D44E4
%s: %s, xrefs: 00007FF7873D439D, 00007FF7873D44A9
d, xrefs: 00007FF7873D41D4
NCName, xrefs: 00007FF7873D4379, 00007FF7873D4485

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: %s: %s$Memory allocation failed$NCName$Name too long use XML_PARSE_HUGE option$d$n
API String ID: 0-698477125
Opcode ID: 5f1cb61db0f1a11a409675970bbbad990f3ef345e5bfe1f267e07a117b318252
Instruction ID: 4f996ead10c508115b93298425bed320cf33b796cf385521ba20dd14544f4010
Opcode Fuzzy Hash: 5f1cb61db0f1a11a409675970bbbad990f3ef345e5bfe1f267e07a117b318252
Instruction Fuzzy Hash: 26B1A132A4C7C186E760AB21B4843BAF6D5FB95784FA44039DA8E42E95DF7CE043CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7874FA3F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7874FA451
IsDebuggerPresent.KERNEL32 ref: 00007FF7874FA469
OutputDebugStringW.KERNEL32 ref: 00007FF7874FA47A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7874FA473

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 085a76700e68d6dc8880249fdf21faf02338f6a026c6726e02a72d3c5b7c09a2
Instruction ID: 23621d0ee0fe1b3a6f5ef994815cfbb7ef06c72fd698b3c50a1c1195a2e8634c
Opcode Fuzzy Hash: 085a76700e68d6dc8880249fdf21faf02338f6a026c6726e02a72d3c5b7c09a2
Instruction Fuzzy Hash: 14113D32B94B8297E704AB22E654379B3A5FB44344FA44135C64E87A50EF7CE165C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873D2510 Relevance: 6.6, Strings: 5, Instructions: 376COMMON

Download Yara Rule

Strings

Memory allocation failed, xrefs: 00007FF7873D271A, 00007FF7873D27A1, 00007FF7873D29A3
Name %s is not XML Namespace compliant, xrefs: 00007FF7873D2A80
:, xrefs: 00007FF7873D266D
:, xrefs: 00007FF7873D25C0
:, xrefs: 00007FF7873D2620

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: :$:$:$Memory allocation failed$Name %s is not XML Namespace compliant
API String ID: 0-941754222
Opcode ID: afe7a0dc4685e906880020aaee8dc5bcc5ca7da6581f330677f2b925e4710e4b
Instruction ID: 35eb401e5eeca30df91f1abc1dcc90b92764462e4682edf3815e2bed6c644faf
Opcode Fuzzy Hash: afe7a0dc4685e906880020aaee8dc5bcc5ca7da6581f330677f2b925e4710e4b
Instruction Fuzzy Hash: 43E1D361A4C7C241EB34AB21A188279FA91FF45794FA40038DA8F63E95DF7CE483D721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787405FB0 Relevance: 6.4, Strings: 5, Instructions: 180COMMON

Download Yara Rule

Strings

xmlNewElementContent : name == NULL !, xrefs: 00007FF787406073
Internal: ELEMENT content corrupted invalid type, xrefs: 00007FF787405FFD
Memory allocation failed : %s, xrefs: 00007FF787406117
malloc failed, xrefs: 00007FF787406105
xmlNewElementContent : name != NULL !, xrefs: 00007FF787406081

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: Internal: ELEMENT content corrupted invalid type$Memory allocation failed : %s$malloc failed$xmlNewElementContent : name != NULL !$xmlNewElementContent : name == NULL !
API String ID: 2882836952-2621422465
Opcode ID: a25bd16bf9fe5ebb5a795bbf91fdd7e442d2b5f280a0dcd38adae93917c81017
Instruction ID: e1cfa47b7e42eade6e987177cc414a7a9432461ac6743599d9ce8f97368b3e63
Opcode Fuzzy Hash: a25bd16bf9fe5ebb5a795bbf91fdd7e442d2b5f280a0dcd38adae93917c81017
Instruction Fuzzy Hash: CC816D32648B8186E7A0EF25A44036AF7E5FB89744FA84138D68F47B95CF3DD452CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C7150 Relevance: 6.4, Strings: 5, Instructions: 149COMMON

Download Yara Rule

Strings

xmlRegisterCharEncodingHandler: NULL handler !, xrefs: 00007FF7873C730F
xmlNewCharEncodingHandler : no name !, xrefs: 00007FF7873C7192
xmlRegisterCharEncodingHandler: Too many handler registered, see %s, xrefs: 00007FF7873C736B
MAX_ENCODING_HANDLERS, xrefs: 00007FF7873C735C
xmlNewCharEncodingHandler : out of memory !, xrefs: 00007FF7873C729A

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: MAX_ENCODING_HANDLERS$xmlNewCharEncodingHandler : no name !$xmlNewCharEncodingHandler : out of memory !$xmlRegisterCharEncodingHandler: NULL handler !$xmlRegisterCharEncodingHandler: Too many handler registered, see %s
API String ID: 2882836952-4198703406
Opcode ID: ba01218149bb0ae67f87552a1933e45c05369aabd5e8109c04f630b4089aa241
Instruction ID: a3dab924abcafc5a5e75c5f026246780634c0db725e3d4bc40f4c56a598813ee
Opcode Fuzzy Hash: ba01218149bb0ae67f87552a1933e45c05369aabd5e8109c04f630b4089aa241
Instruction Fuzzy Hash: B9613F3264CB8186E7609B14F84136AF6E8FB94794FA40139EA8E47FA5DF3CD052CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873DED70 Relevance: 5.2, Strings: 4, Instructions: 247COMMON

Download Yara Rule

Strings

building QName, xrefs: 00007FF7873DEFA1, 00007FF7873DF101
Failed to parse QName '%s:%s:', xrefs: 00007FF7873DF04D
Failed to parse QName '%s', xrefs: 00007FF7873DEE15
Failed to parse QName '%s:', xrefs: 00007FF7873DEEE4

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID: Failed to parse QName '%s'$Failed to parse QName '%s:%s:'$Failed to parse QName '%s:'$building QName
API String ID: 0-3501110172
Opcode ID: b9f32c71e7a8cd57ce99ede81e384d55a23856a7550b5d3ec8192fbe59243a31
Instruction ID: dd4f54de69c5551a5dd830051e7113a088d83766b3692c049cb3e8dd60da7853
Opcode Fuzzy Hash: b9f32c71e7a8cd57ce99ede81e384d55a23856a7550b5d3ec8192fbe59243a31
Instruction Fuzzy Hash: 6BB1E8326487C285FA64AB11A4843AAF694FB85BD4FA44239EA9E07FD5DF3CD013C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C1F30 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF7873C1F68

