Edit tour

Windows Analysis Report
xploview v3.3.31.exe

Overview

General Information

Sample name:	xploview v3.3.31.exe
Analysis ID:	1408549
MD5:	0e9b5834cee3dc5760f1ec3ecf75580b
SHA1:	c883426efb8332abbde75a495abaa54cc25501e0
SHA256:	5fbdba70a71b9204b58002679e4db29024d201cc35650e6c616c8643e575cabf
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic

Creates an undocumented autostart registry key

Checks for available system drives (often done to infect USB drives)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

xploview v3.3.31.exe (PID: 5824 cmdline: C:\Users\user\Desktop\xploview v3.3.31.exe MD5: 0E9B5834CEE3DC5760F1EC3ECF75580B)

msiexec.exe (PID: 4884 cmdline: /i "C:\Users\user\AppData\Roaming\xploview\xploview 3.3.31\install\xploview.msi" TRANSFORMS=":2057" AI_SETUPEXEPATH="C:\Users\user\Desktop\xploview v3.3.31.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /exelang 2057 /noprereqs " MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 4244 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 4540 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 3DB9331CBFAEB034E030E728A3FC1106 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2696 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 11947A0328DF3383796F83CAC375CFA1 MD5: 9D09DC1EDA745A5F87553048E57620CF)

xploview.exe (PID: 6596 cmdline: "C:\Program Files (x86)\xploview\xploview.exe" MD5: 04486E6AD3ED10A8230D26431265A6B8)

cleanup

Sigma Signatures

Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: xvidvfw.dll, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 4244, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\vidc.XVID

Snort Signatures

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 178.63.148.180

Timestamp:	03/13/24-19:02:04.916450
SID:	2825564
Source Port:	49734
Destination Port:	5552
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 178.63.148.180

Timestamp:	03/13/24-19:01:59.134305
SID:	2033132
Source Port:	49734
Destination Port:	5552
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 178.63.148.180

Timestamp:	03/13/24-19:01:59.351511
SID:	2814856
Source Port:	49734
Destination Port:	5552
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.4 - Destination IP: 178.63.148.180

Timestamp:	03/13/24-19:02:04.916450
SID:	2814860
Source Port:	49734
Destination Port:	5552
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: xploview v3.3.31.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: xploview v3.3.31.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Program Files (x86)\xploview\xploview.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49734 -> 178.63.148.180:5552
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49734 -> 178.63.148.180:5552
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49734 -> 178.63.148.180:5552
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49734 -> 178.63.148.180:5552

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3ae65e.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7B6.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE872.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{14110D92-632D-4C9A-A849-98542BAE0BDA}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE8E1.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE911.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE9CD.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\xvid.ax
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\xvidcore.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\xvidvfw.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{14110D92-632D-4C9A-A849-98542BAE0BDA}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{14110D92-632D-4C9A-A849-98542BAE0BDA}\SystemFoldermsiexec.exe
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{14110D92-632D-4C9A-A849-98542BAE0BDA}\xploview.exe
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3ae660.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3ae660.msi

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIE7B6.tmp

Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: riched20.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: usp10.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: msi.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Section loaded: mstask.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: riched20.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: usp10.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: avcodec-55.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: avformat-55.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: avutil-52.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: swscale-2.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: libiconv-2.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: libgcc_s_dw2-1.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: msimg32.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: libgcc_s_dw2-1.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: libgcc_s_dw2-1.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: libgcc_s_dw2-1.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: oledlg.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: oleacc.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: devenum.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: msdmo.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: avicap32.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: msvfw32.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: thumbcache.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: policymanager.dll
Source: C:\Program Files (x86)\xploview\xploview.exe	Section loaded: msvcp110_win.dll

Source: xploview v3.3.31.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.winEXE@9/59@0/0

