Edit tour

Windows Analysis Report
DRAWING_SHEET_P02405912916 .exe

Overview

General Information

Sample name:	DRAWING_SHEET_P02405912916 .exe
Analysis ID:	1447921
MD5:	55ec2edc07564f96fadc8681055baf07
SHA1:	76c6df27f51e184509b81812589a59e9aa552f9c
SHA256:	e6bb64329e3641fc55e523d5778edeae726d41e3481e26fd0855e1710508cc7b
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DRAWING_SHEET_P02405912916 .exe (PID: 4028 cmdline: "C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe" MD5: 55EC2EDC07564F96FADC8681055BAF07)

MSBuild.exe (PID: 4708 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7140 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 1144 cmdline: C:\Windows\system32\WerFault.exe -u -p 4028 -s 1016 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.officeemailbackup.com", "Username": "1177y@officeemailbackup.com", "Password": "*L_n.e3}D?ky"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2625649867.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2625649867.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2625649867.0000000002D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2625649867.0000000002D71000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DRAWING_SHEET_P02405912916 .exe PID: 4028	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DRAWING_SHEET_P02405912916 .exe PID: 4028	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DRAWING_SHEET_P02405912916 .exe PID: 4028	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DRAWING_SHEET_P02405912916 .exe PID: 4028	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: MSBuild.exe PID: 4708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 4708	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31715:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31787:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31811:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318a3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3190d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3197f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a15:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31aa5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33515:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33587:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33611:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336a3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3370d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3377f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33815:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338a5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31715:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31787:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31811:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318a3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3190d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3197f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a15:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31aa5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33515:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df5d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33587:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dfcf:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33611:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e059:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336a3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0eb:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3370d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e155:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3377f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e1c7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33815:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e25d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338a5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e2ed:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33515:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33587:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33611:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336a3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3370d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3377f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33815:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338a5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb0e9ac0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb0e9ac0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb0e9ac0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0xfd395:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x137ddd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xfd407:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x137e4f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xfd491:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x137ed9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xfd523:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x137f6b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xfd58d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x137fd5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xfd5ff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x138047:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xfd695:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1380dd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xfd725:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x13816d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 13 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 179.43.183.46, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 4708, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 172.67.74.152, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 4708, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.officeemailbackup.com", "Username": "1177y@officeemailbackup.com", "Password": "*L_n.e3}D?ky"}

Multi AV Scanner detection for submitted file

Source: DRAWING_SHEET_P02405912916 .exe	ReversingLabs: Detection: 34%
Source: DRAWING_SHEET_P02405912916 .exe	Virustotal: Detection: 34%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: DRAWING_SHEET_P02405912916 .exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DRAWING_SHEET_P02405912916 .exe PID: 4028, type: MEMORYSTR

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.8:49705 version: TLS 1.2

Source: DRAWING_SHEET_P02405912916 .exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdbRSDS source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdbMZ@ source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERC8A7.tmp.dmp.6.dr

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

Code function: 4x nop then jmp 00007FFB4B1B56C6h

0_2_00007FFB4B1B5529

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 179.43.183.46:587

Source: Joe Sandbox View	IP Address: 179.43.183.46 179.43.183.46
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View	ASN Name: PLI-ASCH PLI-ASCH
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 179.43.183.46:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 95.101.54.129
Source: unknown	TCP traffic detected without corresponding DNS query: 95.101.54.129
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.officeemailbackup.com

Source: MSBuild.exe, 00000002.00000002.2629786574.0000000005EE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2625649867.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: MSBuild.exe, 00000002.00000002.2629786574.0000000005EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: MSBuild.exe, 00000002.00000002.2629786574.0000000005EE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2625649867.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2629786574.0000000005F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: MSBuild.exe, 00000002.00000002.2629786574.0000000005EE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2625649867.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2622599305.00000000010D1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2629786574.0000000005F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: MSBuild.exe, 00000002.00000002.2625649867.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.officeemailbackup.com
Source: MSBuild.exe, 00000002.00000002.2629786574.0000000005EE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2625649867.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2629786574.0000000005F0B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2622599305.00000000010D1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2629786574.0000000005F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: MSBuild.exe, 00000002.00000002.2625649867.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://officeemailbackup.com
Source: MSBuild.exe, 00000002.00000002.2625649867.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2625649867.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: MSBuild.exe, 00000002.00000002.2625649867.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: MSBuild.exe, 00000002.00000002.2625649867.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: MSBuild.exe, 00000002.00000002.2629786574.0000000005EE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2625649867.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2622599305.00000000010D1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2629786574.0000000005F71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.8:49705 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, JovGVW.cs	.Net Code: oz3TFs
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.raw.unpack, JovGVW.cs	.Net Code: oz3TFs

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb0e9ac0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1BE7A0	0_2_00007FFB4B1BE7A0
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B1045	0_2_00007FFB4B1B1045
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B7048	0_2_00007FFB4B1B7048
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1C770A	0_2_00007FFB4B1C770A
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1C1709	0_2_00007FFB4B1C1709
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1BEB81	0_2_00007FFB4B1BEB81
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B1DB3	0_2_00007FFB4B1B1DB3
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B74A0	0_2_00007FFB4B1B74A0
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1BB540	0_2_00007FFB4B1BB540
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1BB538	0_2_00007FFB4B1BB538
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B0AC8	0_2_00007FFB4B1B0AC8
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B0AD3	0_2_00007FFB4B1B0AD3
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1C2E9F	0_2_00007FFB4B1C2E9F
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B0AF3	0_2_00007FFB4B1B0AF3
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1C7761	0_2_00007FFB4B1C7761
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B09F2	0_2_00007FFB4B1B09F2
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B92D8	0_2_00007FFB4B1B92D8
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B2A0001	0_2_00007FFB4B2A0001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0142E848	2_2_0142E848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0142DBF0	2_2_0142DBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0142BA59	2_2_0142BA59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01424A98	2_2_01424A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01423E80	2_2_01423E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_014241C8	2_2_014241C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0142DBF0	2_2_0142DBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066B7ED0	2_2_066B7ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066B572B	2_2_066B572B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066B6738	2_2_066B6738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066BC2D8	2_2_066BC2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066BB380	2_2_066BB380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066B31B8	2_2_066B31B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066B5E23	2_2_066B5E23
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066B77F0	2_2_066B77F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066BE500	2_2_066BE500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066B2378	2_2_066B2378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066B0040	2_2_066B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_066B0006	2_2_066B0006

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4028 -s 1016

Source: DRAWING_SHEET_P02405912916 .exe

Static PE information: No import functions for PE file found

Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIkonojutumifuquL vs DRAWING_SHEET_P02405912916 .exe
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4934848b-6622-4d0c-968c-4044090c39c2.exe4 vs DRAWING_SHEET_P02405912916 .exe
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs DRAWING_SHEET_P02405912916 .exe
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAsiaMorning.exe" vs DRAWING_SHEET_P02405912916 .exe
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000000.1366354137.000001DFC92F2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs DRAWING_SHEET_P02405912916 .exe
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1459949780.000001DFC9670000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameNativeMethods.dll" vs DRAWING_SHEET_P02405912916 .exe
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1459990900.000001DFC9710000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameIkonojutumifuquL vs DRAWING_SHEET_P02405912916 .exe
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000000.1366380678.000001DFC932A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAsiaMorning.exe" vs DRAWING_SHEET_P02405912916 .exe
Source: DRAWING_SHEET_P02405912916 .exe	Binary or memory string: OriginalFilenameNativeMethods.dll" vs DRAWING_SHEET_P02405912916 .exe
Source: DRAWING_SHEET_P02405912916 .exe	Binary or memory string: OriginalFilenameAsiaMorning.exe" vs DRAWING_SHEET_P02405912916 .exe

Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb0e9ac0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: DRAWING_SHEET_P02405912916 .exe, --.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, yNzg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, yNzg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, yNzg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, yNzg.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, KNymkUU5gB.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, KNymkUU5gB.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, LPE.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, LPE.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@6/5@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4028

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\9849cb27-11b2-45e9-b4de-2caef96fe43b

Jump to behavior

Source: DRAWING_SHEET_P02405912916 .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DRAWING_SHEET_P02405912916 .exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DRAWING_SHEET_P02405912916 .exe	ReversingLabs: Detection: 34%
Source: DRAWING_SHEET_P02405912916 .exe	Virustotal: Detection: 34%

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

File read: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe "C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe"
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4028 -s 1016
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: DRAWING_SHEET_P02405912916 .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DRAWING_SHEET_P02405912916 .exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: DRAWING_SHEET_P02405912916 .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdbRSDS source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdbMZ@ source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.Core.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.ni.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WERC8A7.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERC8A7.tmp.dmp.6.dr

Source: DRAWING_SHEET_P02405912916 .exe

Static PE information: 0xACD24723 [Thu Nov 17 14:05:23 2061 UTC]

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1BC260 pushad ; retf	0_2_00007FFB4B1C2A6A
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B7C3A push eax; ret	0_2_00007FFB4B1B7C3B
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B1B00BD pushad ; iretd	0_2_00007FFB4B1B00C1
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Code function: 0_2_00007FFB4B2A0001 push esp; retf 4810h	0_2_00007FFB4B2A0312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_0142B692 push ss; iretd	2_2_0142B699
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_01420C77 push edi; retf	2_2_01420C7A

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: DRAWING_SHEET_P02405912916 .exe PID: 4028, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Memory allocated: 1DFC9540000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Memory allocated: 1DFE30E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2D20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2C20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199405	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1197953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1197843	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2527			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7312			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1928	Thread sleep count: 2527 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1928	Thread sleep count: 7312 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -99731s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -99622s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -99514s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -99391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -99282s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -99157s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -99032s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -98907s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -98563s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -98438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -98313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -98188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -97969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -97844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -97735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -97610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -97485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -97360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -97235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -97110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -96985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -96860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -96735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -96610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1199843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1199734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1199625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1199515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1199405s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1199281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1199172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1199062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1198937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1198828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1198718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1198609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1198500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1198390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1198281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1198172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1198062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1197953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2056	Thread sleep time: -1197843s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99731	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99622	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99514	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99157	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99032	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98907	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1200000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199405	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1199062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1198062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1197953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 1197843	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000002.00000002.2629786574.0000000005F0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: AC1008	Jump to behavior

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"			Jump to behavior
Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"			Jump to behavior