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 746e6eb2d1a1117aad8b087402c01110a686746222bb28c3391cc06e53fde1b0
Instruction ID: eb4b14137ab5fb7f8dfd7ffbab1d8c1975db6138eb24f63de847045e2f9844f2
Opcode Fuzzy Hash: 746e6eb2d1a1117aad8b087402c01110a686746222bb28c3391cc06e53fde1b0
Instruction Fuzzy Hash: A8016236E4858186FB71BB11A4213F9A390BBC8754FE40135D64E06685DF3CD106DA21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787518ACC Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 00007FF787518C9B

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: d474f519e288bebb3776aadca59e4aa65866eb36760e48044dc48b216662f6dd
Instruction ID: 703c4dd16683c4d8ff81d06cb9401f59381ee835bcefa8c2025257f4645c57d5
Opcode Fuzzy Hash: d474f519e288bebb3776aadca59e4aa65866eb36760e48044dc48b216662f6dd
Instruction Fuzzy Hash: FC71D025A5930246EBB8BA1980806B9A291FF40769FE45432DD4F1B6D9CF2DFC43C778

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787517848 Relevance: 1.5, Strings: 1, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF7875179E1

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: de94bfaff3a5cf4e8a59df0cc0368c3989eeaee540664849dc8fced3b32465d0
Instruction ID: c8716d6baccdccde34b32024fd906e22bfd774c2a266738d8e4497f30098a13e
Opcode Fuzzy Hash: de94bfaff3a5cf4e8a59df0cc0368c3989eeaee540664849dc8fced3b32465d0
Instruction Fuzzy Hash: 1471A421A8C64646FB64AA3D40003B9E792BB41F45FF81931DD8B0779ACE2DE84BC771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C5240 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46693dbf9f6a397b1457424d35a50aa5f9b6751634194fc1e4ea554f06a55c7d
Instruction ID: 73048587fba5c4642936e7c81f38142e0382f5911509539d65f5600479422d9a
Opcode Fuzzy Hash: 46693dbf9f6a397b1457424d35a50aa5f9b6751634194fc1e4ea554f06a55c7d
Instruction Fuzzy Hash: B7B1FC62B486C687EB68EA119040739E691BBB07A0FB4503DDE5F47BD0DE7DE852C312

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C4DE0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0155d063973d59419c7893cdb7d0c22d835bbcd046b73ffc3a9d8a7082f90e11
Instruction ID: 5cac8d92dc7ffdb255652339b01d2e9e1b400fa6d99d313132ce943ae0dbda96
Opcode Fuzzy Hash: 0155d063973d59419c7893cdb7d0c22d835bbcd046b73ffc3a9d8a7082f90e11
Instruction Fuzzy Hash: 5691D632A0878182E758DF25D51033DB7A4F798BA4F658139DE4E87785DF38D892C361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7875187EC Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd8cb441ee8899db3f14b329389a3467cdf09f4d8e94e00437460040d27086d6
Instruction ID: 44237ebe4a6768f3c4845a2d611e6fc08e4fb5127dcde7cb1d3dc54eb8aa88e6
Opcode Fuzzy Hash: bd8cb441ee8899db3f14b329389a3467cdf09f4d8e94e00437460040d27086d6
Instruction Fuzzy Hash: 9F811325A9820282FBB8BA1580806B9A291FF40765FE45136DD4F53698CF2DF843C772

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787518218 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c9744b62ff630c810a024247eba52f3b77e7e111ef789983f0bc06c712269dff
Instruction ID: 9f869fa453ac3dfa10751b0ea74cb97ea917100d39c5ed2aaec7d54c020cfd6f
Opcode Fuzzy Hash: c9744b62ff630c810a024247eba52f3b77e7e111ef789983f0bc06c712269dff
Instruction Fuzzy Hash: F6812425E5860686EBB8BA1984802BDA290FF4076AFE85535DD4F47689CF3DF847C234

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787546098 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 9c6990047df265be31c9680ac5459c0bcf8dacae1a5d0e388159ad14d4fc73dd
Instruction ID: 98fd2fae3593839bd35ed23fef7cc646df924546828a00eace106884407e00a8
Opcode Fuzzy Hash: 9c6990047df265be31c9680ac5459c0bcf8dacae1a5d0e388159ad14d4fc73dd
Instruction Fuzzy Hash: B341D662754A5442EF44DF26D9152A9B3A1FB4CFD4BA99436EE0E87B58DF3CD442C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CC940 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb1f743ac1ef8f95b1eda17f2a4fba62b59e07d82c91b03d918f4b14817b188
Instruction ID: faaccf71e3bedd3ed9e3896ae9f3aebc602633c8f22ee82873db6683e6ae38aa
Opcode Fuzzy Hash: 6cb1f743ac1ef8f95b1eda17f2a4fba62b59e07d82c91b03d918f4b14817b188
Instruction Fuzzy Hash: 4931F6B3F495D203D75DCE38586027AA9E3A7C1741B8DC53EDA8BC2B89EE398911C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787536E04 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd2c9ad6f66a0e37362a675495163433ebd724a795661b71147279716215bd4
Instruction ID: 24d100f30f4f20e4de1c256f306ef08a65f9cddecee3ee9e149648492357ec4b
Opcode Fuzzy Hash: 9bd2c9ad6f66a0e37362a675495163433ebd724a795661b71147279716215bd4
Instruction Fuzzy Hash: 10316A22E9C14285FBA57668C55457AD242FF83740FF4863CC50F06AB9CD2EB84BE520

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CC870 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 590e65582da1ece30385956d2c99742cf1de0fc0112662a95effe2d7524acb7b
Instruction ID: 99d51f7e934d3e87285d0c64bcf51b2e228fa4bebacf522f619f5b04dcaa2320
Opcode Fuzzy Hash: 590e65582da1ece30385956d2c99742cf1de0fc0112662a95effe2d7524acb7b
Instruction Fuzzy Hash: 7121A4B3F49A9703D75E8E38586013BE5E3ABC1341B99C53AE94BC1B99EF398911C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C1C10 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7873C1C60
GetFileVersionInfoSizeW.VERSION ref: 00007FF7873C1C70
GetFileVersionInfoW.VERSION ref: 00007FF7873C1C8F
VerQueryValueW.VERSION ref: 00007FF7873C1CBF