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\xploview

Source: C:\Users\user\Desktop\xploview v3.3.31.exe

File created: C:\Users\user\AppData\Roaming\xploview

Source: C:\Program Files (x86)\xploview\xploview.exe

Mutant created: \Sessions\1\BaseNamedObjects\xploview

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSID20B.tmp

Source: xploview v3.3.31.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\xploview v3.3.31.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\xploview v3.3.31.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\xploview v3.3.31.exe

File read: C:\Users\user\Desktop\xploview v3.3.31.exe

Source: unknown	Process created: C:\Users\user\Desktop\xploview v3.3.31.exe C:\Users\user\Desktop\xploview v3.3.31.exe
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Process created: C:\Windows\System32\msiexec.exe /i "C:\Users\user\AppData\Roaming\xploview\xploview 3.3.31\install\xploview.msi" TRANSFORMS=":2057" AI_SETUPEXEPATH="C:\Users\user\Desktop\xploview v3.3.31.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /exelang 2057 /noprereqs "
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3DB9331CBFAEB034E030E728A3FC1106 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 11947A0328DF3383796F83CAC375CFA1
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Process created: C:\Windows\System32\msiexec.exe /i "C:\Users\user\AppData\Roaming\xploview\xploview 3.3.31\install\xploview.msi" TRANSFORMS=":2057" AI_SETUPEXEPATH="C:\Users\user\Desktop\xploview v3.3.31.exe" SETUPEXEDIR="C:\Users\user\Desktop\" EXE_CMD_LINE="/exenoupdates /exelang 2057 /noprereqs "
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3DB9331CBFAEB034E030E728A3FC1106 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 11947A0328DF3383796F83CAC375CFA1
Source: unknown	Process created: C:\Program Files (x86)\xploview\xploview.exe "C:\Program Files (x86)\xploview\xploview.exe"

Source: C:\Users\user\Desktop\xploview v3.3.31.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: xploview v3.3.31.exe

Static file information: File size 10056544 > 1048576

Source: xploview v3.3.31.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: xploview v3.3.31.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: xploview v3.3.31.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: xploview v3.3.31.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: xploview v3.3.31.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: xploview v3.3.31.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: xploview v3.3.31.exe

Static PE information: real checksum: 0x5e1c6 should be: 0x9a3217

Source: C:\Users\user\Desktop\xploview v3.3.31.exe	File created: C:\Users\user\AppData\Roaming\xploview\xploview 3.3.31\install\2057.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\xvid.ax	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\xploview\avcodec-55.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\xploview\libgcc_s_dw2-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\xploview\xploview.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\xploview\libiconv-2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\xploview\swscale-2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\xploview\avformat-55.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7B6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE9CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\xploview\avutil-52.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\xvidvfw.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\xvidcore.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\xvid.ax	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE7B6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIE9CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\xvidvfw.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\SysWOW64\xvidcore.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\SysWOW64\xvid.ax

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\System32\msiexec.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 vidc.XVID
Source: C:\Windows\System32\msiexec.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32 vidc.XVID

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\xploview
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\xploview\Uninstall.lnk
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\xploview\xploview.lnk
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\xploview.lnk

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\xploview\xploview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\xploview\xploview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\xploview\xploview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\xploview\xploview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\xploview\xploview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\xploview\xploview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\xploview\xploview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\xploview\xploview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\xploview\xploview.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\xvid.ax	Jump to dropped file
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\xploview\xploview 3.3.31\install\2057.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\xploview\avcodec-55.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\xploview\xploview.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\xploview\libgcc_s_dw2-1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\xploview\libiconv-2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\xploview\swscale-2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\xploview\avformat-55.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE7B6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIE9CD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\xploview\avutil-52.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\xvidvfw.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\xvidcore.dll	Jump to dropped file