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe	Queries volume information: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb0e9ac0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2625649867.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2625649867.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2625649867.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DRAWING_SHEET_P02405912916 .exe PID: 4028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4708, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb0e9ac0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2625649867.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DRAWING_SHEET_P02405912916 .exe PID: 4028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4708, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1b3940.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb1ee388.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DRAWING_SHEET_P02405912916 .exe.1dfdb0e9ac0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2625649867.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2625649867.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2625649867.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DRAWING_SHEET_P02405912916 .exe PID: 4028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 4708, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	311 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	231 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 Process Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	151 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DRAWING_SHEET_P02405912916 .exe	34%	ReversingLabs	Win64.Trojan.Generic
DRAWING_SHEET_P02405912916 .exe	35%	Virustotal		Browse
DRAWING_SHEET_P02405912916 .exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://mail.officeemailbackup.com	0%	Avira URL Cloud	safe
http://officeemailbackup.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
officeemailbackup.com	179.43.183.46	true	true	unknown
api.ipify.org	172.67.74.152	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
mail.officeemailbackup.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2625649867.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
http://mail.officeemailbackup.com	MSBuild.exe, 00000002.00000002.2625649867.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	MSBuild.exe, 00000002.00000002.2629786574.0000000005EE1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2625649867.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2622599305.00000000010D1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2629786574.0000000005F71000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	DRAWING_SHEET_P02405912916 .exe, 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	MSBuild.exe, 00000002.00000002.2625649867.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	MSBuild.exe, 00000002.00000002.2625649867.0000000002D21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://officeemailbackup.com	MSBuild.exe, 00000002.00000002.2625649867.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
179.43.183.46	officeemailbackup.com	Panama		51852	PLI-ASCH	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447921
Start date and time:	2024-05-27 12:25:40 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DRAWING_SHEET_P02405912916 .exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@6/5@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 89% Number of executed functions: 77 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.0, 20.190.159.68, 40.126.31.73, 20.190.159.23, 40.126.31.69, 40.126.31.67, 40.126.31.71, 20.190.159.73, 52.182.143.212, 20.12.23.50, 192.229.221.95, 20.166.126.56, 52.165.164.15
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdcus15.centralus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:26:36	API Interceptor	2584387x Sleep call for process: MSBuild.exe modified
06:26:39	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
179.43.183.46	NEW ORDER.xlsx	Get hash	malicious	FormBook	Browse	lupasgroup.com/Files/promise.exe
179.43.183.46	a6cdf669_by_Libranalysis.xlsx	Get hash	malicious	AgentTesla	Browse	lupasgroup.com/Files/s68r0hZ49vns9tk.exe
172.67.74.152	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	https://url.za.m.mimecastprotect.com/s/dkSWC8qYY1u9oZr4unuoBl?domain=t.co	Get hash	malicious	Unknown	Browse	192.229.221.95
	script.js	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://mary-7.ispring.com/app/preview/df7e6170-1759-11ef-9d84-1e3de37e0836	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://monespace.uegar.com/guest/64/Login/Register?t=blhzTG1lSW5OZ25rMHFpaGl1enJyVllwc2FWSnpuRlNWaklmNDdFb0lRRE5IbDIxMkNFZlFyNytvaEFhZWJzR2V4a0JKUEVHeGNoQTRIY2VpRmhXSE1PRXBDMFYyRTkrSVVrMHBoWVpocHc9	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://verify-signinoutlexchangeadmin.com/MBill@microsoft.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	192.229.221.95
	https://paypalgiftcardgenerator.pages.dev/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://mcguffinboots.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://help-fb-recovery-center.github.io/notification/index.html	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://fix-to-all-issues-review-verification-form-aa-submit-wheat.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	http://y6ss1.shop/	Get hash	malicious	Unknown	Browse	192.229.221.95
api.ipify.org	proforma invoice.bit.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	INV 0983 OSY 240524_PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://attachments.office.net/owa/cmangava%40tharisa.com/service.svc/s/GetAttachmentThumbnail?id=AAMkAGE2N2U5NmFkLWIzMjEtNGMwNS1iOWVlLWExNTBkNDk2NTZjMABGAAAAAAAsNFCwuPDISrln6MRbSR5lBwBC4JDOFd8jTJozG%2BNc7YRrAAAAmcUBAABu3YNoqzF8SLI68HoWeAXzAAFRD3sAAAABEgAQAOXLRvcdfU5Kkg7Zx598XsI%3D&thumbnailType=2&token=eyJhbGciOiJSUzI1NiIsImtpZCI6IkU1RDJGMEY4REE5M0I2NzA5QzQzQTlFOEE2MTQzQzAzRDYyRjlBODAiLCJ0eXAiOiJKV1QiLCJ4NXQiOiI1ZEx3LU5xVHRuQ2NRNm5vcGhROEE5WXZtb0EifQ.eyJvcmlnaW4iOiJodHRwczovL291dGxvb2sub2ZmaWNlLmNvbSIsInVjIjoiNTIyZjRhMmM0ZWRmNDA4NjkxMWIwMGFjYzE2ZjgzNzEiLCJzaWduaW5fc3RhdGUiOlsiZHZjX21uZ2QiLCJkdmNfY21wIiwiZHZjX2RtamQiLCJpbmtub3dubnR3ayJdLCJ2ZXIiOiJFeGNoYW5nZS5DYWxsYmFjay5WMSIsImFwcGN0eHNlbmRlciI6Ik93YURvd25sb2FkQDliMDgyOWI5LWJlMzktNDMzNi1hNzY2LWY4YzlkYzJjNzFhNCIsImlzc3JpbmciOiJXVyIsImFwcGN0eCI6IntcIm1zZXhjaHByb3RcIjpcIm93YVwiLFwicHVpZFwiOlwiMTE1MzkwNjY2MTMxNDQwNDI4NFwiLFwic2NvcGVcIjpcIk93YURvd25sb2FkXCIsXCJvaWRcIjpcIjUyMjAyODA5LWJkODUtNGZmOC04NTUwLTRjNzUwZjNhODNlZFwiLFwicHJpbWFyeXNpZFwiOlwiUy0xLTUtMjEtMTAxMjEyODM0Ni0xNjc3NDQzNDQtMTE3Njg1Mjg2MS0xMzc4MTQ4OVwifSIsIm5iZiI6MTcxNjc5NjM3MCwiZXhwIjoxNzE2Nzk2NjcwLCJpc3MiOiIwMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDBAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiYXVkIjoiMDAwMDAwMDItMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL2F0dGFjaG1lbnRzLm9mZmljZS5uZXRAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiaGFwcCI6Im93YSJ9.QgmzIBWvZG6gLwDV2SGPl9TdStXctQrpU_xiIGcL5I4eoVDkUPzqcKcrSAnwOD_E73nNMbCTWC-kgcJIIFGhLmh8iFWITRD5MwmaJN23JV7c8rlmzHlxnoqm8tPo98Soui3XZZYSaJZVTruXDBhUCiweHA69qYSoZDJxVUYZDvl5KvXMWJkA_ui0Vq1Sw7pPL5h9t4_QlGAarVBz6O9q21EGSBoX_hWPpcaEGJwoBDVeI-G6VvbkXzy9bJEMEZ6N-WzLyQtuKS9HVJBafIkUxsf0pIhhnJUluyukhnQ1dZohnpQr8e5v0Xoa3SObMFt_C5SeZHG2hFyxqFdeBhKQ_w&X-OWA-CANARY=X-OWA-CANARY_cookie_is_null_or_empty&owa=outlook.office.com&scriptVer=20240517003.15&clientId=1A63CAED249649AEBB5264A13128C2B5&animation=true&persistenceId=80cb7b14-7011-42b1-acde-250d928510f9	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	PO_27052024.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Remittance#26856.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://interface01.nsxtlmv.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://christiantensen478345.pages.dev/help/contact/45367900411236/	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://louiss-comxinh.pages.dev/help/contact/388061959224233	Get hash	malicious	Unknown	Browse	172.67.74.152
	http://worker-office-onedrive.td5xtn-b1lv7f1ymscd0.workers.dev/favicon.ico	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	z23mypdfscanner-invoice3535.bat	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLI-ASCH	http://inclucedhealth.com	Get hash	malicious	Unknown	Browse	81.17.29.149
	http://salecinask.live	Get hash	malicious	Unknown	Browse	179.43.159.147
	[EXTERNAL] New file received.eml	Get hash	malicious	HTMLPhisher	Browse	190.211.254.196
	zlONcFaXkc.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	179.43.170.230
	n3R8WBIjhz.exe	Get hash	malicious	FormBook	Browse	81.17.29.146
	0ekwLomWKo.exe	Get hash	malicious	FormBook	Browse	81.17.29.147
	travel itinerary.exe	Get hash	malicious	Remcos	Browse	81.17.17.70
	General Specification -INVACO PVT.exe	Get hash	malicious	FormBook	Browse	81.17.29.146
	2024#U5e74#U4e00#U5b63#U5ea6#U5458#U5de5#U8865#U52a9#U6d41#U7a0b.docx.doc	Get hash	malicious	Unknown	Browse	179.43.180.99
	2024#U5e74#U4e00#U5b63#U5ea6#U5458#U5de5#U8865#U52a9#U6d41#U7a0b.docx.doc	Get hash	malicious	Unknown	Browse	179.43.180.99
CLOUDFLARENETUS	PAYMENT COPY.exe	Get hash	malicious	FormBook	Browse	172.67.137.210
	Shipping Document.exe	Get hash	malicious	FormBook	Browse	172.67.190.203
	NUEVA ORDEN DE COMPRAsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	PAYMENT ADVICE.exe	Get hash	malicious	FormBook	Browse	172.67.190.203
	proforma invoice.bit.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	INV 0983 OSY 240524_PDF.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	ZAMOWIEN.EXE.exe	Get hash	malicious	DBatLoader, FormBook	Browse	172.67.190.76
	https://attachments.office.net/owa/cmangava%40tharisa.com/service.svc/s/GetAttachmentThumbnail?id=AAMkAGE2N2U5NmFkLWIzMjEtNGMwNS1iOWVlLWExNTBkNDk2NTZjMABGAAAAAAAsNFCwuPDISrln6MRbSR5lBwBC4JDOFd8jTJozG%2BNc7YRrAAAAmcUBAABu3YNoqzF8SLI68HoWeAXzAAFRD3sAAAABEgAQAOXLRvcdfU5Kkg7Zx598XsI%3D&thumbnailType=2&token=eyJhbGciOiJSUzI1NiIsImtpZCI6IkU1RDJGMEY4REE5M0I2NzA5QzQzQTlFOEE2MTQzQzAzRDYyRjlBODAiLCJ0eXAiOiJKV1QiLCJ4NXQiOiI1ZEx3LU5xVHRuQ2NRNm5vcGhROEE5WXZtb0EifQ.eyJvcmlnaW4iOiJodHRwczovL291dGxvb2sub2ZmaWNlLmNvbSIsInVjIjoiNTIyZjRhMmM0ZWRmNDA4NjkxMWIwMGFjYzE2ZjgzNzEiLCJzaWduaW5fc3RhdGUiOlsiZHZjX21uZ2QiLCJkdmNfY21wIiwiZHZjX2RtamQiLCJpbmtub3dubnR3ayJdLCJ2ZXIiOiJFeGNoYW5nZS5DYWxsYmFjay5WMSIsImFwcGN0eHNlbmRlciI6Ik93YURvd25sb2FkQDliMDgyOWI5LWJlMzktNDMzNi1hNzY2LWY4YzlkYzJjNzFhNCIsImlzc3JpbmciOiJXVyIsImFwcGN0eCI6IntcIm1zZXhjaHByb3RcIjpcIm93YVwiLFwicHVpZFwiOlwiMTE1MzkwNjY2MTMxNDQwNDI4NFwiLFwic2NvcGVcIjpcIk93YURvd25sb2FkXCIsXCJvaWRcIjpcIjUyMjAyODA5LWJkODUtNGZmOC04NTUwLTRjNzUwZjNhODNlZFwiLFwicHJpbWFyeXNpZFwiOlwiUy0xLTUtMjEtMTAxMjEyODM0Ni0xNjc3NDQzNDQtMTE3Njg1Mjg2MS0xMzc4MTQ4OVwifSIsIm5iZiI6MTcxNjc5NjM3MCwiZXhwIjoxNzE2Nzk2NjcwLCJpc3MiOiIwMDAwMDAwMi0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDBAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiYXVkIjoiMDAwMDAwMDItMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL2F0dGFjaG1lbnRzLm9mZmljZS5uZXRAOWIwODI5YjktYmUzOS00MzM2LWE3NjYtZjhjOWRjMmM3MWE0IiwiaGFwcCI6Im93YSJ9.QgmzIBWvZG6gLwDV2SGPl9TdStXctQrpU_xiIGcL5I4eoVDkUPzqcKcrSAnwOD_E73nNMbCTWC-kgcJIIFGhLmh8iFWITRD5MwmaJN23JV7c8rlmzHlxnoqm8tPo98Soui3XZZYSaJZVTruXDBhUCiweHA69qYSoZDJxVUYZDvl5KvXMWJkA_ui0Vq1Sw7pPL5h9t4_QlGAarVBz6O9q21EGSBoX_hWPpcaEGJwoBDVeI-G6VvbkXzy9bJEMEZ6N-WzLyQtuKS9HVJBafIkUxsf0pIhhnJUluyukhnQ1dZohnpQr8e5v0Xoa3SObMFt_C5SeZHG2hFyxqFdeBhKQ_w&X-OWA-CANARY=X-OWA-CANARY_cookie_is_null_or_empty&owa=outlook.office.com&scriptVer=20240517003.15&clientId=1A63CAED249649AEBB5264A13128C2B5&animation=true&persistenceId=80cb7b14-7011-42b1-acde-250d928510f9	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://docsend.com/view/qqrrvyqndwsixgqg	Get hash	malicious	Phisher	Browse	172.67.137.213
	https://url.za.m.mimecastprotect.com/s/dkSWC8qYY1u9oZr4unuoBl?domain=t.co	Get hash	malicious	Unknown	Browse	104.17.2.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	NUEVA ORDEN DE COMPRAsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	172.67.74.152
	proforma invoice.bit.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	INV 0983 OSY 240524_PDF.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	PO_27052024.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	01vwXiyQ8K.exe	Get hash	malicious	Quasar	Browse	172.67.74.152
	xA4LQYIndy.exe	Get hash	malicious	DCRat	Browse	172.67.74.152
	https://kruekanlogin.gitbook.io/	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://fbreview-requestnow.github.io/ajaz	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://mega.nz/file/wncXiYhZ#ABJEpmoiGH0hIeVVKQy7V_ALtGclDnJ4rFrDjwZ8kDE	Get hash	malicious	DCRat	Browse	172.67.74.152
	wtrD6RiHlm.exe	Get hash	malicious	RedLine	Browse	172.67.74.152

