Windows Analysis Report
JrE5qsYZD8.exe

Overview

General Information

Sample name: JrE5qsYZD8.exe
renamed because original name is a hash value
Original sample name: 5f4a7d44b849b744b38f11fbb131743324c84705ec16ae7a1f0789f4f35e49c2.exe
Analysis ID: 1438321
MD5: 3143cd8f56bf599b3cfddaf9152d445d
SHA1: 33b83cd5d719be2acd908834ce7336d805b35c6a
SHA256: 5f4a7d44b849b744b38f11fbb131743324c84705ec16ae7a1f0789f4f35e49c2
Tags: exe
Infos:

Detection

Score: 72
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Binary is likely a compiled AutoIt script file
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample file is different than original file name gathered from version info
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: JrE5qsYZD8.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: JrE5qsYZD8.exe ReversingLabs: Detection: 52%
Machine Learning detection for sample
Source: JrE5qsYZD8.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: JrE5qsYZD8.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 23.55.184.112:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.55.184.112:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.6:49753 version: TLS 1.2
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0060C2A2 FindFirstFileExW, 0_2_0060C2A2
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_006468EE FindFirstFileW,FindClose, 0_2_006468EE
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0064698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 0_2_0064698F
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0063D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0063D076
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0063D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0063D3A9
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00649642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00649642
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0064979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_0064979D
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00649B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_00649B2B
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0063DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 0_2_0063DBBE
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00645C97 FindFirstFileW,FindNextFileW,FindClose, 0_2_00645C97
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 23.55.184.112
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0064CE44 InternetReadFile,SetEvent,GetLastError,SetEvent, 0_2_0064CE44
Source: global traffic HTTP traffic detected: GET /m?continue=https%3A%2F%2Fwww.youtube.com%2Faccount%3Fcbrd%3D1&gl=GB&m=0&pc=yt&cm=2&hl=en&src=1 HTTP/1.1Host: consent.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: SOCS=CAAaBgiAgeuxBg; YSC=e5m9XFf1H9o; __Secure-YEC=CgsyRkM0QnNRYkNlVSi9hu6xBjIKCgJHQhIEGgAgLQ%3D%3D; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgLQ%3D%3D; PREF=f7=4000
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://consent.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5P8Saa5M9ntdoUo&MD=LVxO2v5f HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5P8Saa5M9ntdoUo&MD=LVxO2v5f HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: JrE5qsYZD8.exe, 00000000.00000003.2312157038.00000000038D5000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2312611297.00000000038D6000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000002.2314771847.00000000038D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: chromecache_83.4.dr String found in binary or memory: ff=u(["https://sandbox.google.com/tools/feedback/"]),gf=u(["https://www.google.cn/tools/feedback/"]),hf=u(["https://help.youtube.com/tools/feedback/"]),jf=u(["https://asx-frontend-staging.corp.google.com/inapp/"]),kf=u(["https://asx-frontend-staging.corp.google.com/tools/feedback/"]),lf=u(["https://localhost.corp.google.com/inapp/"]),mf=u(["https://localhost.proxy.googlers.com/inapp/"]),nf=S(Pe),of=[S(Qe),S(Re)],pf=[S(Se),S(Te),S(Ue),S(Ve),S(We),S(Xe),S(Ye),S(Ze),S($e),S(af)],qf=[S(bf),S(cf)],rf= equals www.youtube.com (Youtube)
Source: JrE5qsYZD8.exe, 00000000.00000003.2308087425.000000000383C000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2308443995.0000000003861000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2312661987.00000000038DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: JrE5qsYZD8.exe, 00000000.00000003.2312661987.00000000038DA000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2312997328.00000000038ED000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2312157038.00000000038D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account[ equals www.youtube.com (Youtube)