Source: C:\Users\user\Desktop\xploview v3.3.31.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	File Volume queried: C:\Users\user\AppData\Roaming\xploview\xploview 3.3.31\install FullSizeInformation
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	File Volume queried: C:\Users\user\AppData\Roaming\xploview\xploview 3.3.31\install FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Process created: C:\Windows\System32\msiexec.exe /i "c:\users\user\appdata\roaming\xploview\xploview 3.3.31\install\xploview.msi" transforms=":2057" ai_setupexepath="c:\users\user\desktop\xploview v3.3.31.exe" setupexedir="c:\users\user\desktop\" exe_cmd_line="/exenoupdates /exelang 2057 /noprereqs "
Source: C:\Users\user\Desktop\xploview v3.3.31.exe	Process created: C:\Windows\System32\msiexec.exe /i "c:\users\user\appdata\roaming\xploview\xploview 3.3.31\install\xploview.msi" transforms=":2057" ai_setupexepath="c:\users\user\desktop\xploview v3.3.31.exe" setupexedir="c:\users\user\desktop\" exe_cmd_line="/exenoupdates /exelang 2057 /noprereqs "

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\xploview\xploview.exe	Queries volume information: C:\Program Files (x86)\xploview\Resource\image\TimedShot.png VolumeInformation
Source: C:\Program Files (x86)\xploview\xploview.exe	Queries volume information: C:\Program Files (x86)\xploview\Resource\image\RecordingMovie.png VolumeInformation
Source: C:\Program Files (x86)\xploview\xploview.exe	Queries volume information: C:\Program Files (x86)\xploview\Resource\image\Setting.png VolumeInformation
Source: C:\Program Files (x86)\xploview\xploview.exe	Queries volume information: C:\Program Files (x86)\xploview\Resource\image\Help.png VolumeInformation
Source: C:\Program Files (x86)\xploview\xploview.exe	Queries volume information: C:\Program Files (x86)\xploview\Resource\image\Exit.png VolumeInformation
Source: C:\Program Files (x86)\xploview\xploview.exe	Queries volume information: C:\Program Files (x86)\xploview\Resource\image\FullScreen.PNG VolumeInformation
Source: C:\Program Files (x86)\xploview\xploview.exe	Queries volume information: C:\Program Files (x86)\xploview\Resource\image\TakeAShot.png VolumeInformation
Source: C:\Program Files (x86)\xploview\xploview.exe	Queries volume information: C:\Program Files (x86)\xploview\Resource\image\rotate\rotate.png VolumeInformation
Source: C:\Program Files (x86)\xploview\xploview.exe	Queries volume information: C:\Program Files (x86)\xploview\Resource\image\TimedShot.png VolumeInformation
Source: C:\Program Files (x86)\xploview\xploview.exe	Queries volume information: C:\Program Files (x86)\xploview\Resource\image\TimedShot.png VolumeInformation

Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents\xploview
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents\xploview
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents\xploview
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents\xploview
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents\xploview
Source: C:\Program Files (x86)\xploview\xploview.exe	Directory queried: C:\Users\user\Documents\xploview

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	32 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	1 Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Process Injection	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
xploview v3.3.31.exe	2%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\xploview\avcodec-55.dll	0%	ReversingLabs
C:\Program Files (x86)\xploview\avformat-55.dll	2%	ReversingLabs
C:\Program Files (x86)\xploview\avutil-52.dll	0%	ReversingLabs
C:\Program Files (x86)\xploview\libgcc_s_dw2-1.dll	0%	ReversingLabs
C:\Program Files (x86)\xploview\libiconv-2.dll	0%	ReversingLabs
C:\Program Files (x86)\xploview\swscale-2.dll	0%	ReversingLabs
C:\Program Files (x86)\xploview\xploview.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\xploview\xploview 3.3.31\install\2057.dll	5%	ReversingLabs
C:\Windows\Installer\MSIE7B6.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIE9CD.tmp	0%	ReversingLabs
C:\Windows\SysWOW64\xvid.ax	0%	ReversingLabs
C:\Windows\SysWOW64\xvidcore.dll	0%	ReversingLabs
C:\Windows\SysWOW64\xvidvfw.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1408549
Start date and time:	2024-03-13 19:06:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	xploview v3.3.31.exe
Detection:	MAL
Classification:	mal52.winEXE@9/59@0/0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.29.132.67, 20.114.59.183, 20.242.39.171
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, fs.microsoft.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: xploview v3.3.31.exe