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_DRAWING_SHEET_P0_b088b2a1ea814e2a8d34d4abad448ba01bd6d55_a0fac049_8c9e2797-37ac-4a2f-8c4c-14b00a3cae93\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.008734203284085
Encrypted:	false
SSDEEP:	192:dfI+T/havE0UnUVaWBHpSszuiFaZ24lO8un:mCha/UnUVamHcszuiFaY4lO8m
MD5:	58A51B70160DB4FB50644AF698EA165B
SHA1:	A3F493B724B84BFA49C7C1970D79968BFDD09D14
SHA-256:	7ED1883088F1FF8B9F1AEAD8D341366DFB90D85A4645A3FBD574283EF78D73B6
SHA-512:	E3442ABD6D0E8A1CB2476BEDB49125FBD3E977EF958F3B050B1276D2E12989B2DE631E842366AFD6FC8B57AB269D1772AC0A91A8B08712BA2C5B41C8EA62A38A
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.2.7.9.1.9.5.2.1.5.8.9.9.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.2.7.9.1.9.5.7.4.7.1.5.0.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.c.9.e.2.7.9.7.-.3.7.a.c.-.4.a.2.f.-.8.c.4.c.-.1.4.b.0.0.a.3.c.a.e.9.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.8.a.1.8.9.d.e.-.0.f.1.3.-.4.e.a.7.-.b.d.5.1.-.8.c.c.9.3.2.3.c.9.f.7.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.D.R.A.W.I.N.G._.S.H.E.E.T._.P.0.2.4.0.5.9.1.2.9.1.6. ...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.s.i.a.M.o.r.n.i.n.g...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.b.c.-.0.0.0.1.-.0.0.1.4.-.c.7.b.1.-.2.2.5.7.2.0.b.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.4.6.e.3.5.0.8.f.a.5.c.8.f.c.8.2.7.9.c.9.f.a.6.a.d.c.8.5.9.a.2.0.0.0.0.0.0.0.0.!.0.0.0.0.7.6.c.6.d.f.2.7.f.5.1.e.1.8.4.5.0.9.b.8.1.8.1.2.5.8.9.a.5.9.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8A7.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Mon May 27 10:26:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	391458
Entropy (8bit):	3.2910056862527832
Encrypted:	false
SSDEEP:	3072:6CHX0PQVcSrg1vAKij81CCq+h3+vvwFgoc4ipL:6V0sRiGqs3QSWZp
MD5:	0E80CCD006800771C31AAFECF8CC6DCA
SHA1:	4BB53964590157923A3C6E71F63C1196D0E48318
SHA-256:	99A68F47074DB526E6C58507B2BB02725D2668768D20075B7590049306B8AEEF
SHA-512:	5430889EACE7396528F4C191A4CFA178680E511066D97F5E45CBA16086A68751BC40554781FC11C409B999CB3CCAC21C876E4BB23FB5280145BCEAA76F494748
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........_Tf....................................$...............(.......dH..Fv..........l.......8...........T...........`(...............9...........:..............................................................................eJ.......;......Lw......................T............_Tf.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9E0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8666
Entropy (8bit):	3.716205473846341
Encrypted:	false
SSDEEP:	192:R6l7wVeJHku6YSLwVFgmf4MrprH89bFNAfy3m:R6lXJEu6Y+wVFgmf4MeF6f7
MD5:	F6A868449980FE9F8E0BA884078659C4
SHA1:	95590216A2B17E4909CBF48A41309C2296C6B72E
SHA-256:	53B8231D093B3DFD1087B33890749F83BD266827A4E50B9284673D3E6C6B8FD5
SHA-512:	242B754E9D67D789DFF10371925139BAD89B1115937711636EF532BBA352B4142979EF934A667CE40D7CF179E41467F1EA76058ECE57E29A50C3E9EC1CBAA3DF
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA10.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4844
Entropy (8bit):	4.577948559647039
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg771I97wWpW8VYMYm8M4JA/vQFKcyq85sIc5K3wItIcPd:uIjfSI78J7VoJA/Dclc3wItI8d
MD5:	D0986D4CAC5E1E25A1716252C0A17239
SHA1:	5FD947CBB293A545A484D3EF24665227BC5D9257
SHA-256:	872D78584F86174137650B45CE9DF8EC1B3914DA67BDF51908491B0441EE74D1
SHA-512:	9B36F639C3B2C868992D694C38D8137840C1AC2391C040427B6568BE06CC02EB39A61DA791936E3946BB41B39B1F10493A01A658A9DB317F2F89330E59C39B63
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="341369" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372398453063531
Encrypted:	false
SSDEEP:	6144:qFVfpi6ceLP/9skLmb0nyWWSPtaJG8nAge35OlMMhA2AX4WABlguNmiL:CV19yWWI/glMM6kF7oq
MD5:	903A190F414B0D20C843478511510D99
SHA1:	7FBE0949D0D2EEE38E1C3C026508146683B0B373
SHA-256:	E67089628F204ABAE5B4FF079AEC3826762D068E8A5A05D11CF422B4025E1E65
SHA-512:	C8C2D899EBFAC287C1FDA82715DE2713295A86C79237F40DEC2C82F55FF2AD3A0C15538949944D77D9212235D06EE618813DF13B24EA9E8A9F7C74FDBC7EE9C9
Malicious:	false
Reputation:	low
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmB..Y ................................................................................................................................................................................................................................................................................................................................................u.m........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.790001715501068
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	DRAWING_SHEET_P02405912916 .exe
File size:	811'981 bytes
MD5:	55ec2edc07564f96fadc8681055baf07
SHA1:	76c6df27f51e184509b81812589a59e9aa552f9c
SHA256:	e6bb64329e3641fc55e523d5778edeae726d41e3481e26fd0855e1710508cc7b
SHA512:	e608b0e0533095390c1502237a2520a47a73c22f44ec770053c0696517b366192f95eb678314c0ff23c4d25e4553ecc06328e5663c60fd310c408480b02917ba
SSDEEP:	12288:JDkAKHUnZJWA1m70Z/bil4pOgpU9v3JD7ORS/EMpxeW:JtK0nZJWumwFa47pU9/wUp
TLSH:	AC0512BC76AF9E83D7BDC674E12161018BB9A0137B43E706C504E8DE0E127C666568EF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...#G............"...0..g..\............ ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xACD24723 [Thu Nov 17 14:05:23 2061 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3a000	0x35c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x38768	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x36784	0x36800	2254db206425a6cd5cc5748fbb77b5ab	False	0.5601526662844036	data	6.356905705356032	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x3a000	0x35c	0x400	725380ceea7cb4798ffb7ee981170699	False	0.3505859375	data	2.7092544734172037	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3a058	0x304	data			0.4261658031088083