Part of subcall function 00007FF7873C36B0: VerQueryValueW.VERSION ref: 00007FF7873C370A

VerQueryValueW.VERSION ref: 00007FF7873C1D08
VerQueryValueW.VERSION ref: 00007FF7873C1D51
VerQueryValueW.VERSION ref: 00007FF7873C1D9A
VerQueryValueW.VERSION ref: 00007FF7873C1DE3
GetStdHandle.KERNEL32 ref: 00007FF7873C1E0D
GetFileType.KERNEL32 ref: 00007FF7873C1E16

Strings

%s v%s - %s%s%s, xrefs: 00007FF7873C1E36, 00007FF7873C1E6B
FileDescription, xrefs: 00007FF7873C1D5C
LegalCopyright, xrefs: 00007FF7873C1DA5
FileVersion, xrefs: 00007FF7873C1D13
\VarFileInfo\Translation, xrefs: 00007FF7873C1CB5, 00007FF7873C1D01, 00007FF7873C1D4A, 00007FF7873C1D93, 00007FF7873C1DDC
CompanyName, xrefs: 00007FF7873C1DEE
InternalName, xrefs: 00007FF7873C1CCA

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: QueryValue$File$InfoVersion$HandleModuleNameSizeType
String ID: %s v%s - %s%s%s$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$\VarFileInfo\Translation
API String ID: 1763495592-3823988196
Opcode ID: 59e0e0438944b33c2a9cde6bba76fb07b4b6ebd65a71f3af95fb5b98ed3aec2f
Instruction ID: a7c6b2090de8c0f229bce8898dd9b2612ba1a509ffd361c4534367d33e7f2379
Opcode Fuzzy Hash: 59e0e0438944b33c2a9cde6bba76fb07b4b6ebd65a71f3af95fb5b98ed3aec2f
Instruction Fuzzy Hash: 11717E26649B8282D710EF55F4802AAB3B5FB85BD4FA00136EB8E07B64DF3DD15AC710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873F8400 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 179
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7873F87D0: TlsAlloc.KERNEL32(?,?,?,?,00007FF7873CAE69), ref: 00007FF7873F87F1
Part of subcall function 00007FF7873F87D0: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F87FD

TlsGetValue.KERNEL32 ref: 00007FF7873F840F
GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F
CreateMutexW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7873CAE85), ref: 00007FF7873F84D3
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7873CAE85), ref: 00007FF7873F84EB
ReleaseMutex.KERNEL32 ref: 00007FF7873F86A6
GetCurrentThreadId.KERNEL32 ref: 00007FF7873F86C3

Part of subcall function 00007FF7873F87D0: Sleep.KERNEL32(?,?,?,?,00007FF7873CAE69), ref: 00007FF7873F8828

GetCurrentProcess.KERNEL32 ref: 00007FF7873F870F
GetCurrentThread.KERNEL32 ref: 00007FF7873F8718
GetCurrentProcess.KERNEL32 ref: 00007FF7873F8721
DuplicateHandle.KERNEL32 ref: 00007FF7873F874B
TlsSetValue.KERNEL32 ref: 00007FF7873F875A

Part of subcall function 00007FF78752460C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787524628

Strings

20910, xrefs: 00007FF7873F85C9
xmlGetGlobalState: out of memory, xrefs: 00007FF7873F846A, 00007FF7873F86EE

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: Current$Thread$MutexProcessValue$AllocCreateDuplicateHandleObjectReleaseSingleSleepWait_invalid_parameter_noinfo
String ID: 20910$xmlGetGlobalState: out of memory
API String ID: 2647883383-3156977938
Opcode ID: 17a640fbf34f9c5a2ac778d59e486bb6deea208b404d879d0bf2743d061012a3
Instruction ID: b654428b62cdf88d47ca00d358185d7ed63315a35a9965a6db245fb049feb426
Opcode Fuzzy Hash: 17a640fbf34f9c5a2ac778d59e486bb6deea208b404d879d0bf2743d061012a3
Instruction Fuzzy Hash: E3A16435A49B8287EB14EF20E8442A9B3A5FB48784FA44135DA5F43761DF3CF196C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CA960 Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 298
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7873F87D0: TlsAlloc.KERNEL32(?,?,?,?,00007FF7873CAE69), ref: 00007FF7873F87F1
Part of subcall function 00007FF7873F87D0: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F87FD

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CA9C2
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CA9EC

Part of subcall function 00007FF7873F8400: TlsGetValue.KERNEL32 ref: 00007FF7873F840F
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F

Strings

%s:%d: , xrefs: 00007FF7873CACBE
Entity: line %d: , xrefs: 00007FF7873CAADB
element %s: , xrefs: 00007FF7873CAAEF
Entity: line %d: , xrefs: 00007FF7873CACDD
%s:%d: , xrefs: 00007FF7873CAA8F, 00007FF7873CAAB5
warning : , xrefs: 00007FF7873CAC17
out of memory error, xrefs: 00007FF7873CAC7C
error : , xrefs: 00007FF7873CAC0E
^, xrefs: 00007FF7873CAD57
%s, xrefs: 00007FF7873CAC5D, 00007FF7873CAC86, 00007FF7873CAD2F, 00007FF7873CAD71

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread$AllocValue
String ID: %s$%s:%d: $%s:%d: $Entity: line %d: $Entity: line %d: $^$element %s: $error : $out of memory error$warning :
API String ID: 3461179012-3702862348
Opcode ID: d4e8f76f1f956a65195a3d747291fe41469c4e53c99c211f4d6d467ec98e605d
Instruction ID: 06cb092fdf4e03ed4cbb19be01359bf6bbf631e6bdff45693621dda16b991bee
Opcode Fuzzy Hash: d4e8f76f1f956a65195a3d747291fe41469c4e53c99c211f4d6d467ec98e605d
Instruction Fuzzy Hash: 49C12922A4D7C245EB65EB10D55437DA760BF81B94FE9803ACA4F43B91DF2CE846D322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873DDE00 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 293threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873DDE5F
GetCurrentThreadId.KERNEL32 ref: 00007FF7873DDE92
GetCurrentThreadId.KERNEL32 ref: 00007FF7873DDEBA