Source: JrE5qsYZD8.exe, 00000000.00000003.2312661987.00000000038DA000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2312997328.00000000038ED000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2312157038.00000000038D5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountd equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: www.youtube.com
Source: global traffic DNS traffic detected: DNS query: consent.youtube.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: play.google.com
Source: unknown HTTP traffic detected: POST /_/ConsentUi/browserinfo?f.sid=-9033751170818193612&bl=boq_identityfrontenduiserver_20240505.08_p1&hl=en&gl=GB&_reqid=57061&rt=j HTTP/1.1Host: consent.youtube.comConnection: keep-aliveContent-Length: 118sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Same-Domain: 1sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://consent.youtube.comX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://consent.youtube.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: SOCS=CAAaBgiAgeuxBg; YSC=e5m9XFf1H9o; __Secure-YEC=CgsyRkM0QnNRYkNlVSi9hu6xBjIKCgJHQhIEGgAgLQ%3D%3D; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgLQ%3D%3D; PREF=f7=4000; OTZ=7547871_48_52_123900_48_436380
Source: chromecache_83.4.dr String found in binary or memory: http://localhost.corp.google.com/inapp/
Source: chromecache_83.4.dr String found in binary or memory: http://localhost.proxy.googlers.com/inapp/
Source: chromecache_85.4.dr String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_83.4.dr String found in binary or memory: https://apis.google.com/js/client.js
Source: chromecache_83.4.dr String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/inapp/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-frontend-autopush.corp.google.co.uk/tools/feedback/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-frontend-autopush.corp.google.com/inapp/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-frontend-autopush.corp.google.com/tools/feedback/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-frontend-autopush.corp.google.de/inapp/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-frontend-autopush.corp.google.de/tools/feedback/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-frontend-staging.corp.google.com/inapp/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-frontend-staging.corp.google.com/tools/feedback/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/inapp/
Source: chromecache_83.4.dr String found in binary or memory: https://asx-help-frontend-autopush.corp.youtube.com/tools/feedback/
Source: chromecache_83.4.dr String found in binary or memory: https://feedback-pa.clients6.google.com
Source: chromecache_83.4.dr String found in binary or memory: https://feedback.googleusercontent.com/resources/annotator.css
Source: chromecache_83.4.dr String found in binary or memory: https://feedback.googleusercontent.com/resources/render_frame2.html
Source: chromecache_83.4.dr String found in binary or memory: https://feedback2-test.corp.google.com/inapp/%
Source: chromecache_83.4.dr String found in binary or memory: https://feedback2-test.corp.google.com/tools/feedback/%
Source: chromecache_83.4.dr String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/inapp/%
Source: chromecache_83.4.dr String found in binary or memory: https://feedback2-test.corp.googleusercontent.com/tools/feedback/%
Source: chromecache_101.4.dr String found in binary or memory: https://fonts.google.com/license/googlerestricted
Source: chromecache_101.4.dr String found in binary or memory: https://fonts.gstatic.com/s/youtubesans/v30/Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3
Source: chromecache_83.4.dr String found in binary or memory: https://gstatic.com/uservoice/surveys/resources/
Source: chromecache_83.4.dr String found in binary or memory: https://help.youtube.com/tools/feedback/
Source: chromecache_83.4.dr String found in binary or memory: https://localhost.corp.google.com/inapp/
Source: chromecache_83.4.dr String found in binary or memory: https://localhost.proxy.googlers.com/inapp/
Source: chromecache_94.4.dr String found in binary or memory: https://play.google.com