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	18903
Entropy (8bit):	5.810378826750059
Encrypted:	false
SSDEEP:
MD5:	73B5018A60F5A196673CBA3CC6C1A698
SHA1:	9F632067B2C58F971F8398E2998089B73D445EEF
SHA-256:	05BF1970271821BB8E210A83742D82F0A5DA707E4819828B420BF1C879C49E42
SHA-512:	860A0DEB60352ABABF560DA14CF6C5CDCBF17B79578B4CA7CC9451126097BD3D478A2FEB7B92EB8F849E397E75DCF638486E0DB44298A690E29FA491272AC1B4
Malicious:	false
Reputation:	unknown
Preview:	...@IXOS.@.....@.mX.@.....@.....@.....@.....@.....@......&.{14110D92-632D-4C9A-A849-98542BAE0BDA}..xploview..xploview.msi.@.....@.....@.....@......xploview.exe..&.{BE8DDB59-D912-40B1-A611-AB1DCF8F99F2}.....@.....@.....@.....@.......@.....@.....@.......@......xploview......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{1B75D046-319F-482B-8D3B-309F6CC7B0D1}&.{14110D92-632D-4C9A-A849-98542BAE0BDA}.@......&.{1A1320FB-00A5-48E6-8CEC-49108623BBC4}&.{14110D92-632D-4C9A-A849-98542BAE0BDA}.@......&.{12DEE231-33BD-49F3-A8CF-A85D529F8F4C}&.{14110D92-632D-4C9A-A849-98542BAE0BDA}.@......&.{BE505CFC-20B5-4F48-B714-8EE38CE14DA4}&.{14110D92-632D-4C9A-A849-98542BAE0BDA}.@......&.{362F759C-D7AD-4266-961B-498C49D5EE38}&.{14110D92-632D-4C9A-A849-98542BAE0BDA}.@......&.{B59ED910-B5D1-457B-A79A-2BB2B32A7A9A}&.{14110D92-632D-4C9A-A849-98542BAE0BDA}.@......&.{55DBB6EF-8975-4A1E-8A0F-36666B205E73}&.{14110D92-632D-4C

Process:	C:\Users\user\Desktop\xploview v3.3.31.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	5.109921060702604
Encrypted:	false
SSDEEP:
MD5:	E44EC8298EADE7462918E5122F8781A1
SHA1:	E29EA9A99204471E8437C202A564669330F146BF
SHA-256:	F3A1B7CB94D2EB01AD75119A81168CB7AA8603E547FF089B0E6C18C4CDD95566
SHA-512:	DA8F60C632E0F2936B48E37A0CCF325A7EC72B014C8C69FC9B78481B7E73C5305C57813CD82BFB21180C5A86F3A9D5EC069CB31F5ED9B9E2719AF807AB278E6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q....{...{...{...p..{...l..{..Rich.{..........................PE..L......Q...........!......................................................................@..........................................................................................................................................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.734391236863114
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xploview v3.3.31.exe
File size:	10'056'544 bytes
MD5:	0e9b5834cee3dc5760f1ec3ecf75580b
SHA1:	c883426efb8332abbde75a495abaa54cc25501e0
SHA256:	5fbdba70a71b9204b58002679e4db29024d201cc35650e6c616c8643e575cabf
SHA512:	9e05d08724d388c8dd190e22f0096f2c3bc5b291fcd079403c48638da3ef446bd65075786b72c9374dd00badb3aa89facf61d55f4e74a7adedabf16bac605c1c
SSDEEP:	196608:NQ8KxEDLocXkt43u0Y0rrVZH71g6ZSIBd2IFpVr82QNgiD4u:LK2DLocXbg0rrPS6L2Ivp8VgUZ
TLSH:	2EA60219B3F49225E4B70B30597287B25AB5BCA0DD32D12F53C8960D2D72B84DA727F2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9.O~W.O~W.O~W.F...Z~W.Q,..H~W.F....~W.F...u~W.F...\~W.O~V...W.F....~W.F...N~W.RichO~W.........................PE..L......Q...