Strings

Y, xrefs: 00007FF7873DE0BE
Detected an entity reference loop, xrefs: 00007FF7873DE0B7
PEReference: expecting ';', xrefs: 00007FF7873DDF11
PEReference: %%%s; not found, xrefs: 00007FF7873DE01B, 00007FF7873DE03B, 00007FF7873DE05B
Internal: %%%s; is not a parameter entity, xrefs: 00007FF7873DE15B
PEReference: no name, xrefs: 00007FF7873DDE43
Y, xrefs: 00007FF7873DE111
PEReference: %s, xrefs: 00007FF7873DDEDF
%s, xrefs: 00007FF7873DDF2D, 00007FF7873DE0D3

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: %s$Detected an entity reference loop$Internal: %%%s; is not a parameter entity$PEReference: %%%s; not found$PEReference: %s$PEReference: expecting ';'$PEReference: no name$Y$Y
API String ID: 2882836952-114631651
Opcode ID: 9378d22c01893fcf21cf10bc1e63450b383dcc82cfcab1859742a64802999641
Instruction ID: 56800603cf34148e2d8325b04cd8dd9232c95a934fc5da144aef4c42409a1901
Opcode Fuzzy Hash: 9378d22c01893fcf21cf10bc1e63450b383dcc82cfcab1859742a64802999641
Instruction Fuzzy Hash: C8E1A67298C7C285EB54BF21D4883B9BAA0FB45B44FA44039D94F16AA5CF3CE457C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C2690 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 133windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7873C26CD
GetSysColorBrush.USER32 ref: 00007FF7873C26DD
GetDlgItem.USER32 ref: 00007FF7873C270D
EndDialog.USER32 ref: 00007FF7873C2725
SetWindowTextW.USER32 ref: 00007FF7873C2839
GetDlgItem.USER32 ref: 00007FF7873C2847
SendMessageW.USER32 ref: 00007FF7873C285E
GetDlgItem.USER32 ref: 00007FF7873C286C
SendMessageW.USER32 ref: 00007FF7873C2885

Strings

%s License Agreement, xrefs: 00007FF7873C2801

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: Item$MessageSend$BrushColorDialogTextWindow
String ID: %s License Agreement
API String ID: 1092124246-1285993597
Opcode ID: e65ede458fc0a3f5f314a5a8bcb1a629bf2c95977582fef719601ff82180c112
Instruction ID: f71bba1406a8dd4f5cd901532613bc16c39e3f44c7657f2fd5413c55f2aa4674
Opcode Fuzzy Hash: e65ede458fc0a3f5f314a5a8bcb1a629bf2c95977582fef719601ff82180c112
Instruction Fuzzy Hash: B751B020A9DAC281FB55AB25A9543BAA250FBC5BA0FE04234D94F17FD5CE3CD583C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C1A70 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 90COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7873C1AB5
GetFileVersionInfoSizeW.VERSION ref: 00007FF7873C1AC5
GetFileVersionInfoW.VERSION ref: 00007FF7873C1AE4

Part of subcall function 00007FF7873C3830: VerQueryValueW.KERNELBASE ref: 00007FF7873C387A
Part of subcall function 00007FF7873C3830: VerQueryValueW.VERSION ref: 00007FF7873C38BE

GetStdHandle.KERNEL32 ref: 00007FF7873C1B49
GetFileType.KERNEL32 ref: 00007FF7873C1B52

Strings

%s v%s - %s%s%s, xrefs: 00007FF7873C1B6A, 00007FF7873C1B9F
FileDescription, xrefs: 00007FF7873C1B0B
LegalCopyright, xrefs: 00007FF7873C1B1D
FileVersion, xrefs: 00007FF7873C1AF9
CompanyName, xrefs: 00007FF7873C1B2F
InternalName, xrefs: 00007FF7873C1AEA

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: File$InfoQueryValueVersion$HandleModuleNameSizeType
String ID: %s v%s - %s%s%s$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright
API String ID: 4213512751-3661493233
Opcode ID: ddbe9d75366782137882ea54602471a268f4138fcc54bce7e62a5a480a17ba78
Instruction ID: c56e7714c849dd61cc8a965ba9e1dba9ade4101d63ab0a0cc033b8be1d585328
Opcode Fuzzy Hash: ddbe9d75366782137882ea54602471a268f4138fcc54bce7e62a5a480a17ba78
Instruction Fuzzy Hash: F1419065A58B8282EB10FB51E8892A9E395FF85BD0FE44139D94F07B95DF3CE106C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CAE30 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 386threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7873F87D0: TlsAlloc.KERNEL32(?,?,?,?,00007FF7873CAE69), ref: 00007FF7873F87F1
Part of subcall function 00007FF7873F87D0: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F87FD

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CAE69
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CAEA5

Part of subcall function 00007FF7873F8400: TlsGetValue.KERNEL32 ref: 00007FF7873F840F
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CAF51
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CAF88
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB26A
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB2A0

Part of subcall function 00007FF7873F87D0: Sleep.KERNEL32(?,?,?,?,00007FF7873CAE69), ref: 00007FF7873F8828

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB2F2

Part of subcall function 00007FF7873F8400: ReleaseMutex.KERNEL32 ref: 00007FF7873F86A6
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F86C3

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB34B
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB37F

Strings

No error message provided, xrefs: 00007FF7873CAFB8

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread$AllocMutexReleaseSleepValue
String ID: No error message provided
API String ID: 1567288208-2316238207
Opcode ID: 639cb6ce21f7da558f7f775564c39e798a02aeace90cf1bd9860c7af86f788d3
Instruction ID: 4031dfea2f3e1bd8054934b55830c8a76122505b3b205c4bd51cdee1cb0c4c76
Opcode Fuzzy Hash: 639cb6ce21f7da558f7f775564c39e798a02aeace90cf1bd9860c7af86f788d3
Instruction Fuzzy Hash: B4026021A896C295EE64BB11A480379A391FF847A8FE44039DA4F47F91DF3CE546C732

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873DE320 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 245threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873DE364
GetCurrentThreadId.KERNEL32 ref: 00007FF7873DE38F
GetCurrentThreadId.KERNEL32 ref: 00007FF7873DE3B7

