Windows Analysis Report
hesaphareketi_1.exe

Overview

General Information

Sample name:	hesaphareketi_1.exe
Analysis ID:	1447918
MD5:	f95b9a1c5289b35be63e254949d22041
SHA1:	6f6ea15d0e4c24b9cedc2c9d92b71de39fdcd89f
SHA256:	59488d405e3242fe18b8cc30a362da1e3170d2facc85a3d7be83fe0d7b0080ef
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Detected potential crypto function

One or more processes crash

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: hesaphareketi_1.exe	ReversingLabs: Detection: 34%
Source: hesaphareketi_1.exe	Virustotal: Detection: 36%			Perma Link

Machine Learning detection for sample

Source: hesaphareketi_1.exe

Joe Sandbox ML: detected

Source: hesaphareketi_1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Drawing.pdbMZ@ source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em\S0_4.0..tex `9\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbsP source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indoC:\Windows\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbTP source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb` source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: Microsoft.CSharp.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Users\user\Desktop\hesaphareketi_1.PDB source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.pdb` source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbH source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdblT source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb&3 source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdbb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: keti.PDB source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Dynamic.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb]R source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdblP#K source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbZ source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr

Source: Amcache.hve.3.dr

String found in binary or memory: http://upx.sf.net

Detected potential crypto function

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B881E9A	0_2_00007FFD9B881E9A
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B8845E8	0_2_00007FFD9B8845E8
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B888A40	0_2_00007FFD9B888A40
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B884698	0_2_00007FFD9B884698
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B8805D3	0_2_00007FFD9B8805D3
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B8808A5	0_2_00007FFD9B8808A5

One or more processes crash

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1072 -s 876

PE file does not import any functions

Source: hesaphareketi_1.exe

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: hesaphareketi_1.exe, 00000000.00000000.1627780843.000001D89A40C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIpogazezowamifayL vs hesaphareketi_1.exe
Source: hesaphareketi_1.exe, 00000000.00000000.1627760546.000001D89A402000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs hesaphareketi_1.exe
Source: hesaphareketi_1.exe	Binary or memory string: OriginalFilenameNativeMethods.dll" vs hesaphareketi_1.exe
Source: hesaphareketi_1.exe	Binary or memory string: OriginalFilenameIpogazezowamifayL vs hesaphareketi_1.exe

Source: classification engine

Classification label: mal52.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1072

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\91fa9421-19a8-47e7-b0ba-e9e203b2689d

Jump to behavior

Source: hesaphareketi_1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hesaphareketi_1.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hesaphareketi_1.exe	ReversingLabs: Detection: 34%
Source: hesaphareketi_1.exe	Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

File read: C:\Users\user\Desktop\hesaphareketi_1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\hesaphareketi_1.exe "C:\Users\user\Desktop\hesaphareketi_1.exe"
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1072 -s 876

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: hesaphareketi_1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: hesaphareketi_1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: hesaphareketi_1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Drawing.pdbMZ@ source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em\S0_4.0..tex `9\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbsP source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indoC:\Windows\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbTP source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb` source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: Microsoft.CSharp.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Users\user\Desktop\hesaphareketi_1.PDB source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.pdb` source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbH source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdblT source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb&3 source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdbb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: keti.PDB source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Dynamic.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb]R source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdblP#K source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbZ source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr

Binary contains a suspicious time stamp

Source: hesaphareketi_1.exe

Static PE information: 0xD7B7C12B [Thu Sep 7 05:46:19 2084 UTC]

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B8859E7 push es; retf		0_2_00007FFD9B885A27
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B8800BD pushad ; iretd		0_2_00007FFD9B8800C1

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Memory allocated: 1D89A730000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Memory allocated: 1D8B4180000 memory reserve \| memory write watch			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Queries volume information: C:\Users\user\Desktop\hesaphareketi_1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

AV Detection

Multi AV Scanner detection for submitted file

Source: hesaphareketi_1.exe	ReversingLabs: Detection: 34%
Source: hesaphareketi_1.exe	Virustotal: Detection: 36%			Perma Link

Machine Learning detection for sample

Source: hesaphareketi_1.exe

Joe Sandbox ML: detected

Source: hesaphareketi_1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Drawing.pdbMZ@ source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em\S0_4.0..tex `9\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbsP source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indoC:\Windows\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbTP source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb` source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: Microsoft.CSharp.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Users\user\Desktop\hesaphareketi_1.PDB source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.pdb` source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbH source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdblT source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb&3 source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdbb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: keti.PDB source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Dynamic.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb]R source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdblP#K source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbZ source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr

Source: Amcache.hve.3.dr

String found in binary or memory: http://upx.sf.net

Detected potential crypto function

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B881E9A	0_2_00007FFD9B881E9A
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B8845E8	0_2_00007FFD9B8845E8
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B888A40	0_2_00007FFD9B888A40
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B884698	0_2_00007FFD9B884698
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B8805D3	0_2_00007FFD9B8805D3
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B8808A5	0_2_00007FFD9B8808A5