Source: chromecache_88.4.dr String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_83.4.dr String found in binary or memory: https://sandbox.google.com/inapp/
Source: chromecache_83.4.dr String found in binary or memory: https://sandbox.google.com/inapp/%
Source: chromecache_83.4.dr String found in binary or memory: https://sandbox.google.com/tools/feedback/
Source: chromecache_83.4.dr String found in binary or memory: https://sandbox.google.com/tools/feedback/%
Source: chromecache_83.4.dr String found in binary or memory: https://scone-pa.clients6.google.com
Source: chromecache_83.4.dr String found in binary or memory: https://stagingqual-feedback-pa-googleapis.sandbox.google.com
Source: chromecache_94.4.dr String found in binary or memory: https://support.google.com
Source: chromecache_83.4.dr String found in binary or memory: https://support.google.com/
Source: chromecache_83.4.dr String found in binary or memory: https://support.google.com/inapp/
Source: chromecache_83.4.dr String found in binary or memory: https://support.google.com/inapp/%
Source: chromecache_83.4.dr String found in binary or memory: https://test-scone-pa-googleapis.sandbox.google.com
Source: chromecache_85.4.dr String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: chromecache_83.4.dr String found in binary or memory: https://www.google.cn/tools/feedback/
Source: chromecache_83.4.dr String found in binary or memory: https://www.google.cn/tools/feedback/%
Source: chromecache_94.4.dr String found in binary or memory: https://www.google.com
Source: chromecache_83.4.dr String found in binary or memory: https://www.google.com/tools/feedback
Source: chromecache_83.4.dr String found in binary or memory: https://www.google.com/tools/feedback/
Source: chromecache_83.4.dr String found in binary or memory: https://www.google.com/tools/feedback/%
Source: chromecache_83.4.dr String found in binary or memory: https://www.google.com/tools/feedback/help_panel_binary.js
Source: chromecache_94.4.dr String found in binary or memory: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js
Source: chromecache_83.4.dr String found in binary or memory: https://www.gstatic.com/uservoice/feedback/client/web/
Source: chromecache_83.4.dr String found in binary or memory: https://www.gstatic.com/uservoice/surveys/resources/
Source: JrE5qsYZD8.exe, 00000000.00000002.2314882594.00000000038F4000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2308250823.0000000003845000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2313520255.0000000003874000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2309857328.000000000386D000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000002.2314771847.00000000038D7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/account
Source: JrE5qsYZD8.exe, 00000000.00000003.2312661987.00000000038DA000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2312997328.00000000038ED000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2312157038.00000000038D5000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000003.2312611297.00000000038D6000.00000004.00000020.00020000.00000000.sdmp, JrE5qsYZD8.exe, 00000000.00000002.2314882594.00000000038F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/accountd
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown HTTPS traffic detected: 23.55.184.112:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.55.184.112:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49698 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.6:49753 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0064EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_0064EAFF
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0064ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_0064ED6A
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0064EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_0064EAFF
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0063AB9C GetKeyState,GetKeyboardState,SetKeyboardState,PostMessageW,SendInput, 0_2_0063AB9C
Installs a raw input device (often for capturing keystrokes)
Source: JrE5qsYZD8.exe, 00000000.00000003.2308087425.000000000383C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _WINAPI_GETRAWINPUTDATAfu memstr_dcd7dad0-0
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00669576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 0_2_00669576