Part of subcall function 00007FF7873F8400: TlsGetValue.KERNEL32 ref: 00007FF7873F840F
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F

Part of subcall function 00007FF7873F8400: ReleaseMutex.KERNEL32 ref: 00007FF7873F86A6
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F86C3

Part of subcall function 00007FF7873F8400: CreateMutexW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7873CAE85), ref: 00007FF7873F84D3
Part of subcall function 00007FF7873F8400: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7873CAE85), ref: 00007FF7873F84EB

Strings

Reading %s entity content input, xrefs: 00007FF7873DE3DD
xmlLoadEntityContent parameter error, xrefs: 00007FF7873DE6CC
xmlLoadEntityContent: invalid char value %d, xrefs: 00007FF7873DE683
xmlLoadEntityContent input error, xrefs: 00007FF7873DE41F

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread$Mutex$CreateObjectReleaseSingleValueWait
String ID: Reading %s entity content input$xmlLoadEntityContent input error$xmlLoadEntityContent parameter error$xmlLoadEntityContent: invalid char value %d
API String ID: 2259964185-1959987939
Opcode ID: b0b000a91367ae14f95b23648544a78075539547c159ebb8f462d266a2663628
Instruction ID: 0f603c3efd1e71897e8e6154d5a735553453881cca1e02980ad0a49059a763d6
Opcode Fuzzy Hash: b0b000a91367ae14f95b23648544a78075539547c159ebb8f462d266a2663628
Instruction Fuzzy Hash: 1BB1AB71AC969285EA60BB55D488678AF61FF40B94FF40039D50F47AE1DF2CE493C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CB560 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 156threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB5C5
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB5F0
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB6D7
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB6FB
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB754
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB773

Strings

error: , xrefs: 00007FF7873CB618

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: error:
API String ID: 2882836952-2884437635
Opcode ID: d0159070469704058cf5e7706f6300e6281debd0f83d208a983135a5a57aafed
Instruction ID: 1c39c30585cb63a393c4fed823b6b5d637729a6cd67348c79f32b0c48a3f1dc4
Opcode Fuzzy Hash: d0159070469704058cf5e7706f6300e6281debd0f83d208a983135a5a57aafed
Instruction Fuzzy Hash: 2B618021E8C6C295EE50BB11D4453B9E290BF80BE8FE54039D90F46AA1DE3CE587C332

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CB7C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB825
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB850
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB937
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB95B
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB9B4
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CB9D3

Strings

warning: , xrefs: 00007FF7873CB878

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: warning:
API String ID: 2882836952-990315431
Opcode ID: 0470ec2a24b305d315f576fff2691a3bea6c1cf8d0a7a8806b06a47bf6bbfea5
Instruction ID: 1e97ccbe80a97b0a2d8a73913f1379a515267530ef358cfd289f1522aaeb8fb8
Opcode Fuzzy Hash: 0470ec2a24b305d315f576fff2691a3bea6c1cf8d0a7a8806b06a47bf6bbfea5
Instruction Fuzzy Hash: 7A618121E8D6C695EE50BB11A4453B9E250BF80BE8FF54039D94F46AA1DE3CA587C232

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C2FA0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7873C308F
GetCommandLineW.KERNEL32 ref: 00007FF7873C30A7

Part of subcall function 00007FF787522054: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787522071

Strings

-accepteula, xrefs: 00007FF7873C300B, 00007FF7873C30EB
CommandLineToArgvW, xrefs: 00007FF7873C3088
Shell32.dll, xrefs: 00007FF7873C3076
/accepteula, xrefs: 00007FF7873C2FF8, 00007FF7873C30D8

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: AddressCommandLineProc_invalid_parameter_noinfo
String ID: -accepteula$/accepteula$CommandLineToArgvW$Shell32.dll
API String ID: 1655280681-2252253654
Opcode ID: 8810968ca1d4bd5888414cc0080fec073e82111f81f4927d60697030f544e4c5
Instruction ID: 3a11026de73144ef549048705669bb8e962186c31f26266dd762d2cde94bc56d
Opcode Fuzzy Hash: 8810968ca1d4bd5888414cc0080fec073e82111f81f4927d60697030f544e4c5
Instruction Fuzzy Hash: 38518032A4978696E700BF01E9801B9B391BF84B94FA04039DE1F53755DF7DE496C362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CE2E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CE301
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CE329

Part of subcall function 00007FF7873F8400: TlsGetValue.KERNEL32 ref: 00007FF7873F840F
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CE39A
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CE3C2

Part of subcall function 00007FF7873F87D0: TlsAlloc.KERNEL32(?,?,?,?,00007FF7873CAE69), ref: 00007FF7873F87F1
Part of subcall function 00007FF7873F87D0: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F87FD

Strings

Cannot initialize memory for list, xrefs: 00007FF7873CE341, 00007FF7873CE35F
Cannot initialize memory for sentinel, xrefs: 00007FF7873CE3E7

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread$AllocValue
String ID: Cannot initialize memory for list$Cannot initialize memory for sentinel
API String ID: 3461179012-1086957842
Opcode ID: 12c87320a915eb4173dda38ece05783319f2f95a58f9afabbd8c051ec05f138e
Instruction ID: eefafc49b4a6db9ca354c2596447d1c509289f644a3b47a2521233151834dc1a
Opcode Fuzzy Hash: 12c87320a915eb4173dda38ece05783319f2f95a58f9afabbd8c051ec05f138e
Instruction Fuzzy Hash: FE416231E98A8285EF44BB14E4852B8B3A1FF44B94FE54035D20F426A5EF3CE596C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CA670 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CA692
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CA6BA

Part of subcall function 00007FF7873F8400: TlsGetValue.KERNEL32 ref: 00007FF7873F840F
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F

Part of subcall function 00007FF7873F8400: ReleaseMutex.KERNEL32 ref: 00007FF7873F86A6
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F86C3

Part of subcall function 00007FF7873F8400: CreateMutexW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7873CAE85), ref: 00007FF7873F84D3
Part of subcall function 00007FF7873F8400: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7873CAE85), ref: 00007FF7873F84EB

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CA700
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CA728

Part of subcall function 00007FF7873F87D0: TlsAlloc.KERNEL32(?,?,?,?,00007FF7873CAE69), ref: 00007FF7873F87F1
Part of subcall function 00007FF7873F87D0: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F87FD