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 12:26:27.561940908 CEST	49677	80	192.168.2.8	192.229.211.108
May 27, 2024 12:26:30.514995098 CEST	49673	443	192.168.2.8	23.206.229.226
May 27, 2024 12:26:30.827639103 CEST	49672	443	192.168.2.8	23.206.229.226
May 27, 2024 12:26:31.265054941 CEST	49676	443	192.168.2.8	52.182.143.211
May 27, 2024 12:26:32.530610085 CEST	49671	443	192.168.2.8	204.79.197.203
May 27, 2024 12:26:32.890140057 CEST	49677	80	192.168.2.8	192.229.211.108
May 27, 2024 12:26:36.453241110 CEST	49705	443	192.168.2.8	172.67.74.152
May 27, 2024 12:26:36.453288078 CEST	443	49705	172.67.74.152	192.168.2.8
May 27, 2024 12:26:36.453353882 CEST	49705	443	192.168.2.8	172.67.74.152
May 27, 2024 12:26:36.499742031 CEST	49705	443	192.168.2.8	172.67.74.152
May 27, 2024 12:26:36.499775887 CEST	443	49705	172.67.74.152	192.168.2.8
May 27, 2024 12:26:36.994316101 CEST	443	49705	172.67.74.152	192.168.2.8
May 27, 2024 12:26:36.994426966 CEST	49705	443	192.168.2.8	172.67.74.152
May 27, 2024 12:26:36.998353958 CEST	49705	443	192.168.2.8	172.67.74.152
May 27, 2024 12:26:36.998367071 CEST	443	49705	172.67.74.152	192.168.2.8
May 27, 2024 12:26:36.998811960 CEST	443	49705	172.67.74.152	192.168.2.8
May 27, 2024 12:26:37.046210051 CEST	49705	443	192.168.2.8	172.67.74.152
May 27, 2024 12:26:37.051131010 CEST	49705	443	192.168.2.8	172.67.74.152
May 27, 2024 12:26:37.094532967 CEST	443	49705	172.67.74.152	192.168.2.8
May 27, 2024 12:26:37.220448971 CEST	443	49705	172.67.74.152	192.168.2.8
May 27, 2024 12:26:37.220535994 CEST	443	49705	172.67.74.152	192.168.2.8
May 27, 2024 12:26:37.220587969 CEST	49705	443	192.168.2.8	172.67.74.152
May 27, 2024 12:26:37.226619959 CEST	49705	443	192.168.2.8	172.67.74.152
May 27, 2024 12:26:37.819555044 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:37.826430082 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:37.826508999 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:38.859607935 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:38.859814882 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:38.864717960 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.052341938 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.052495956 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:39.057461977 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.246319056 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.246942043 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:39.251823902 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.448019981 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.448039055 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.448051929 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.448064089 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.448139906 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:39.448139906 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:39.534554958 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.562220097 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:39.567168951 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.755116940 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.757997990 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:39.762912035 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.981606007 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:39.982667923 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:39.987564087 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.124346018 CEST	49673	443	192.168.2.8	23.206.229.226
May 27, 2024 12:26:40.175823927 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.176908016 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:40.181862116 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.384634972 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.385324001 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:40.390181065 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.436827898 CEST	49672	443	192.168.2.8	23.206.229.226
May 27, 2024 12:26:40.577971935 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.578216076 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:40.583188057 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.787401915 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.787697077 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:40.792612076 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.874327898 CEST	49676	443	192.168.2.8	52.182.143.211
May 27, 2024 12:26:40.980164051 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.983258963 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:40.983315945 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:40.983315945 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:40.984203100 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:40.988295078 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.988327026 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.988337994 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:40.989006042 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:41.299314976 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:26:41.343086004 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:26:42.176721096 CEST	443	49704	23.206.229.226	192.168.2.8
May 27, 2024 12:26:42.176810026 CEST	49704	443	192.168.2.8	23.206.229.226
May 27, 2024 12:26:43.514962912 CEST	49677	80	192.168.2.8	192.229.211.108
May 27, 2024 12:27:21.956506968 CEST	49703	80	192.168.2.8	95.101.54.129
May 27, 2024 12:27:21.963407040 CEST	80	49703	95.101.54.129	192.168.2.8
May 27, 2024 12:27:21.963469982 CEST	49703	80	192.168.2.8	95.101.54.129
May 27, 2024 12:28:17.749365091 CEST	49707	587	192.168.2.8	179.43.183.46
May 27, 2024 12:28:17.754437923 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:28:18.134430885 CEST	587	49707	179.43.183.46	192.168.2.8
May 27, 2024 12:28:18.135097027 CEST	49707	587	192.168.2.8	179.43.183.46

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 12:26:36.430185080 CEST	57660	53	192.168.2.8	1.1.1.1
May 27, 2024 12:26:36.438568115 CEST	53	57660	1.1.1.1	192.168.2.8
May 27, 2024 12:26:37.722546101 CEST	60823	53	192.168.2.8	1.1.1.1
May 27, 2024 12:26:37.818027020 CEST	53	60823	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 27, 2024 12:26:36.430185080 CEST	192.168.2.8	1.1.1.1	0x49b7	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 27, 2024 12:26:37.722546101 CEST	192.168.2.8	1.1.1.1	0x38bc	Standard query (0)	mail.officeemailbackup.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 27, 2024 12:26:36.438568115 CEST	1.1.1.1	192.168.2.8	0x49b7	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
May 27, 2024 12:26:36.438568115 CEST	1.1.1.1	192.168.2.8	0x49b7	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
May 27, 2024 12:26:36.438568115 CEST	1.1.1.1	192.168.2.8	0x49b7	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
May 27, 2024 12:26:37.818027020 CEST	1.1.1.1	192.168.2.8	0x38bc	No error (0)	mail.officeemailbackup.com	officeemailbackup.com		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 12:26:37.818027020 CEST	1.1.1.1	192.168.2.8	0x38bc	No error (0)	officeemailbackup.com		179.43.183.46	A (IP address)	IN (0x0001)	false
May 27, 2024 12:26:51.199331045 CEST	1.1.1.1	192.168.2.8	0xb01	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 12:26:51.199331045 CEST	1.1.1.1	192.168.2.8	0xb01	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 27, 2024 12:27:03.586246014 CEST	1.1.1.1	192.168.2.8	0x3c10	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 27, 2024 12:27:03.586246014 CEST	1.1.1.1	192.168.2.8	0x3c10	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	172.67.74.152	443	4708	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-27 10:26:37 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-27 10:26:37 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 27 May 2024 10:26:37 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 88a54ec5ea4680d9-EWR
2024-05-27 10:26:37 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 27, 2024 12:26:38.859607935 CEST	587	49707	179.43.183.46	192.168.2.8	220-cphost21.qhoster.net ESMTP Exim 4.96.2 #2 Mon, 27 May 2024 12:26:38 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2024 12:26:38.859814882 CEST	49707	587	192.168.2.8	179.43.183.46	EHLO 648351
May 27, 2024 12:26:39.052341938 CEST	587	49707	179.43.183.46	192.168.2.8	250-cphost21.qhoster.net Hello 648351 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 27, 2024 12:26:39.052495956 CEST	49707	587	192.168.2.8	179.43.183.46	STARTTLS
May 27, 2024 12:26:39.246319056 CEST	587	49707	179.43.183.46	192.168.2.8	220 TLS go ahead

Target ID:	0
Start time:	06:26:30
Start date:	27/05/2024
Path:	C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\DRAWING_SHEET_P02405912916 .exe"
Imagebase:	0x1dfc92f0000
File size:	811'981 bytes
MD5 hash:	55EC2EDC07564F96FADC8681055BAF07
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1460235392.000001DFCB43B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1461004297.000001DFDB0E7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:26:34
Start date:	27/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:	0x910000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2625649867.0000000002D9C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2625649867.0000000002DA4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2620865574.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2625649867.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2625649867.0000000002D71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:26:34
Start date:	27/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
Imagebase:	0xd40000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:26:35
Start date:	27/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 4028 -s 1016
Imagebase:	0x7ff6f7470000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	7
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4B1B09F2 Relevance: 4.3, Strings: 3, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@qK, xrefs: 00007FFB4B1B0BA1
qK, xrefs: 00007FFB4B1B0B81
0qK, xrefs: 00007FFB4B1B0B91

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: qK$0qK$@qK
API String ID: 0-1291200079
Opcode ID: 8595515d5a768de754963cf0c6236b4a92ddd57efb46308579ca80b7e91262c4
Instruction ID: 8da316772c7cd8bb56d347b719c12c72dc6763d563ace1fd88ad379dbe6b6205
Opcode Fuzzy Hash: 8595515d5a768de754963cf0c6236b4a92ddd57efb46308579ca80b7e91262c4
Instruction Fuzzy Hash: EDD147A2B1D5524AE3067B7CFC192F96F95DF85B35B0841BBE18DCA0D3CD18688B46E0

Function 00007FFB4B1B0AD3 Relevance: 4.1, Strings: 3, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@qK, xrefs: 00007FFB4B1B0BA1
qK, xrefs: 00007FFB4B1B0B81
0qK, xrefs: 00007FFB4B1B0B91

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: qK$0qK$@qK
API String ID: 0-1291200079
Opcode ID: dd777d117935da9edcd3df40add49709263e6f3130ca6e2cbb268002b94fd481
Instruction ID: cf61659f429068b19cb5ac5e560bed14b69fb8d68b55e1fa27afd9ea3da43575
Opcode Fuzzy Hash: dd777d117935da9edcd3df40add49709263e6f3130ca6e2cbb268002b94fd481
Instruction Fuzzy Hash: B2B14792B1D6424AE3067B7CFC192F96FD5DF85B25F0481FBE18DC61D3CD18288A46A1

Function 00007FFB4B1B0AF3 Relevance: 4.1, Strings: 3, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@qK, xrefs: 00007FFB4B1B0BA1
qK, xrefs: 00007FFB4B1B0B81
0qK, xrefs: 00007FFB4B1B0B91

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: qK$0qK$@qK
API String ID: 0-1291200079
Opcode ID: 49530af5753d8b11d4714ad0005b751735fca10359ba5355e22304de042855e4
Instruction ID: 9046e9a3b5a93ce028795f4b634075815475d01c11d131d7b24a351e37b52793
Opcode Fuzzy Hash: 49530af5753d8b11d4714ad0005b751735fca10359ba5355e22304de042855e4
Instruction Fuzzy Hash: 26B159A2B1D6424AE3067B7CFC192F96BD5DF85B24F0881FBE18DC61D3CD18688646A1

Function 00007FFB4B1B0AC8 Relevance: 4.1, Strings: 3, Instructions: 379
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@qK, xrefs: 00007FFB4B1B0BA1
qK, xrefs: 00007FFB4B1B0B81
0qK, xrefs: 00007FFB4B1B0B91

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: qK$0qK$@qK
API String ID: 0-1291200079
Opcode ID: f12b95b1662c568d4010e264541c00bfb00714283b6d5d44af838f4e43c9ebb0
Instruction ID: 5cdfeefc88509919ace7fe25917a6d8d3364476a95a19d7431e000a853f5e509
Opcode Fuzzy Hash: f12b95b1662c568d4010e264541c00bfb00714283b6d5d44af838f4e43c9ebb0
Instruction Fuzzy Hash: 32B149A2B1D6424AE3067B7CFC192F96BD5DF85B24F0881FBE18DC61D3CD18288646A1

Function 00007FFB4B1B1045 Relevance: 3.3, Strings: 2, Instructions: 812
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 00007FFB4B1B1A64
8gK, xrefs: 00007FFB4B1B1072

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: 8gK$W
API String ID: 0-1701587082
Opcode ID: 27d5d4fdbcff255579ff63975712198379faa25c3b6fb3039cf839b2de0c475a
Instruction ID: bc639482115eddd4a4195d0df6f1959930c54e6fc7775e7475b1f377f1ef6c66
Opcode Fuzzy Hash: 27d5d4fdbcff255579ff63975712198379faa25c3b6fb3039cf839b2de0c475a
Instruction Fuzzy Hash: 9042F170A2CA068FE759FF38C15567973E2FF89704B15857DD48EC72A6CE28B8528B40