One or more processes crash

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1072 -s 876

PE file does not import any functions

Source: hesaphareketi_1.exe

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: hesaphareketi_1.exe, 00000000.00000000.1627780843.000001D89A40C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIpogazezowamifayL vs hesaphareketi_1.exe
Source: hesaphareketi_1.exe, 00000000.00000000.1627760546.000001D89A402000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs hesaphareketi_1.exe
Source: hesaphareketi_1.exe	Binary or memory string: OriginalFilenameNativeMethods.dll" vs hesaphareketi_1.exe
Source: hesaphareketi_1.exe	Binary or memory string: OriginalFilenameIpogazezowamifayL vs hesaphareketi_1.exe

Source: classification engine

Classification label: mal52.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1072

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\91fa9421-19a8-47e7-b0ba-e9e203b2689d

Jump to behavior

Source: hesaphareketi_1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hesaphareketi_1.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: hesaphareketi_1.exe	ReversingLabs: Detection: 34%
Source: hesaphareketi_1.exe	Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

File read: C:\Users\user\Desktop\hesaphareketi_1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\hesaphareketi_1.exe "C:\Users\user\Desktop\hesaphareketi_1.exe"
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1072 -s 876

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: hesaphareketi_1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: hesaphareketi_1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: hesaphareketi_1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Drawing.pdbMZ@ source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em\S0_4.0..tex `9\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbsP source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indoC:\Windows\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Core.pdbTP source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb` source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: Microsoft.CSharp.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Users\user\Desktop\hesaphareketi_1.PDB source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Windows.Forms.pdb` source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbH source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdblT source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb&3 source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdbb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Core.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: keti.PDB source: hesaphareketi_1.exe, 00000000.00000002.1794662194.000000033FCF4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Dynamic.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb]R source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1794842691.000001D89A5EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Core.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdblP#K source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbZ source: hesaphareketi_1.exe, 00000000.00000002.1795845051.000001D8B48C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER2B2E.tmp.dmp.3.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2B2E.tmp.dmp.3.dr

Binary contains a suspicious time stamp

Source: hesaphareketi_1.exe

Static PE information: 0xD7B7C12B [Thu Sep 7 05:46:19 2084 UTC]

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B8859E7 push es; retf		0_2_00007FFD9B885A27
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Code function: 0_2_00007FFD9B8800BD pushad ; iretd		0_2_00007FFD9B8800C1

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Memory allocated: 1D89A730000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Memory allocated: 1D8B4180000 memory reserve \| memory write watch			Jump to behavior

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Queries volume information: C:\Users\user\Desktop\hesaphareketi_1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi_1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi_1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

ID:	1447918
Product:	CloudBasic
Start time:	12:29:01
Start date:	27.05.2024
Sample:	hesaphareketi_1.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	f95b9a1c5289b35be63e254949d22041
SHA1:	6f6ea15d0e4c24b9cedc2c9d92b71de39fdcd89f
SHA256:	59488d405e3242fe18b8cc30a362da1e3170d2facc85a3d7be83fe0d7b0080ef
Filetype:	Win64 Executable GUI Net Framework (217006/5) 49.88%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_hesaphareketi_1._249f7061c93968d61f11176880c786d0825038ed_7ae9667d_914613ef-3e3c-4d5a-921c-68d5898b3235\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	34BEBBA79414EF7F828747766569413B	73FD4E2D3531E7D15275CB5041AB58F155C08FE7	A585DAB64BEBA1C8336651F6455FDABD15DCDB7D7CDE0C8E803AB4F73048C7A4
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B2E.tmp.dmp	Mini DuMP crash report, 16 streams, Mon May 27 10:29:50 2024, 0x1205a4 type	A2BD6B662817A47E3141CB9FF846E740	2994D6EF2F4E481FC59461021D7BDEB7ACAD5ED9	6B55950C04F25932B6E5F84D2D691BBC9AAD87013BD7CD99298EB04F78D37867
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C57.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	5B91C020AB0E7655608DBB52C5BF7833	C7946DE13CEECF3C458FFB2600D1838D15866192	1C3E043ADA0BCDF27272BEB35E009E2ACA91C293FB25A8DBB8750DE41103E2FB
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C87.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	39726A22A44D7568EDB60040F7628C2E	2C24E5FE1B3C6D1B87A1C041681A4AEDD5039328	1A0736194F74D95C3E53F5B1E3EDE41F455EA7B6B03CE453C1A2ACB402FA050D
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	A5CC1917D84890E30CF36FFF38C0BF49	4CDCD852237D5EDBD5005A6387535AE4B5E8AAD6	644D4E347BA3610C0679CC8529458B2BA9CEDF4B4E3EF32A077EA2147A1D6E3D

Windows Analysis Report
hesaphareketi_1.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report hesaphareketi_1.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
hesaphareketi_1.exe