Strings

Entity: line %d: , xrefs: 00007FF7873CA74E
%s:%d: , xrefs: 00007FF7873CA6E0

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread$Mutex$AllocCreateObjectReleaseSingleValueWait
String ID: %s:%d: $Entity: line %d:
API String ID: 2417299850-3495040061
Opcode ID: c3c4c060acccb9bc1dbdbfafe9495c64fd32d18d52f71b8bd1deeec13a32323f
Instruction ID: b74343d445619da553803e34aa5d36345ba382aa1cc36cedbb5640830461e425
Opcode Fuzzy Hash: c3c4c060acccb9bc1dbdbfafe9495c64fd32d18d52f71b8bd1deeec13a32323f
Instruction Fuzzy Hash: 6721FE21E98586C6FF54BB60E4857B8A261FF40794FF44035D60F129A1DF2CA497D732

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C3170 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 00007FF7873C31B1
RegQueryValueExW.ADVAPI32 ref: 00007FF7873C31E3
RegCloseKey.ADVAPI32 ref: 00007FF7873C320D

Part of subcall function 00007FF787522054: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787522071

Strings

iotuap, xrefs: 00007FF7873C31F2
Software\Microsoft\windows nt\currentversion, xrefs: 00007FF7873C319F
ProductName, xrefs: 00007FF7873C31D7

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CloseOpenQueryValue_invalid_parameter_noinfo
String ID: ProductName$Software\Microsoft\windows nt\currentversion$iotuap
API String ID: 1583418253-312185779
Opcode ID: 0973e7db58ccba645885ec6ba6b06478c82442a14c6d38ece9f8fd8e0640c410
Instruction ID: 24a2376c76658a898f251172f959cb845183bfa4d7e82c00edd417841d5b3df2
Opcode Fuzzy Hash: 0973e7db58ccba645885ec6ba6b06478c82442a14c6d38ece9f8fd8e0640c410
Instruction Fuzzy Hash: D011337165DB8582EB50DF14E884366B3A0FBC8754FD01135E68F86A58EF3CD54ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CBA20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CBADF
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CBB03

Part of subcall function 00007FF7873F8400: TlsGetValue.KERNEL32 ref: 00007FF7873F840F
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F

Part of subcall function 00007FF7873F8400: ReleaseMutex.KERNEL32 ref: 00007FF7873F86A6
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F86C3

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CBC05
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CBC2E

Strings

validity error: , xrefs: 00007FF7873CBB14, 00007FF7873CBB2C

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread$MutexReleaseValue
String ID: validity error:
API String ID: 2840059946-3630159132
Opcode ID: 4d96cfd1eccfd620eb7493c1feb5770219781f7950464fd403cc7c3c9c2ad804
Instruction ID: 9925d71f7e0afb4b0a8035d71639a3b01d6bb52cafaad6d5a905e13007d1e2c4
Opcode Fuzzy Hash: 4d96cfd1eccfd620eb7493c1feb5770219781f7950464fd403cc7c3c9c2ad804
Instruction Fuzzy Hash: 3561A421A886C295EB50BB119445379F394FF84BD4FA94039DA8F43B95DF3CE546C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CBCA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CBD3D
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CBD68
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CBE55
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CBE7E

Strings

validity warning: , xrefs: 00007FF7873CBD90

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: validity warning:
API String ID: 2882836952-3523503534
Opcode ID: b2ab466dd6d0467266276de83911bd55b650172457de475c5a2f45d08fe6271e
Instruction ID: 8768a29d1dccf2b40059cac2915717280110eb5769103589827eab2e572068db
Opcode Fuzzy Hash: b2ab466dd6d0467266276de83911bd55b650172457de475c5a2f45d08fe6271e
Instruction Fuzzy Hash: 8B518322A88AC295EB50BF11A44437DA7A0FF84BD4FA54039DA4F43B95DF3CE546C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873E7EB0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 103threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873E7EE6
GetCurrentThreadId.KERNEL32 ref: 00007FF7873E7F17
GetCurrentThreadId.KERNEL32 ref: 00007FF7873E7F3F

Strings

xmlNewEntityInputStream entity = NULL, xrefs: 00007FF7873E7EC8
new input from entity: %s, xrefs: 00007FF7873E7F65

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: new input from entity: %s$xmlNewEntityInputStream entity = NULL
API String ID: 2882836952-972125157
Opcode ID: 2f6558647664a530bdd548ccb30aac2b30fc9ffc8b46766f0aaccdfbc6a3813e
Instruction ID: 9b09085f1ffd1dfbd169c38e71362a34fe8b4f787c2dbe9d6dca637c25c931ec
Opcode Fuzzy Hash: 2f6558647664a530bdd548ccb30aac2b30fc9ffc8b46766f0aaccdfbc6a3813e
Instruction Fuzzy Hash: FD413D22E49B8695EF54AB24D484378A3A1FF44B84FE45439D60E42F95DF3CE887C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C3230 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 00007FF7873C3260
RegQueryValueExW.ADVAPI32 ref: 00007FF7873C3292
RegCloseKey.ADVAPI32 ref: 00007FF7873C32B4

Strings

NanoServer, xrefs: 00007FF7873C3286
Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels, xrefs: 00007FF7873C324A

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: NanoServer$Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels
API String ID: 3677997916-218722125
Opcode ID: 9de69367eb79942b6999c6a22687235655297ca43ad7d4f859e2aba061d7b515
Instruction ID: 88c86ec555c0f762bffecad17d27e50a4ae87999efa49e34348b5bb8e16d7256
Opcode Fuzzy Hash: 9de69367eb79942b6999c6a22687235655297ca43ad7d4f859e2aba061d7b515
Instruction Fuzzy Hash: 63014871618B4587DB10DF54E48025AF7B0FBC53A1FA00135E68E46A68EF7DD549CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CC180 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32 ref: 00007FF7873CC1B9
WaitForSingleObject.KERNEL32 ref: 00007FF7873CC1D1
ReleaseMutex.KERNEL32 ref: 00007FF7873CC398