Function 00007FFB4B1B92D8 Relevance: 2.8, Strings: 1, Instructions: 1579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c, xrefs: 00007FFB4B1CC7CA

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: 5ce218a19439f4557fe6743cc2fc40409b4cf5a156802446d63394fe62b49492
Instruction ID: 8525d4b98c3038041b5aa897e520a43f5f8e8ae4b4eb9a3628f6b095673ae432
Opcode Fuzzy Hash: 5ce218a19439f4557fe6743cc2fc40409b4cf5a156802446d63394fe62b49492
Instruction Fuzzy Hash: C3328971A1D6868FE359EF39C4551B57BF1EF81304B1881BED08AC71E2DE28AC46CB81

Function 00007FFB4B1C1709 Relevance: 2.8, Strings: 1, Instructions: 1569COMMON

Download Yara Rule

Strings

H>$K, xrefs: 00007FFB4B1C2503

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: H>$K
API String ID: 0-1106714346
Opcode ID: 6263196ae608f3dabe7d1fea55771af59143fe4a02d22dae89432218c187f458
Instruction ID: 172b771279ffcd9e4baec386449f3d6c130e5c5959bd11f1fae981e2c5c8bac1
Opcode Fuzzy Hash: 6263196ae608f3dabe7d1fea55771af59143fe4a02d22dae89432218c187f458
Instruction Fuzzy Hash: 93B2357062CB494FD719EF38C4804A5B7E2FF95305B1485BEE58AC72A6DE34E846CB81

Function 00007FFB4B1BB540 Relevance: 2.8, Strings: 1, Instructions: 1501COMMON

Download Yara Rule

Strings

f&K, xrefs: 00007FFB4B1C4225

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: f&K
API String ID: 0-1171631576
Opcode ID: 04b85c30d093baf175f2a6c1a603a4216503be4ae1e55609ed3220f07ddc9d1d
Instruction ID: f75d87708d987300dd1cb80cf68b3398ddb55991183740104f1850c4946ea245
Opcode Fuzzy Hash: 04b85c30d093baf175f2a6c1a603a4216503be4ae1e55609ed3220f07ddc9d1d
Instruction Fuzzy Hash: B7B2C0B0A1CA498FE7A9EF29D4956B877F1FF55304F1441BAD04EC72A2DA38AC41CB41

Function 00007FFB4B1BEB81 Relevance: 2.7, Strings: 1, Instructions: 1456COMMON

Download Yara Rule

Strings

hy&K, xrefs: 00007FFB4B1BF67E

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: hy&K
API String ID: 0-2787526675
Opcode ID: eb881a95c04c028fa8c254ad8bcb300382d5fab008a3e3d8d6bb4e372d04539f
Instruction ID: 4ae579f6dd0cf1a66efac249bfb841d664cf004ef3a48626b0c109b57ea18f42
Opcode Fuzzy Hash: eb881a95c04c028fa8c254ad8bcb300382d5fab008a3e3d8d6bb4e372d04539f
Instruction Fuzzy Hash: B5A2287151CB4A8FE759EF38C4944A5B7E1FF95304B1489BED48AC72B2DA38E846CB40

Function 00007FFB4B2A0001 Relevance: 2.2, Instructions: 2173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464619555.00007FFB4B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b2a0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54822f8d3ff49c0358d2c69cbe1bdad5b3d6e2cd44d452ae0b5dbc792cb1bc9e
Instruction ID: d9dd4867e60297ee719d131cc67c7eae9ab6379cd2811edabfb0d83ba94e35bc
Opcode Fuzzy Hash: 54822f8d3ff49c0358d2c69cbe1bdad5b3d6e2cd44d452ae0b5dbc792cb1bc9e
Instruction Fuzzy Hash: E0E2F3B280DBC64FE756FF38C8A55A57FE0EF5A300F0845FAD189CB1A2D9296805C791

Function 00007FFB4B1B74A0 Relevance: 2.0, Strings: 1, Instructions: 734COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFB4B1B779F

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 4b989b981ab8600658bc82c89e89c26a6fb48e464b51f40bf0050b2ef69b1fb1
Instruction ID: d79575dc119f3db09fc00c7320f6d369663550d9662fd3b2e3d01a86f6a77e63
Opcode Fuzzy Hash: 4b989b981ab8600658bc82c89e89c26a6fb48e464b51f40bf0050b2ef69b1fb1
Instruction Fuzzy Hash: 6C2236B192CA894FE34AEF38C88157177E1EF46714B1481BAC59EC71A7DD28E843CB81

Function 00007FFB4B1B7048 Relevance: 1.7, Strings: 1, Instructions: 466COMMON

Download Yara Rule

Strings

fish, xrefs: 00007FFB4B1B70A0

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: 3e5bbd14d4549e36d443eb4351f428afb51a07c33d4a36930629f87ee99b9716
Instruction ID: bf128c0699326abf59a52d53819a6c08d339400c2e2a16e61c99a7027abe0511
Opcode Fuzzy Hash: 3e5bbd14d4549e36d443eb4351f428afb51a07c33d4a36930629f87ee99b9716
Instruction Fuzzy Hash: B8D15B7162CA4A4FE74DFF38D8551B577E1EF96714B0481BEE58BC32E2DD14A8028B81

Function 00007FFB4B1B1DB3 Relevance: 1.6, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

c), xrefs: 00007FFB4B1B1DCB, 00007FFB4B1B1E12, 00007FFB4B1B1E36, 00007FFB4B1B1E7D, 00007FFB4B1B1E93, 00007FFB4B1B1EF9, 00007FFB4B1B1F70, 00007FFB4B1B1FA6, 00007FFB4B1B1FD5, 00007FFB4B1B2021, 00007FFB4B1B2050

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID: c)
API String ID: 0-3897767060
Opcode ID: 4c54a65479f0b1cc017a58d43deec1baeb2d3335938b5a68a2e3e86f2fb45db2
Instruction ID: a8dc7cd4a31a7c862786c8a17c851fb7b68000df9ca06b1d541c8fbbeae36bd9
Opcode Fuzzy Hash: 4c54a65479f0b1cc017a58d43deec1baeb2d3335938b5a68a2e3e86f2fb45db2
Instruction Fuzzy Hash: 70819291B2C9094BE798FB3CC869778A6D2EF8CB50F548579E14DC32D6DC28BC018B95

Function 00007FFB4B1C2E9F Relevance: 1.4, Instructions: 1368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 349549787679100410b0e1f1605b0d7fa98e0586a6d138f707a9f93cfacc0024
Instruction ID: a9e72fda34aac2c0c43b1cd36eaa8b632b53a53244f33641cfe3f084d247f075
Opcode Fuzzy Hash: 349549787679100410b0e1f1605b0d7fa98e0586a6d138f707a9f93cfacc0024
Instruction Fuzzy Hash: D872777152CB894FE369EF38D4415B577E1FF95304B1086BED48AC72A2DE38A846CB81

Function 00007FFB4B1BB538 Relevance: .8, Instructions: 791COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4001ebf811722718fc90543fe008dd767af8af931507ecc15bdfbfaa56326a
Instruction ID: b4bb57c7c8a05b2698e49d17d1d6be5f6dd027959827994fa5181401b6a4acca
Opcode Fuzzy Hash: 3b4001ebf811722718fc90543fe008dd767af8af931507ecc15bdfbfaa56326a
Instruction Fuzzy Hash: 0D32D670A1CA498FDB68EF39C85567977E1EF55304F1441BEE48EC72A2DE24AC42CB81

Function 00007FFB4B1BE7A0 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a30aa440497471a321279669bd134f85f330a17f2865c5e5207d813753ae26
Instruction ID: 096cfb7e743ee06d25d6a106814f95f3db33702da37ed2ea3d439b8c7de3a75f
Opcode Fuzzy Hash: 37a30aa440497471a321279669bd134f85f330a17f2865c5e5207d813753ae26
Instruction Fuzzy Hash: C9D1667251CB864FE31DDB38C891171BBD2FF95305B148ABED4CAC72B5DA28A446CB81

Function 00007FFB4B1C770A Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1d7878ae578aa3aa746041ae35cc5cc6c8f4bd67d208c396c0e21313d2a63c3
Instruction ID: 72d8e5f45af44b4db9e6e68331baf98ebe988b6fde9836f5b1677fdf381a9e92
Opcode Fuzzy Hash: b1d7878ae578aa3aa746041ae35cc5cc6c8f4bd67d208c396c0e21313d2a63c3
Instruction Fuzzy Hash: AF416BB260D7894FD71E9E38C8661B57BE5DB43220B1582BFC587C71A7DC1868078791

Function 00007FFB4B1C7761 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46e65b77a6a97b95d4f81e6027d090d2070971477c6c5a1ed60903ca7b5f209
Instruction ID: f5f43802618f58a3af7fe28ff89cbcfbb9cb60f5a97188024db644e4f81d4967
Opcode Fuzzy Hash: b46e65b77a6a97b95d4f81e6027d090d2070971477c6c5a1ed60903ca7b5f209
Instruction Fuzzy Hash: 454186B1A0D68A0FD71F9E38C8611A53BA5EB53310B0582FFC587C71E7EC5868068792

Function 00007FFB4B1B59A9 Relevance: 1.7, APIs: 1, Instructions: 182memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFB4B1B5AC6

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8d81b7394170289ea6918d28aa613e14bfe2b8fcc2598f211d475015b175a056
Instruction ID: a8dc74c893d0e13d9d6c92a968ed59dc9942e330394e9b553b41d401c9a14a2f
Opcode Fuzzy Hash: 8d81b7394170289ea6918d28aa613e14bfe2b8fcc2598f211d475015b175a056
Instruction Fuzzy Hash: A2516970918B1C8FDB58EF58C895BE9BBF1FB59314F1042AED44AE3251DB70A981CB81

Function 00007FFB4B1B599C Relevance: 1.7, APIs: 1, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFB4B1B5AC6

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0b6900421da020542a6648b5a94bb4d22ba6b0c341e8fe2ec4b1b1952f4b77c2
Instruction ID: 297b1f94868aaf6eac49d0c7f08df52d2a9fc1b2ff94591ed5c4b664e9305dd0
Opcode Fuzzy Hash: 0b6900421da020542a6648b5a94bb4d22ba6b0c341e8fe2ec4b1b1952f4b77c2
Instruction Fuzzy Hash: 2B413A7491861C8FDF48EF58D895AECBBF1FB69315F1052AAC44AE3251DB30A981CF81

Function 00007FFB4B2A10FC Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464619555.00007FFB4B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b2a0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd6f17cf97c388acd4ccf946892cb32340bca4e9762637e11e2dc38f37df379
Instruction ID: 3fe43fa0fb55748eb7d5be4563d08c97cb6b649b28ca7e0c4ae0654bf1ca4299
Opcode Fuzzy Hash: 9bd6f17cf97c388acd4ccf946892cb32340bca4e9762637e11e2dc38f37df379
Instruction Fuzzy Hash: 23416A7580CA8D8FEB49FF24D8954A87FF0FF5A310B1841BEC04AD71A2DA25E851C780