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: JrE5qsYZD8.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: JrE5qsYZD8.exe, 00000000.00000000.2053693967.0000000000692000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_0ba295ce-0
Source: JrE5qsYZD8.exe, 00000000.00000000.2053693967.0000000000692000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_1a356fed-8
Source: JrE5qsYZD8.exe String found in binary or memory: This is a third-party compiled AutoIt script. memstr_623c22e9-1
Source: JrE5qsYZD8.exe String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_ab4b8b24-6
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0063D5EB: CreateFileW,DeviceIoControl,CloseHandle, 0_2_0063D5EB
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00631201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00631201
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0063E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 0_2_0063E8F6
Detected potential crypto function
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00642046 0_2_00642046
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005D8060 0_2_005D8060
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00638298 0_2_00638298
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0060E4FF 0_2_0060E4FF
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0060676B 0_2_0060676B
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00664873 0_2_00664873
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005DCAF0 0_2_005DCAF0
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005FCAA0 0_2_005FCAA0
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005ECC39 0_2_005ECC39
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00606DD9 0_2_00606DD9
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005EB119 0_2_005EB119
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005D91C0 0_2_005D91C0
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005F1394 0_2_005F1394
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005F781B 0_2_005F781B
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005E997D 0_2_005E997D
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005D7920 0_2_005D7920
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005F7A4A 0_2_005F7A4A
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005F7CA7 0_2_005F7CA7
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0065BE44 0_2_0065BE44
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00609EEE 0_2_00609EEE
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005DBF40 0_2_005DBF40
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: String function: 005EF9F2 appears 40 times
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: String function: 005F0A30 appears 46 times
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: String function: 005D9CB3 appears 31 times
Sample file is different than original file name gathered from version info
Source: JrE5qsYZD8.exe, 00000000.00000003.2311451407.00000000010CC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2311302080.0000000001156000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAMENEdn vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2311302080.0000000001156000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2308509227.0000000003707000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuildr Unk++ vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2308509227.0000000003707000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuild OSBu_[S vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2313535992.00000000010DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2308630724.0000000003711000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuildr Unk++ vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2308630724.0000000003711000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuild OSBu_[S vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2311765455.0000000003723000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuildr Unk++ vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2311765455.0000000003723000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuild OSBu_[S vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2312105709.000000000372B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuildr Unk++ vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2312105709.000000000372B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuild OSBu_[S vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2311132562.00000000010C6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2311156892.00000000010CA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2313405524.000000000372C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuildr Unk++ vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2313405524.000000000372C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuild OSBu> vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000002.2314085820.00000000010DF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2311025988.0000000001111000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAMENEdn vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2311025988.0000000001111000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename`_[ vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2312837160.000000000372B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuildr Unk++ vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2312837160.000000000372B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ents|CompanyName|FileDescription|FileVersion|InternalName|LegalCopyright|LegalTrademarks|OriginalFilename|ProductName|ProductVersion|PrivateBuild|SpecialBuild OSBu_[S vs JrE5qsYZD8.exe
Source: JrE5qsYZD8.exe, 00000000.00000003.2311259090.00000000010CB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs JrE5qsYZD8.exe
Uses 32bit PE files
Source: JrE5qsYZD8.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal72.evad.winEXE@33/48@12/6
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_006437B5 GetLastError,FormatMessageW, 0_2_006437B5
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_006310BF AdjustTokenPrivileges,CloseHandle, 0_2_006310BF
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_006316C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 0_2_006316C3
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_006451CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 0_2_006451CD
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0065A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 0_2_0065A67C
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0064648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize, 0_2_0064648E
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005D42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 0_2_005D42A2
Source: JrE5qsYZD8.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe File read: C:\Program Files\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: JrE5qsYZD8.exe ReversingLabs: Detection: 52%
Source: unknown Process created: C:\Users\user\Desktop\JrE5qsYZD8.exe "C:\Users\user\Desktop\JrE5qsYZD8.exe"
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1992,i,15798156456821883579,10995336834318236159,262144 /prefetch:8
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1992,i,15798156456821883579,10995336834318236159,262144 /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: JrE5qsYZD8.exe Static file information: File size 1166336 > 1048576
Source: JrE5qsYZD8.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: JrE5qsYZD8.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: JrE5qsYZD8.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: JrE5qsYZD8.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: JrE5qsYZD8.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: JrE5qsYZD8.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: JrE5qsYZD8.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: JrE5qsYZD8.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: JrE5qsYZD8.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: JrE5qsYZD8.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: JrE5qsYZD8.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: JrE5qsYZD8.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_005D42DE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005F0A76 push ecx; ret 0_2_005F0A89
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005EF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_005EF98E
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00661C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 0_2_00661C41
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Window / User API: threadDelayed 1352 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe API coverage: 3.6 %
Sleep loop found (likely to delay execution)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Thread sleep count: Count: 1352 delay: -10 Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0060C2A2 FindFirstFileExW, 0_2_0060C2A2
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_006468EE FindFirstFileW,FindClose, 0_2_006468EE
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0064698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 0_2_0064698F
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0063D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0063D076
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0063D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0063D3A9
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00649642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00649642
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0064979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_0064979D
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00649B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_00649B2B
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0063DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 0_2_0063DBBE
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00645C97 FindFirstFileW,FindNextFileW,FindClose, 0_2_00645C97
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_005D42DE
Source: JrE5qsYZD8.exe, 00000000.00000002.2314771847.00000000038D7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}-qq