Entrypoint:	0x430bf7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x51CAE298 [Wed Jun 26 12:46:16 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	a702490d9998129db37a9f38c84de0b0

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x52fec	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x59000	0xd5dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x67000	0x33a0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x521a8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x46000	0x444	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x52864	0xc0	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4481f	0x44a00	0bed4f9024bd65a7f2899aa81730bfc7	False	0.5653887750455373	data	6.585677870572202	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x46000	0xe7ac	0xe800	ab62f59be994ce8c356e99cbbd1ebe6e	False	0.3014715786637931	data	4.588744159675867	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x55000	0x3ebc	0x2000	adc6664bb557a3e69bd73b243a3a2a6d	False	0.3619384765625	data	3.9545188052681777	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x59000	0xd5dc	0xd600	148700eb9908384ffa7b7aa031de0c8b	False	0.4212908878504673	data	5.234368263794012	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x67000	0x48d2	0x4a00	2f1877439405ddde88737c612e785f3c	False	0.5420713682432432	data	5.450730274899008	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE_FILE	0x59920	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
IMAGE_FILE	0x59928	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
RTF_FILE	0x59930	0x2e9	Rich Text Format data, version 1, ANSI, code page 1252	English	United States	0.5503355704697986
RTF_FILE	0x59c1c	0xa1	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033	English	United States	0.906832298136646
RT_ICON	0x59cc0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.2634146341463415
RT_ICON	0x5a328	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.3575268817204301
RT_ICON	0x5a610	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4426229508196721
RT_ICON	0x5a7f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5033783783783784
RT_ICON	0x5a920	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5146588486140725
RT_ICON	0x5b7c8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7026173285198556
RT_ICON	0x5c070	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.7644009216589862
RT_ICON	0x5c738	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.6047687861271677
RT_ICON	0x5cca0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4612033195020747
RT_ICON	0x5f248	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7181050656660413
RT_ICON	0x602f0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.780327868852459
RT_ICON	0x60c78	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.775709219858156
RT_MENU	0x610e0	0x5c	data	English	United States	0.8478260869565217
RT_MENU	0x6113c	0x2a	data	English	United States	1.0714285714285714
RT_DIALOG	0x61168	0x84	data	English	United States	0.7424242424242424
RT_DIALOG	0x611ec	0x2a6	data	English	United States	0.5132743362831859
RT_DIALOG	0x61494	0x3b4	data	English	United States	0.43248945147679324
RT_DIALOG	0x61848	0xbc	data	English	United States	0.7180851063829787
RT_DIALOG	0x61904	0x204	data	English	United States	0.560077519379845
RT_DIALOG	0x61b08	0x282	data	English	United States	0.48598130841121495
RT_DIALOG	0x61d8c	0xcc	data	English	United States	0.6911764705882353
RT_DIALOG	0x61e58	0x146	data	English	United States	0.5736196319018405
RT_DIALOG	0x61fa0	0x226	data	English	United States	0.4690909090909091
RT_DIALOG	0x621c8	0x388	data	English	United States	0.45464601769911506
RT_DIALOG	0x62550	0x1b4	data	English	United States	0.5458715596330275
RT_DIALOG	0x62704	0x136	data	English	United States	0.6064516129032258
RT_STRING	0x6283c	0x45c	data	English	United States	0.3844086021505376
RT_STRING	0x62c98	0x760	data	English	United States	0.3225635593220339
RT_STRING	0x633f8	0x2f8	data	English	United States	0.4039473684210526
RT_STRING	0x636f0	0x598	data	English	United States	0.2807262569832402
RT_STRING	0x63c88	0x3e4	StarOffice Gallery theme i, 1627418368 objects, 1st n	English	United States	0.39558232931726905
RT_STRING	0x6406c	0x7a6	data	English	United States	0.2763023493360572
RT_STRING	0x64814	0x744	data	English	United States	0.26344086021505375
RT_STRING	0x64f58	0x7b8	data	English	United States	0.22672064777327935
RT_STRING	0x65710	0x598	data	English	United States	0.3952513966480447
RT_STRING	0x65ca8	0x82	data	English	United States	0.6307692307692307
RT_GROUP_ICON	0x65d2c	0xae	data	English	United States	0.5977011494252874
RT_VERSION	0x65ddc	0x360	data	English	United States	0.4398148148148148
RT_MANIFEST	0x6613c	0x4a0	ASCII text, with very long lines (940), with CRLF line terminators	English	United States	0.4375