Function 00007FFB4B2A1ED0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464619555.00007FFB4B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b2a0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff5cbffb84039a93e457bd3c4ab431a9ed88b71bf2e95a914a69b56d6fe17d2
Instruction ID: e992eff8580e826adba5db504d9b43d78021bfaa1bc9906f3f8a02517011cbbd
Opcode Fuzzy Hash: 1ff5cbffb84039a93e457bd3c4ab431a9ed88b71bf2e95a914a69b56d6fe17d2
Instruction Fuzzy Hash: 24F01D31A0892D8FDFA5EA4CD880BECB3B1EBA8350F0081E6904DE3151DA30AAC58F50

Function 00007FFB4B2A09FC Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464619555.00007FFB4B2A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b2a0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7627f3e4a15c9c1148b376ff07f3f8fb7cf8ae90d2dccc66a51a8fbd059b246
Instruction ID: 16a7417ce93cabb3da7792ee6b6c981855151236cdb1791e1e451a587e9eb47b
Opcode Fuzzy Hash: d7627f3e4a15c9c1148b376ff07f3f8fb7cf8ae90d2dccc66a51a8fbd059b246
Instruction Fuzzy Hash: 10E06531A18A298FDB60EB28C841FEEB3B0FF88300F0040E6D45DE3251CA306A81CF52

Non-executed Functions

Function 00007FFB4B1B5529 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1463966805.00007FFB4B1B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B1B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b1b0000_DRAWING_SHEET_P02405912916 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5e3e85ec9c861ed47da0dc3f583f446675a8e6451f67708f441fb9320cdc47
Instruction ID: e90cc491cc2c42ccf6d079dd05be81fcd19c786206e043322a1c6cdcb8640d11
Opcode Fuzzy Hash: 3a5e3e85ec9c861ed47da0dc3f583f446675a8e6451f67708f441fb9320cdc47
Instruction Fuzzy Hash: 8D61617091CA8D8FDBA8EF28C8557E977E1FB59300F10412ED84EC7251DB749581CB81

Analysis Process: MSBuild.exePID: 4708, Parent PID: 4028COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	107
Total number of Limit Nodes:	19

Executed Functions

Function 066B2378 Relevance: 1.1, Instructions: 1058COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277daffb5bbc21cdb05608d8bad80b7fae2cc9cdede63b3ce9a53868df64f812
Instruction ID: 118c5ae3853337a45966276588f27988770e016ef9d9359989bffb04b19433b6
Opcode Fuzzy Hash: 277daffb5bbc21cdb05608d8bad80b7fae2cc9cdede63b3ce9a53868df64f812
Instruction Fuzzy Hash: 35A21334E00204CFDBA0DB68C594BADBBF6EB45314F5594AAD409AB362DB35ED85CF80

Function 066B6738 Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2864aa1ea5f0e4b34534fb8e6f4f9764b609334c62c7c04f3cecb75d0ab278
Instruction ID: 182ddfed182bee725db21b3208c92606651e9f3ac13a677420449de64be070de
Opcode Fuzzy Hash: 6b2864aa1ea5f0e4b34534fb8e6f4f9764b609334c62c7c04f3cecb75d0ab278
Instruction Fuzzy Hash: 31628D31B10204DFDB54DB68D994AADBBB2FF84310F249469E806DB391DB35ED82CB90

Function 066BC2D8 Relevance: .6, Instructions: 642
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be31194a4158e9fb7e747a492b0e3faf20bd6bc15ccae5e7f090afa8ccfd5014
Instruction ID: 8f8a8fe4a2b07380aec925db081a02eb911e82fb320a6d55be0beab29c1ff856
Opcode Fuzzy Hash: be31194a4158e9fb7e747a492b0e3faf20bd6bc15ccae5e7f090afa8ccfd5014
Instruction Fuzzy Hash: B1326F35B10209DFDB54DB68D890BAEBBB2FB88310F209529E505EB355DB31ED81CB91

Function 066BB380 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e03173c0c7e8b0046f4b87ab37b6db7a8981c600c3ab56432ba0b4a64fe0c11
Instruction ID: e3e277fe25df1ab2fab47731e2eed30999f04eccfff45acf227c60d355c24012
Opcode Fuzzy Hash: 6e03173c0c7e8b0046f4b87ab37b6db7a8981c600c3ab56432ba0b4a64fe0c11
Instruction Fuzzy Hash: 46226E70E10209CBEFA4DB68D8907EEB7B6EB89310F649426E405DB395DE35DC818B51

Function 066B31B8 Relevance: .5, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dab40307d29adb2a14c609dccde8a13686459ae257520d4145d69272b768ca55
Instruction ID: 122174810871d6b93f69c4fb0972e6094c37bbf5be314fd2763ca21047a72740
Opcode Fuzzy Hash: dab40307d29adb2a14c609dccde8a13686459ae257520d4145d69272b768ca55
Instruction Fuzzy Hash: D9321D31E1061ACFDB14EB75C85069DB7B2FFD9300F60D6AAD449A7364EB30A985CB90

Function 066B7ED0 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d8daf9dc52849d37f33cbd2b8cecf6ed042044ad4c94fa7b0f8089e849e55d
Instruction ID: a9eeefd3d49da7de1c2ec371a6283c3ce81e036211a0d227ffacaa509fd96434
Opcode Fuzzy Hash: 47d8daf9dc52849d37f33cbd2b8cecf6ed042044ad4c94fa7b0f8089e849e55d
Instruction Fuzzy Hash: E4028E31B10216DFDB54DF64D890AAEB7AAFF84310F249529E806DB355DB31ED82CB90

Function 066B572B Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b827bfa8cfcc8232dc7e3f1e4fc39036adfa6e01e5b7c9b809a618cf8b281d4
Instruction ID: 811c07dc62532b148bc04fb9266c1cf50b8e1ea1c1e7564c7aa6eee9ce3d5274
Opcode Fuzzy Hash: 0b827bfa8cfcc8232dc7e3f1e4fc39036adfa6e01e5b7c9b809a618cf8b281d4
Instruction Fuzzy Hash: 24F1E371E10215DFDB60DF64C8806EEBBB2FF85310F24856AD846AB345DA35EC82CB91

Function 0142ECE0 Relevance: 1.6, APIs: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2623298473.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1420000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adbdc7eb7022bee64fd3a3792ca1351dad92765e1b311a1325ee20bad1de34b9
Instruction ID: ec7d36538bed3a96d3ab6b5a0283f49af7a6a9a9a251f8104f741991e03c1c1f
Opcode Fuzzy Hash: adbdc7eb7022bee64fd3a3792ca1351dad92765e1b311a1325ee20bad1de34b9
Instruction Fuzzy Hash: 82412571D003598FDB14DFAAD8046EEBBF5EF89210F15866BD508A7350DB749885CBE0

Function 0142E448 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,0142ED32), ref: 0142EE1F

Memory Dump Source

Source File: 00000002.00000002.2623298473.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1420000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 8c97c254b1c547a5dce2dbda2392aa33ecfae8b80d0fb57b732529e539c75e5d
Instruction ID: 1db4266b8992bd60aefd4e0933ac45ee21a0d1900de411a162e92ed7660c7ff9
Opcode Fuzzy Hash: 8c97c254b1c547a5dce2dbda2392aa33ecfae8b80d0fb57b732529e539c75e5d
Instruction Fuzzy Hash: 8A1114B1C0065A9BDB10DF9AC4447DEFBF4AF48620F10812AE918B7350D778A945CFE1

Function 0142EDB0 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,0142ED32), ref: 0142EE1F

Memory Dump Source

Source File: 00000002.00000002.2623298473.0000000001420000.00000040.00000800.00020000.00000000.sdmp, Offset: 01420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1420000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: caf0b459ed78afb02d1692f557346eb5584dc0631d75e9f0a2a886b18e459f2a
Instruction ID: e1ade91b33a88bda37af85be3e2c67e37b37842b5eb2770bfaf7c298fe1e7bbf
Opcode Fuzzy Hash: caf0b459ed78afb02d1692f557346eb5584dc0631d75e9f0a2a886b18e459f2a
Instruction Fuzzy Hash: C31103B1C0065A9BDB14DF9AC844BDEFBF4AB48620F11812AE818B7350D778A945CFA5

Function 066BFF58 Relevance: 1.3, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

i, xrefs: 066BFF58

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: c0cf1c2c4e90d9cca6572972323f8b1a0fa499ae32c4fe8e0e9109be75442187
Instruction ID: 8ca27083a003c28d40d3809ed2277044d1ec8452bff539983407aef81322a511
Opcode Fuzzy Hash: c0cf1c2c4e90d9cca6572972323f8b1a0fa499ae32c4fe8e0e9109be75442187
Instruction Fuzzy Hash: AA110835B043568FD790EF7CD84029EBBE5AB82201F1045BDD949C7796E734D842CB92

Function 066BD0A0 Relevance: .8, Instructions: 802
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2439e942794eb79809dd6a718557bd2d186251ca37991e35e76d23d2479514bf
Instruction ID: 14329499fc808b11f6f41be702085ba2b2c3b1cb4ef8fe08519efeaf7898edf1
Opcode Fuzzy Hash: 2439e942794eb79809dd6a718557bd2d186251ca37991e35e76d23d2479514bf
Instruction Fuzzy Hash: AB623B30A0031ACFDB55EB68D990A9DB7B2FF84304F209A29D4059F359DB75ED86CB81

Function 066BB7A8 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c60f9fe6149dab409f1b12a5d6382dee51ba9613348738434226b97278a927
Instruction ID: 0232a0dac3f6b9752e6ea57defe90726cf4b7cbbb6f7b8f38811c50aae48de7d
Opcode Fuzzy Hash: 74c60f9fe6149dab409f1b12a5d6382dee51ba9613348738434226b97278a927
Instruction Fuzzy Hash: 8E023930E10209CFDBA4DF68D8806ADB7B2FB85310F24956AE406DB355DF35E982CB91

Function 066BAE28 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a102bda32d26817c171d1b7502f68a3e5da564cedb5093cd05a0e118a07eb08
Instruction ID: ef256a1bb2aba69f209a2f74801e181eb7666c1620776ea479f912a83d2d3f02
Opcode Fuzzy Hash: 6a102bda32d26817c171d1b7502f68a3e5da564cedb5093cd05a0e118a07eb08
Instruction Fuzzy Hash: 5DE16E30E10319CFDB65DBA9D8906AEB7B2FF85310F20952AE9059B354DF319C86CB91

Function 066B5A28 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ff77e48112ebe16dc7b48ecef3fe6e1db3ead37ef73530e367524f07152570
Instruction ID: f049eb747019c215760388203b42ca9edeabaaa9451b84392a2903e7cd50fdda
Opcode Fuzzy Hash: c7ff77e48112ebe16dc7b48ecef3fe6e1db3ead37ef73530e367524f07152570
Instruction Fuzzy Hash: EFB1A071F00215DBDB14EFA4D884AEE77B6EF88310F209529E902AB354DB35ED46CB90