Anti Debugging
barindex
Found API chain indicative of debugger detection
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0064EAA2 BlockInput, 0_2_0064EAA2
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00602622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00602622
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_005D42DE
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005F4CE8 mov eax, dword ptr fs:[00000030h] 0_2_005F4CE8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00630B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 0_2_00630B62
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00602622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00602622
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005F083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_005F083F
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005F09D5 SetUnhandledExceptionFilter, 0_2_005F09D5
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005F0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_005F0C21
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00631201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00631201
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00612BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 0_2_00612BA5
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0063B226 SendInput,keybd_event, 0_2_0063B226
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_006522DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event, 0_2_006522DA
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account Jump to behavior
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00630B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 0_2_00630B62
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00631663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 0_2_00631663
Source: JrE5qsYZD8.exe Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: JrE5qsYZD8.exe Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005F0698 cpuid 0_2_005F0698
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00648195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW, 0_2_00648195
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0062D27A GetUserNameW, 0_2_0062D27A
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_0060B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 0_2_0060B952
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_005D42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_005D42DE
OS version to string mapping found (often used in BOTs)
Source: JrE5qsYZD8.exe Binary or memory string: WIN_81
Source: JrE5qsYZD8.exe, 00000000.00000003.2310993371.00000000011A2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: WIN_XP
Source: JrE5qsYZD8.exe Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: JrE5qsYZD8.exe Binary or memory string: WIN_XPe
Source: JrE5qsYZD8.exe Binary or memory string: WIN_VISTA
Source: JrE5qsYZD8.exe Binary or memory string: WIN_7
Source: JrE5qsYZD8.exe Binary or memory string: WIN_8
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00651204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, 0_2_00651204
Source: C:\Users\user\Desktop\JrE5qsYZD8.exe Code function: 0_2_00651806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 0_2_00651806
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1438321 Sample: JrE5qsYZD8.exe Startdate: 08/05/2024 Architecture: WINDOWS Score: 72 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Binary is likely a compiled AutoIt script file 2->32 34 Machine Learning detection for sample 2->34 7 JrE5qsYZD8.exe 1 2->7         started        process3 signatures4 36 Binary is likely a compiled AutoIt script file 7->36 38 Found API chain indicative of debugger detection 7->38 40 Found API chain indicative of sandbox detection 7->40 10 chrome.exe 1 7->10         started        process5 dnsIp6 16 192.168.2.4 unknown unknown 10->16 18 192.168.2.6, 443, 49195, 49698 unknown unknown 10->18 20 239.255.255.250 unknown Reserved 10->20 13 chrome.exe 10->13         started        process7 dnsIp8 22 www.google.com 142.251.215.228, 443, 49724, 49735 GOOGLEUS United States 13->22 24 play.google.com 142.251.215.238, 443, 49751, 49752 GOOGLEUS United States 13->24 26 3 other IPs or domains 13->26
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.251.33.78
 consent.youtube.com United States
15169 GOOGLEUS false
142.251.215.228
 www.google.com United States
15169 GOOGLEUS false
142.251.215.238
 play.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false

Private

IP
192.168.2.4
192.168.2.6

Contacted Domains

Name IP Active
youtube-ui.l.google.com 142.250.69.206 true
play.google.com 142.251.215.238 true
consent.youtube.com 142.251.33.78 true
www.google.com 142.251.215.228 true
www.youtube.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://consent.youtube.com/_/ConsentUi/browserinfo?f.sid=-9033751170818193612&bl=boq_identityfrontenduiserver_20240505.08_p1&hl=en&gl=GB&_reqid=157061&rt=j false
    		high
    https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Faccount%3Fcbrd%3D1&gl=GB&m=0&pc=yt&cm=2&hl=en&src=1 false
      		high
      https://consent.youtube.com/_/ConsentUi/browserinfo?f.sid=-9033751170818193612&bl=boq_identityfrontenduiserver_20240505.08_p1&hl=en&gl=GB&_reqid=57061&rt=j false
        		high
        https://play.google.com/log?format=json&hasfast=true&authuser=0 false
          		high
          https://www.google.com/favicon.ico false
            		high