DLL	Import
KERNEL32.dll	EnterCriticalSection, LoadLibraryExW, GetModuleHandleW, GetModuleFileNameW, InitializeCriticalSection, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, LoadLibraryW, GetCurrentThreadId, CloseHandle, GetShortPathNameW, CreateEventW, LeaveCriticalSection, GetCommandLineW, SetCurrentDirectoryW, CreateThread, WaitForSingleObject, SetEvent, GetDriveTypeW, GetVersionExW, SetFileAttributesW, CopyFileW, GetExitCodeThread, GetCurrentProcess, FlushInstructionCache, SetLastError, lstrcmpiW, FreeLibrary, GetLastError, WriteFile, CreateFileW, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource, GetCurrentProcessId, RaiseException, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, LCMapStringA, GetConsoleMode, GetConsoleCP, InitializeCriticalSectionAndSpinCount, lstrlenW, MultiByteToWideChar, GetFileAttributesW, WideCharToMultiByte, GetModuleHandleA, RtlUnwind, LCMapStringW, GetStringTypeA, LocalAlloc, LocalFree, GetProcAddress, InterlockedExchange, LoadLibraryA, GetTempPathW, GetTempFileNameW, DeleteFileW, FindFirstFileW, FindNextFileW, RemoveDirectoryW, FindClose, CreateDirectoryW, GetLogicalDriveStringsW, GetFileSize, ReadFile, GetDiskFreeSpaceExW, GetEnvironmentVariableW, SetFilePointer, SetEndOfFile, EnumResourceLanguagesW, GetLocaleInfoW, GetSystemDefaultLangID, GetUserDefaultLangID, GetSystemTime, CreateProcessW, GetExitCodeProcess, GetWindowsDirectoryW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, GetVersion, GlobalMemoryStatus, OutputDebugStringW, GetLocalTime, FlushFileBuffers, lstrcpynW, GetSystemDirectoryW, MulDiv, TerminateThread, MoveFileW, Sleep, ResetEvent, CreateFileA, CreateNamedPipeW, ConnectNamedPipe, FormatMessageW, GetTempPathA, GetTempFileNameA, DuplicateHandle, GetStdHandle, CreateProcessA, DeleteFileA, LockFile, UnlockFile, GetStringTypeW, GetLocaleInfoA, SearchPathW, OpenProcess, TerminateProcess, GlobalLock, GlobalUnlock, GlobalAlloc, GlobalFree, lstrcmpW, HeapDestroy, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, GetProcessHeap, InterlockedCompareExchange, IsProcessorFeaturePresent, VirtualFree, VirtualAlloc, GetStartupInfoW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, ExitProcess, HeapCreate, GetModuleFileNameA, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale
USER32.dll	SetWindowPos, MapWindowPoints, GetClientRect, GetParent, GetWindowRect, SystemParametersInfoW, GetWindowLongW, GetWindow, EndDialog, CreateDialogParamW, SendMessageW, LoadImageW, GetSystemMetrics, GetForegroundWindow, LoadStringW, SetForegroundWindow, EnumWindows, GetWindowThreadProcessId, IsWindowVisible, GetDC, PeekMessageW, TranslateMessage, DispatchMessageW, CreateWindowExW, EnableWindow, ScreenToClient, PostQuitMessage, CallWindowProcW, IsWindow, GetPropW, RedrawWindow, InvalidateRect, SetWindowTextW, GetWindowTextLengthW, SetFocus, GetSystemMenu, EnableMenuItem, DestroyMenu, MsgWaitForMultipleObjects, ModifyMenuW, FindWindowW, MessageBeep, ExitWindowsEx, GetScrollRange, GetScrollPos, GetDlgCtrlID, SetPropW, RemovePropW, TrackPopupMenu, LoadMenuW, GetSubMenu, SetTimer, KillTimer, LoadIconW, ReleaseDC, GetDesktopWindow, OpenClipboard, CloseClipboard, EmptyClipboard, SetClipboardData, UnregisterClassA, PostMessageW, GetWindowTextW, DialogBoxParamW, MessageBoxW, GetActiveWindow, SetWindowLongW, DefWindowProcW, CharNextW, DestroyWindow, GetDlgItem, ShowWindow
GDI32.dll	GetDeviceCaps, DeleteObject, GetObjectW, DeleteDC, SetBkMode, GetStockObject, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, BitBlt, CreateFontIndirectW
SHELL32.dll	ShellExecuteW, SHGetFolderPathW, SHBrowseForFolderW, SHGetMalloc, SHGetPathFromIDListW, ShellExecuteExW, SHGetSpecialFolderLocation
ole32.dll	CreateStreamOnHGlobal, CreateILockBytesOnHGlobal, CoTaskMemRealloc, CoTaskMemAlloc, CoCreateInstance, CoTaskMemFree, CoUninitialize, StgCreateDocfileOnILockBytes, CoInitialize
OLEAUT32.dll	VarUI4FromStr, OleLoadPicture
SHLWAPI.dll	PathFileExistsW
COMCTL32.dll	PropertySheetW, DestroyPropertySheetPage, CreatePropertySheetPageW
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xploview v3.3.31.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Created / dropped Files