Strings

20910, xrefs: 00007FF7873CC29E

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: Mutex$CreateObjectReleaseSingleWait
String ID: 20910
API String ID: 1430916145-651562331
Opcode ID: 0ff2e438b55700f3966b6345843ab6c5399d50f66c6b88b259071fa36c712247
Instruction ID: 698af1ef1bdc473d01d823890bf662101c18789f1a4c4aacd00161e12124556e
Opcode Fuzzy Hash: 0ff2e438b55700f3966b6345843ab6c5399d50f66c6b88b259071fa36c712247
Instruction Fuzzy Hash: D551DD35B45B8197EB49DF25E9842A8B3A9FB48754FA04135DB6D43320EF38A1B5C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873FA920 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873FA9F9
GetCurrentThreadId.KERNEL32 ref: 00007FF7873FAA29

Strings

1.0, xrefs: 00007FF7873FA92D
building doc, xrefs: 00007FF7873FA94F, 00007FF7873FAA5B

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: 1.0$building doc
API String ID: 2882836952-1485071487
Opcode ID: ab748a1eb382fa2a6644bf2e2e9bd5702e9b59f06130db8c70fc9ed90bb2961b
Instruction ID: 038318b6e0a012054535b190de2364e1e7baf56d96f3c5f43ead7c4beb74e699
Opcode Fuzzy Hash: ab748a1eb382fa2a6644bf2e2e9bd5702e9b59f06130db8c70fc9ed90bb2961b
Instruction Fuzzy Hash: 1031C221B8978286FF14BF24E505379A291BF45794FE84138DA0E07BD5DF3CA486C762

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873C3940 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873C39A1
GetCurrentThreadId.KERNEL32 ref: 00007FF7873C39D2
GetCurrentThreadId.KERNEL32 ref: 00007FF7873C39F6

Strings

creating buffer, xrefs: 00007FF7873C3958, 00007FF7873C3A3A

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: creating buffer
API String ID: 2882836952-1293518637
Opcode ID: 3aeccfd6cbc0167159185b6e5c41b63c20093ff1370626c4eb80ff635688e309
Instruction ID: db956f80aa5e4f5073ff7d3bbebe1ea2f71e2500efe148af82843796fa53f334
Opcode Fuzzy Hash: 3aeccfd6cbc0167159185b6e5c41b63c20093ff1370626c4eb80ff635688e309
Instruction Fuzzy Hash: AD319532D587828AEB50BF20E441669B3A4FF44B58FE40039D64E07B95DF3CE592CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7875583F8 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

ReadConsoleInputW.KERNEL32(?,?,00000001,00007FF7875234DB,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF787558424
GetLastError.KERNEL32(?,?,00000001,00007FF7875234DB,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF787558430
CloseHandle.KERNEL32(?,?,00000001,00007FF7875234DB,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF787558448
ReadConsoleInputW.KERNEL32(?,?,00000001,00007FF7875234DB,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF787558463

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: ConsoleInputRead$CloseErrorHandleLast
String ID:
API String ID: 1281600104-0
Opcode ID: 5dadf27e18cd4d24055bb03c872bde3c924215dc274fff9c63ed01f8c75272c4
Instruction ID: ee51aab550f8c2098d2c004494357dfe9a902e7f49463f428d94953fb36a7141
Opcode Fuzzy Hash: 5dadf27e18cd4d24055bb03c872bde3c924215dc274fff9c63ed01f8c75272c4
Instruction Fuzzy Hash: 03015E21B48A4185E700AB56A880025E260FF49BF0FE84230FE6F8B7A5DE2CE942C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787558484 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

SetConsoleMode.KERNEL32(?,?,00000001,00007FF7875234C9,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF787558499
GetLastError.KERNEL32(?,?,00000001,00007FF7875234C9,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF7875584A5
CloseHandle.KERNEL32(?,?,00000001,00007FF7875234C9,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF7875584BD
SetConsoleMode.KERNEL32(?,?,00000001,00007FF7875234C9,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF7875584D1

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: ConsoleMode$CloseErrorHandleLast
String ID:
API String ID: 281222627-0
Opcode ID: 5042438b5366288b93bd0864bfd035a793b8a9d63f17b5ec7a6471537c82c5a3
Instruction ID: 7afa19786445571a8b829be3e7dd848d772e7da9dfc3269b122fa24f03e14e28
Opcode Fuzzy Hash: 5042438b5366288b93bd0864bfd035a793b8a9d63f17b5ec7a6471537c82c5a3
Instruction Fuzzy Hash: CDF03620F4854282E744B755F880139A391BF887B5BF44230E93FCA2D0DE2CF957C220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7875581D8 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,00000001,00007FF7875234C2,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF7875581EF
GetLastError.KERNEL32(?,?,00000001,00007FF7875234C2,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF7875581FB
CloseHandle.KERNEL32(?,?,00000001,00007FF7875234C2,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF787558213
GetConsoleMode.KERNEL32(?,?,00000001,00007FF7875234C2,?,?,?,?,?,?,?,?,?,?,00000000,00007FF78752341E), ref: 00007FF787558228

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: ConsoleMode$CloseErrorHandleLast
String ID:
API String ID: 281222627-0
Opcode ID: dac8c2fd57bab7397dc3a524215fcff2247686e978ec7c66e2154c916769b172
Instruction ID: b184f01c033eb29837682c08c6bd58423da7f3fab023e5175fae585b786e9e5d
Opcode Fuzzy Hash: dac8c2fd57bab7397dc3a524215fcff2247686e978ec7c66e2154c916769b172
Instruction Fuzzy Hash: 29F0D010B9894241EB44BB66E895139E251BF49BF0BE45230F93FCA6E5DE2CF856C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873FA400 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 204threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873FA66E
GetCurrentThreadId.KERNEL32 ref: 00007FF7873FA69E

Strings

building internal subset, xrefs: 00007FF7873FA46B, 00007FF7873FA4E4, 00007FF7873FA542, 00007FF7873FA593

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: building internal subset
API String ID: 2882836952-240863968
Opcode ID: 4c1a31863fc6b3aadb37eb0f2a7540e603e17eb7b52021f1597a21d9cb033087
Instruction ID: 1835a419a5439574edadcf375bab7fc885689c6b2a4771c1968a5ea56fc84f85
Opcode Fuzzy Hash: 4c1a31863fc6b3aadb37eb0f2a7540e603e17eb7b52021f1597a21d9cb033087
Instruction Fuzzy Hash: 9E918322E4979286FF54AF209540339A394FF86B84FA55538CA4F07B91DF3CE492D361

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7875132BC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7875132E9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78751331C