Function 066B92A8 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a44bd5a77641cf77caa8d3983aeb7a4365c686cdd30835258184a5f80fc6e5eb
Instruction ID: ff1841b19a593e2c21d9aa204eca9c3eb075871c64c8102e6fde85e0eece1652
Opcode Fuzzy Hash: a44bd5a77641cf77caa8d3983aeb7a4365c686cdd30835258184a5f80fc6e5eb
Instruction Fuzzy Hash: 5C914F30B1021ACFDB95DB68D850BAEB7B6AF85300F108569D909DB344EE31ED858B91

Function 066B6338 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 726ff03d90adc09eb844571e4791b85b9f5570dcef8c97c48d2cafb1b8ff2a23
Instruction ID: 0035bbc1e20c0e128a65762a3e9a9ace48bde7fccb12ad9a11c4059d5b598198
Opcode Fuzzy Hash: 726ff03d90adc09eb844571e4791b85b9f5570dcef8c97c48d2cafb1b8ff2a23
Instruction Fuzzy Hash: 6E61C772F001218BDF50AB7DC88099EBAD7EFC4610B15543AD80ADB3A4DE65ED4287D5

Function 066B43F9 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2c0d2cb5b6dbca05d34cb1d5bbe7542527297182f4093fc20822de78bb0e04
Instruction ID: 2ad11c0c97dbcece15c4b643b41d43bec40edc69d7925e285a770d6afecc31fa
Opcode Fuzzy Hash: 0f2c0d2cb5b6dbca05d34cb1d5bbe7542527297182f4093fc20822de78bb0e04
Instruction Fuzzy Hash: 3E814E31B11209CFDF54DFA9D4506AEBBF6AF89300F109529D80ADB359DE31EC828B91

Function 066B4718 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1f541843772fe158fb47818ad0bc46de8644ff651bbf231f2053cbdd423262
Instruction ID: 237a26dfb9414f53e09a8042bff4bb89beb154cf72ee3c70e1718b6209be9a7a
Opcode Fuzzy Hash: 0b1f541843772fe158fb47818ad0bc46de8644ff651bbf231f2053cbdd423262
Instruction Fuzzy Hash: 50914D30E00219CBDB60DF64C880BDDB7B1FF89310F20869AD549AB355DB71AA85CF91

Function 066B4730 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7de53d2e2b4a0b074c77a5264523951c0cd30ff27eedb2e53a25cc0aaae2d659
Instruction ID: fbb49e49d3b525f7490684a7805a51f05940456e5ebb990f610d20124f3ebf54
Opcode Fuzzy Hash: 7de53d2e2b4a0b074c77a5264523951c0cd30ff27eedb2e53a25cc0aaae2d659
Instruction Fuzzy Hash: A6911A30E10619CBDF60DF68C880B9DB7B1FF89310F208699D549AB355DB71AA85CF90

Function 066BEC70 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a40c4569ad855a85aee983a1946d2faab8f20c3fc7b4357f7b1c7e02ab29ac8
Instruction ID: e997c25e79a890a1ee1da3ecd6be6c93eceaa3cb7714891061355696216576df
Opcode Fuzzy Hash: 5a40c4569ad855a85aee983a1946d2faab8f20c3fc7b4357f7b1c7e02ab29ac8
Instruction Fuzzy Hash: 97712A31A00249DFDB54DBA9C980AEDBBF6FF88300F249529E415AB355DB31E986CB50

Function 066BEC80 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600ac69256fc4ec3316f01ee68473afe6cdaaf034371d7da79c0feadc6cae18c
Instruction ID: a7b4b71bc4eaf177c84e9ffb3479101e78b41d3ec2f624364a572c7da423d16b
Opcode Fuzzy Hash: 600ac69256fc4ec3316f01ee68473afe6cdaaf034371d7da79c0feadc6cae18c
Instruction Fuzzy Hash: 3B712730E00249DFDB54DBA9C980AEDBBF6FF88340F249529E415AB355DB31E986CB40

Function 066B4CC8 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d19119571d9551efdb1ca58417fca561c0263b25a5f9fea2385851020b4efeb
Instruction ID: d5584a8cdb931a328239e4b824578db898a0c8309ccd1c48d180276ffdb1d0a3
Opcode Fuzzy Hash: 0d19119571d9551efdb1ca58417fca561c0263b25a5f9fea2385851020b4efeb
Instruction Fuzzy Hash: B1617C70F00218DFEB549BA5C854BAEBBF6FF88700F20842AE506AB395DF754C458B91

Function 066BFB90 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55832651690d39bc175cf149a8be4efd47e2194f55320499446652cef702aeaa
Instruction ID: 0b79559a2ba4cd1f29ba0a4e8525239e1df7000f3f0d069a374c36fdd3d9a6be
Opcode Fuzzy Hash: 55832651690d39bc175cf149a8be4efd47e2194f55320499446652cef702aeaa
Instruction Fuzzy Hash: 2B51F330B10214CBEF606668DCA47AF669AD7D9711F20442AE90BC73A5CF79CC8193A2

Function 066B9298 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f523e7074f28883f5d3cfee6b2e866885ff60a4a5498644a99c52115cc1e0c9
Instruction ID: f178ebeb159dfebc05611f81ec85bed4143781f8dba30c8c1284f2333d1017cf
Opcode Fuzzy Hash: 0f523e7074f28883f5d3cfee6b2e866885ff60a4a5498644a99c52115cc1e0c9
Instruction Fuzzy Hash: F9514031B10116CFDB95DB68D890BAEB7F6BF85700F108569D90ADB384EA31ED428B91

Function 066BFBA0 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166ec985200480f89a4b4cca0a9339f4bcd9e27c61adad73244c17208d6fe2a6
Instruction ID: 7fd1de39004bb746b7f36a8f7f04f208befa8c09ce5640302828e9f6597f7795
Opcode Fuzzy Hash: 166ec985200480f89a4b4cca0a9339f4bcd9e27c61adad73244c17208d6fe2a6
Instruction Fuzzy Hash: B951C030B10215CBEF60666CDC647AF769AE7D9711F60442AE90BC33A4CF79CC8153A2

Function 066B4CB8 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29321a0865a1849a2e815d1b9fb2fdef629f3590008b102364902bc46a20e72
Instruction ID: c2d15ffbae210f3abd70416099baa97a76c510e7068f122d8aaae57d6832160a
Opcode Fuzzy Hash: c29321a0865a1849a2e815d1b9fb2fdef629f3590008b102364902bc46a20e72
Instruction Fuzzy Hash: 2F51A070F002089FDB549FA5C814BAEBBF6FFC8700F20852AE505AB395DE759C458B91

Function 066B5571 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c8786cc38747a9129b2e6c30d03947bb9341eefc987366acf9426c184b4972a
Instruction ID: aeddbd432471e77933f8df7d13756d0884aaafbdef5af7a456251214a85a1331
Opcode Fuzzy Hash: 5c8786cc38747a9129b2e6c30d03947bb9341eefc987366acf9426c184b4972a
Instruction Fuzzy Hash: 6B415E72E00609CFDF60CF99D881AEEF7B6EB84310F10492AE156D7650D734E9958B91

Function 066BDC15 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877c0e26268acfff277fc1e636eb325cb59c94ad636bf10512847d57603e4104
Instruction ID: 7f923dac717a6499ab0802cc588d5a635f643ea6cc631b46d46981d6c0ae5410
Opcode Fuzzy Hash: 877c0e26268acfff277fc1e636eb325cb59c94ad636bf10512847d57603e4104
Instruction Fuzzy Hash: B741B070E00349DFDB65DF65D4846AEBBB6BF85700F20882AE801EF344DB709886CB81

Function 066B21ED Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1f21af6036a0dab33e1aac2265ba493bf1d482f6f16d87e80c1800592fbce9
Instruction ID: 2384ca2cb4c27831e0bf15ce57646b4d76d674c16ddc287c6b9599a3d7125f46
Opcode Fuzzy Hash: 0e1f21af6036a0dab33e1aac2265ba493bf1d482f6f16d87e80c1800592fbce9
Instruction Fuzzy Hash: E831F030B10205CFDB69AB74C4646BE7BE6AF89710F245469D802DB395DF35CE82CB91

Function 066B2200 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac0d74021448af84d94d2643547eabb80e7741f35a81db049d390de3e8859d5a
Instruction ID: b918809f577d3ce8c3f42f62ccbf9d14375219aa2148ef35784705400dfa0814
Opcode Fuzzy Hash: ac0d74021448af84d94d2643547eabb80e7741f35a81db049d390de3e8859d5a
Instruction Fuzzy Hash: 7231B030B10209CFDB68AB74C4646BE7BE6AF89710F249468D806DB395DF35DE82C791

Function 066BDAC8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9dd48321e3db4019d9019518499d23a2d044f694008a8e4b81d39d2d9d42778
Instruction ID: 0b78c113349f842b6d4333fd2e74652f28ab3d0fc435c13ce4670ee5c3af2460
Opcode Fuzzy Hash: b9dd48321e3db4019d9019518499d23a2d044f694008a8e4b81d39d2d9d42778
Instruction Fuzzy Hash: 67319270E1031ADBDF24DF64C890ADEBBB6FF85304F109529E805EB304DB71A9868B91

Function 066B20B0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 263ec8166001fbfd327a7f6f157a3ffd14ecd5dd7510b139247745ca05dd5448
Instruction ID: e212b9b546823350827ab58e56e83e3d21a816496d8caf84b0320abbbf079912
Opcode Fuzzy Hash: 263ec8166001fbfd327a7f6f157a3ffd14ecd5dd7510b139247745ca05dd5448
Instruction Fuzzy Hash: 1D31A134E10609DFCB55CF64C864AAEB7F6BF89300F148519EA16EB390DB71AD82CB51

Function 066B20C0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60885b462b432778caaf8b34fa04cd89acc421eb2e41d33b8a8d0144816b9977
Instruction ID: c3e8833c3e77f04661fc13d28053f21c41666444384749d6e93e87742d634d0c
Opcode Fuzzy Hash: 60885b462b432778caaf8b34fa04cd89acc421eb2e41d33b8a8d0144816b9977
Instruction Fuzzy Hash: 9B317031E10609DFCB55CF64C864AAEB7F6BF89300F148529EA06EB350DB71AD82CB51

Function 066BFDE1 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9016c4e38d9a4ffadd7b1a95bb591b81a1c6dae433f4a4a30a6e1b79f1ed868
Instruction ID: 0cf264914cdc020585e8e71217ae8d344b779e41875a1106a069955d02d341dd
Opcode Fuzzy Hash: f9016c4e38d9a4ffadd7b1a95bb591b81a1c6dae433f4a4a30a6e1b79f1ed868
Instruction Fuzzy Hash: FD21A035A11292EFDBA0EF25E9406BE77EAAB64604F005014C908C7319EB35D997CBD1