C:\Config.Msi\3ae65f.rbs

C:\Program Files (x86)\xploview\Resource\Czech.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\English.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\French.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\German.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\Hungarian.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\Italian.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\Japanese.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\Korean.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\Polish.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\Slovak.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\Spanish.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\image\Exit.png

C:\Program Files (x86)\xploview\Resource\image\FullScreen.PNG

C:\Program Files (x86)\xploview\Resource\image\Help.png

C:\Program Files (x86)\xploview\Resource\image\RecordingMovie.png

C:\Program Files (x86)\xploview\Resource\image\Setting.png

C:\Program Files (x86)\xploview\Resource\image\TakeAShot.png

C:\Program Files (x86)\xploview\Resource\image\TimedShot.png

C:\Program Files (x86)\xploview\Resource\image\log.bmp

C:\Program Files (x86)\xploview\Resource\image\rotate\180.png

C:\Program Files (x86)\xploview\Resource\image\rotate\horz.png

C:\Program Files (x86)\xploview\Resource\image\rotate\left90.png

C:\Program Files (x86)\xploview\Resource\image\rotate\right90.png

C:\Program Files (x86)\xploview\Resource\image\rotate\rotate.png

C:\Program Files (x86)\xploview\Resource\image\rotate\verz.png

C:\Program Files (x86)\xploview\Resource\zh_Hans.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\Resource\zh_Hant.lproj\Louserzable.strings

C:\Program Files (x86)\xploview\avcodec-55.dll

C:\Program Files (x86)\xploview\avformat-55.dll

C:\Program Files (x86)\xploview\avutil-52.dll

C:\Program Files (x86)\xploview\libgcc_s_dw2-1.dll

C:\Program Files (x86)\xploview\libiconv-2.dll

C:\Program Files (x86)\xploview\profile.dat

Windows Analysis Report
xploview v3.3.31.exe