Strings

, xrefs: 00007FF78751346A

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-3916222277
Opcode ID: 77b0b188abfd7b2aedc0283303e3e1dbd78a6c9f1d6d28293b1eec24a1065b90
Instruction ID: 9fd388690488ea0550ca5f9130bd7a139eced8e99935c949b8f8dd4840b285e3
Opcode Fuzzy Hash: 77b0b188abfd7b2aedc0283303e3e1dbd78a6c9f1d6d28293b1eec24a1065b90
Instruction Fuzzy Hash: 43619732D8820286E765AF25846D37CB7A1FB05B1AFB41135CA0F462D9CF6DE486C731

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873FA230 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873FA35A
GetCurrentThreadId.KERNEL32 ref: 00007FF7873FA38A

Strings

building DTD, xrefs: 00007FF7873FA280

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: building DTD
API String ID: 2882836952-2361942712
Opcode ID: 4303e45bbc63322dd7f58113ce6327ccf85abe55264047bfdbc902003f13b17a
Instruction ID: b9b71520d05032778eb65c6dc35f3e43a539a4c2ffcf4f542a49db794b1fa586
Opcode Fuzzy Hash: 4303e45bbc63322dd7f58113ce6327ccf85abe55264047bfdbc902003f13b17a
Instruction Fuzzy Hash: 2A41C422E487C286FF11BB209500379A790FF92B84FA55539DA4E03B95DF3DE492D321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF787410B00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF787410B74

Strings

creating input buffer, xrefs: 00007FF787410B1E

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: creating input buffer
API String ID: 2882836952-2602446255
Opcode ID: c022fb5a8756524c400c47d06227659890f228532e2265ff224b550d53ee020b
Instruction ID: 8558f56dce78f8a4d97207e94e7ba572db0696b9fd11f37e9703e9f23c43e2d4
Opcode Fuzzy Hash: c022fb5a8756524c400c47d06227659890f228532e2265ff224b550d53ee020b
Instruction Fuzzy Hash: 8A41BD32A48B468AEB54FF24E440268B3A4FB44B58BB90038D65E073A6DF3CE552C764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873CE440 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7873CE4A2
GetCurrentThreadId.KERNEL32 ref: 00007FF7873CE4CA

Strings

Cannot initialize memory for new link, xrefs: 00007FF7873CE4EF

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: Cannot initialize memory for new link
API String ID: 2882836952-724543864
Opcode ID: 050659ae8c563cc180d2929fa796e15dc129a8107f1aa0e3442f35d5325e88d5
Instruction ID: f0ce57c307abf3e4e92677b95de2a2b56d118271006b215514b991ffedfc0ae0
Opcode Fuzzy Hash: 050659ae8c563cc180d2929fa796e15dc129a8107f1aa0e3442f35d5325e88d5
Instruction Fuzzy Hash: 05216432A88A9281EF54EB65E440178A3A0FF84B94FE88035E60F47B65DF3CD493C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7874011F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF78740123F
GetCurrentThreadId.KERNEL32 ref: 00007FF78740126B

Strings

creating buffer, xrefs: 00007FF78740120D, 00007FF7874012AC

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread
String ID: creating buffer
API String ID: 2882836952-1293518637
Opcode ID: bb8fb26a39d48453f9ce6118874c6c63b0587de29636e1f59bb805740746dd28
Instruction ID: 16e0fef8afce3b15c498c4d3db908099b51f08349ba9b6c714f33f4779dd4057
Opcode Fuzzy Hash: bb8fb26a39d48453f9ce6118874c6c63b0587de29636e1f59bb805740746dd28
Instruction Fuzzy Hash: 97218E26E99742C6FB54BB70A041379A2A1BF80759FE44038C90F47BA6EF3CA553C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7873D0420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7873F87D0: TlsAlloc.KERNEL32(?,?,?,?,00007FF7873CAE69), ref: 00007FF7873F87F1
Part of subcall function 00007FF7873F87D0: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F87FD

GetCurrentThreadId.KERNEL32 ref: 00007FF7873D0451
GetCurrentThreadId.KERNEL32 ref: 00007FF7873D0479

Part of subcall function 00007FF7873F8400: TlsGetValue.KERNEL32 ref: 00007FF7873F840F
Part of subcall function 00007FF7873F8400: GetCurrentThreadId.KERNEL32 ref: 00007FF7873F843F

Strings

Pbm popping %d NS, xrefs: 00007FF7873D049E

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: CurrentThread$AllocValue
String ID: Pbm popping %d NS
API String ID: 3461179012-3384865362
Opcode ID: 300f315ece6cdcca9d52b372e8d7d5dc13757ca01bc2bafbd6ecdef82d1418a3
Instruction ID: d6e84e6d87a05ca2cd33855846d7f987bef16f4b5e0b35fe29b831573537997d
Opcode Fuzzy Hash: 300f315ece6cdcca9d52b372e8d7d5dc13757ca01bc2bafbd6ecdef82d1418a3
Instruction Fuzzy Hash: 8021E432A885D286EB50AB14E4887BCA7A1FF84B44FE54035DA5E47A54CF3CE483CB21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7874FD200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7874C8653), ref: 00007FF7874FD244
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7874C8653), ref: 00007FF7874FD28A

Strings

csm, xrefs: 00007FF7874FD277

Memory Dump Source

Source File: 00000006.00000002.1358807065.00007FF7873C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7873C0000, based on PE: true

Associated: 00000006.00000002.1358785469.00007FF7873C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1358939313.00007FF787575000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359013716.00007FF787647000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359043480.00007FF787649000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359059163.00007FF78764A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1359090448.00007FF787651000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff7873c0000_Sysmon64.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a7f2795f6af1119c039d5f38bd16a65c8875edd74830c5d1113c4df41eff2b6b
Instruction ID: c730071880d11e0e59c1540f8f92148421866c6f4ea81dfcd945a7f65b9d2075
Opcode Fuzzy Hash: a7f2795f6af1119c039d5f38bd16a65c8875edd74830c5d1113c4df41eff2b6b
Instruction Fuzzy Hash: BA114F32A0CB4182EB109F15E840269B7A1FB88B94FA94230EF8E07B64DF3DD552CB40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Sysmon64.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\servicereg.log

C:\servicestart.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: cmd.exePID: 7728, Parent PID: 2296

General

Windows Analysis Report
Sysmon64.exe