Function 066B3BF9 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd697451bf72762d741ccec404850db4459e5898f23034153ee86d381be92e07
Instruction ID: f8cdf26f8d58b7c4d8a4f005044aaacc263411d2c935f97f61b24264563c4912
Opcode Fuzzy Hash: bd697451bf72762d741ccec404850db4459e5898f23034153ee86d381be92e07
Instruction Fuzzy Hash: 21217C75F11215DFDB50EFB9E880AEEBBF5AB88310F108025E905E7344E735D9818B90

Function 066B3C08 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76da248ed28c43d6e9aae72ed22858a0aaab08d9631ea310136feda025912e8
Instruction ID: e240c6704bc7d3265103cf3b24b56d94cf3c0c566f88d0ef6c3257e2ab301f29
Opcode Fuzzy Hash: a76da248ed28c43d6e9aae72ed22858a0aaab08d9631ea310136feda025912e8
Instruction Fuzzy Hash: 64217C75F11215DFDB50EFA9E880AEEBBF1AB88310F208029E905E7350E735E8418B90

Function 066BFDF0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a15d2199da9825bd794a6edc9643bb31bdc8b6877486e601cc7b82b2f1298d80
Instruction ID: 71f7d6b193513ae69e84e7cf86adb74fcda96c46ececc64f2a3cbe1ca80f7fcd
Opcode Fuzzy Hash: a15d2199da9825bd794a6edc9643bb31bdc8b6877486e601cc7b82b2f1298d80
Instruction Fuzzy Hash: 82217131A10252EFDBA0EF25D9506BE77E6AB64744F005124CD08C7359EB36D997CBC0

Function 013DD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2622812673.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a837a047cbfcfb100101be4e2230aa42d3dd2e0bdcf64a7562a6930c5b785d43
Instruction ID: b334b7870fdd36a19850c2cfa9546a25f68f9c89c9879fe63ea57215341f7350
Opcode Fuzzy Hash: a837a047cbfcfb100101be4e2230aa42d3dd2e0bdcf64a7562a6930c5b785d43
Instruction Fuzzy Hash: 8B2122B2604308AFDB11DF64E8C4B26BB65FBC4318F20C56DE9490B782C73AD446CA62

Function 066B6E68 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed7199022ae5987c78db5284f92fdf2995535ef75a12595f404de56f49bb7ef
Instruction ID: f03ddc0645d56008a5d7ce6d55cb6993fcdccd842e35637423ab24783cf8c067
Opcode Fuzzy Hash: 6ed7199022ae5987c78db5284f92fdf2995535ef75a12595f404de56f49bb7ef
Instruction Fuzzy Hash: 8E216031B11118DBDF94DA68E9646EEBBB6FFC4310F149425E805D7344DB31ED828B94

Function 066B4358 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd232053841c032e9148c180ec0b5b1702e34b6b5d95fe872b8a9bc0d772562
Instruction ID: 90480a498de9f3ba7cd017a963eb2650b81b4b02894bcd05c4558b114c9f19f5
Opcode Fuzzy Hash: 7cd232053841c032e9148c180ec0b5b1702e34b6b5d95fe872b8a9bc0d772562
Instruction Fuzzy Hash: C3112230B052108FDB61967EC850B6EBBDADBC6610F14842AF10ECB346DD12DC4283A1

Function 066B3D18 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17940561bde89c07c45321170a4f052e1112043b35f1f1ad823bc77c699483ba
Instruction ID: b2dece0dea4fc424c05cfa657336730ce32887551b9110a42e266dbcbaca4e4f
Opcode Fuzzy Hash: 17940561bde89c07c45321170a4f052e1112043b35f1f1ad823bc77c699483ba
Instruction Fuzzy Hash: BF11A132B111288FDB949A68E8106EE77AAEBC8310F104539D506E7344DE65DD028BD1

Function 066B39D0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a637bd07b3aa2562bdd119b8fe4fbee1a0c116e58983dd43e1c1c77fa9e558
Instruction ID: 866c532476db83e84758642d79c05f09198776e576ea540927dcc8cc95189eeb
Opcode Fuzzy Hash: 35a637bd07b3aa2562bdd119b8fe4fbee1a0c116e58983dd43e1c1c77fa9e558
Instruction Fuzzy Hash: F821E4B5D01619AFCB00DF9AD884ACEFBB4FB48720F108229E918B3350C7746554CFA5

Function 066BA460 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7a5a776db70839f131500784aebbaa3c28a91a735d2bf9e782fb7156deaf1a3
Instruction ID: aba1532c0840262bef6f745e2937e95d3f9e3945a0dc16069f4a501587bf7e5a
Opcode Fuzzy Hash: a7a5a776db70839f131500784aebbaa3c28a91a735d2bf9e782fb7156deaf1a3
Instruction Fuzzy Hash: 0E012D30B112104FDB61EB7CD814B5B77D5EB86714F10442EF10ACB351EE21DC818341

Function 013DD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2622812673.00000000013DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_13dd000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: 251c5e78370669aef5792a9884ab9edd81ac0e83eac00592226ddad9c6a164db
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 2411BB76504284CFCB12CF64D9C4B15BBA2FB84328F24C6A9D8494B292C33AD44ACF62

Function 066BEEF1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201780d438484e8d0892e5644b36907189687aec3fbb03275c2f933f9926a5cf
Instruction ID: fef958a8fcaa7e70bccc52a99c0d8a9188f64813e5fce0b6c4f848a46c7e930f
Opcode Fuzzy Hash: 201780d438484e8d0892e5644b36907189687aec3fbb03275c2f933f9926a5cf
Instruction Fuzzy Hash: 1B01F730B115108FDB619A3CE454BAF77EADBC6754F10842AF50EC7346DA22DC424381

Function 066B3D07 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5865db27977edc9cc2a1a33413ee37d3ec5b1a088fceb0dbebfddc603ee54b
Instruction ID: b9342ae64a365961fa8a38e5facbe9e30af524447f5017fb103643e7d3dd4cee
Opcode Fuzzy Hash: 2b5865db27977edc9cc2a1a33413ee37d3ec5b1a088fceb0dbebfddc603ee54b
Instruction Fuzzy Hash: B501F732B211698BDB949679EC106EF7AEBEBC8310F54453ED506E3340EE619D0247E1

Function 066B39D8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3246ce26431625b84cfb29d5f9591bef6c74b5142c1580309a1e26d06fc1c3dc
Instruction ID: 2e385331805187d98fdb24a3b2fe7cc2c6098de251ff6f3c0f0c9627644dcd90
Opcode Fuzzy Hash: 3246ce26431625b84cfb29d5f9591bef6c74b5142c1580309a1e26d06fc1c3dc
Instruction Fuzzy Hash: 0311AFB5D01259AFCB10DF9AD884ADEFBB8FB48714F10812AE918A7350C374A954CFA5

Function 066B4368 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c334543a484c3601a06e5e8fa7c31b14616c97e6be45e28dbf1be039372afb
Instruction ID: bc71bd6027609ec839e6655c3c514bd37bf41c08b3c644f873ce3a018ca9bb87
Opcode Fuzzy Hash: 26c334543a484c3601a06e5e8fa7c31b14616c97e6be45e28dbf1be039372afb
Instruction Fuzzy Hash: 5201AD31B101118BDBA0956ED454B6FB2DADBCA720F14843AF50EC734ADE62DC424391

Function 066BEF00 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2035440f87e56f115f9f2583b64d464a20a8bf6d68d081cf9a4a4f97900573
Instruction ID: 00d428307b270efa27ccf53611d18db50d88c47c0036822d4b947401a7709281
Opcode Fuzzy Hash: 7f2035440f87e56f115f9f2583b64d464a20a8bf6d68d081cf9a4a4f97900573
Instruction Fuzzy Hash: 1201AF31B105108BDBA5992CE854BAF73DBDBCABA0F10883AF60EC7341DE26DC424381

Function 066BA470 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8a1bc5a2645d7360fc05444c91ec61f2675749ab66de04506c83f123a941b9
Instruction ID: 77798f3a852dcd06f64991e49bd540de0c7be98548b488bf352a286fef73a54a
Opcode Fuzzy Hash: 2e8a1bc5a2645d7360fc05444c91ec61f2675749ab66de04506c83f123a941b9
Instruction Fuzzy Hash: FD014431B211148FDB65EAACD858B6B73D6EB85724F108829F60ECB355EE21EC818781

Function 066B8446 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ab5ba05e7a24d9eac92d0208b9aed14ccdf768e4a9277498dc92cf39544bdff
Instruction ID: a76ffd912bd5038122bb57173cde5bb3e570fe19469494b0dd532243e4610dca
Opcode Fuzzy Hash: 0ab5ba05e7a24d9eac92d0208b9aed14ccdf768e4a9277498dc92cf39544bdff
Instruction Fuzzy Hash: 1DF03936E10211EFEFA48E44E9805E9736CEB90365F1960AADE05CB345D632EA92C790

Function 066BFF68 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32496a6292fef2fec87fe9ba89a3aec06a8b26172266ae2efc6eea54bf031f8f
Instruction ID: b283f878e2cc66ab12af4332dfdb93e3764016ba6cab7cf5646f8fda5b6f1bed
Opcode Fuzzy Hash: 32496a6292fef2fec87fe9ba89a3aec06a8b26172266ae2efc6eea54bf031f8f
Instruction Fuzzy Hash: F8F08C78A003198FC790FFB8C81026EBBE6FB84202F508579D919D7719EB349941CB92

Function 066B65B8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2630605162.00000000066B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_66b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b55acb90fab7e2ee28edbc02aa1e9d2d339a484d26adb5bd5d3e25f21f89d56
Instruction ID: 4efc40be35dfa5ce8665e0070501dc1fed34be5181ec78783ba676afc254c8ab
Opcode Fuzzy Hash: 1b55acb90fab7e2ee28edbc02aa1e9d2d339a484d26adb5bd5d3e25f21f89d56
Instruction Fuzzy Hash: AEE0D8B2E2924CFBEF50CB70C946B8A7BADD743204F5085A9D404C7342E176DA90D391

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DRAWING_SHEET_P02405912916 .exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_DRAWING_SHEET_P0_b088b2a1ea814e2a8d34d4abad448ba01bd6d55_a0fac049_8c9e2797-37ac-4a2f-8c4c-14b00a3cae93\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8A7.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC9E0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA10.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
DRAWING_SHEET_P02405912916 .exe

Function 00007FFB4B1B09F2 Relevance: 4.3, Strings: 3, Instructions: 501
COMMON

Function 00007FFB4B1B0AD3 Relevance: 4.1, Strings: 3, Instructions: 394
COMMON

Function 00007FFB4B1B0AF3 Relevance: 4.1, Strings: 3, Instructions: 384
COMMON

Function 00007FFB4B1B0AC8 Relevance: 4.1, Strings: 3, Instructions: 379
COMMON

Function 00007FFB4B1B1045 Relevance: 3.3, Strings: 2, Instructions: 812
COMMON

Function 00007FFB4B1B92D8 Relevance: 2.8, Strings: 1, Instructions: 1579
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre