Windows Analysis Report
PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Overview

General Information

Sample name:	PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Analysis ID:	1465559
MD5:	3fab44c211a6c5519aa034184aca3fdb
SHA1:	4d4618e371726bd5f7cca66659fd67ecb9b1d9cf
SHA256:	afb3c2222365641951a91bb0a55a1cdd2774539475a79c0deb8fa6bbd3d56f53
Tags:	exe
Infos:

Detection

AgentTesla, DarkTortilla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected DarkTortilla Crypter

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Name	Description	Attribution	Blogpost URLs	Link
DarkTortilla	DarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.	No Attribution	https://www.secureworks.com/research/darktortilla-malware-analysis	https://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Signatures

AV Detection

Found malware configuration

Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Zeew.exe

ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Zeew.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Joe Sandbox ML: detected

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 4x nop then mov eax, dword ptr [ebp-1Ch]		0_2_00BB47C8
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 4x nop then mov eax, dword ptr [ebp-1Ch]		14_2_017747C8

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_00BB6B20	0_2_00BB6B20
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_00BBBEDF	0_2_00BBBEDF
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_00BBE048	0_2_00BBE048
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_05CD4040	0_2_05CD4040
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_05CDC344	0_2_05CDC344
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_05CD4030	0_2_05CD4030
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_05CDDF28	0_2_05CDDF28
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_06F5B488	0_2_06F5B488
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_06F54018	0_2_06F54018
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_06F5EE00	0_2_06F5EE00
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_06F5EDF2	0_2_06F5EDF2
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_06F54008	0_2_06F54008
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077B41D8	0_2_077B41D8
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_07925B80	0_2_07925B80
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_0792D3A0	0_2_0792D3A0
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_07925B4D	0_2_07925B4D
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_07928368	0_2_07928368
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077B41BF	0_2_077B41BF
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_01776B20	14_2_01776B20
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_01777A10	14_2_01777A10
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0177DFC8	14_2_0177DFC8
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0177BEF1	14_2_0177BEF1
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_08114040	14_2_08114040
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0811C344	14_2_0811C344
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0811DF28	14_2_0811DF28
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_08114030	14_2_08114030
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_08284018	14_2_08284018
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0828B488	14_2_0828B488
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0828EDF1	14_2_0828EDF1
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0828EDC8	14_2_0828EDC8
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0828EE00	14_2_0828EE00

Sample file is different than original file name gathered from version info

Uses reg.exe to modify the Windows registry

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"

Yara signature match

Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, b9A.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, b9A.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/6@0/1

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Zeew.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8004:120:WilError_03

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe "C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe"
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 26 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 34 > nul && copy "C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe" "C:\Users\user\AppData\Roaming\Zeew.exe" && ping 127.0.0.1 -n 34 > nul && "C:\Users\user\AppData\Roaming\Zeew.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Zeew.exe "C:\Users\user\AppData\Roaming\Zeew.exe"
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 26 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 34 > nul && copy "C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe" "C:\Users\user\AppData\Roaming\Zeew.exe" && ping 127.0.0.1 -n 34 > nul && "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Zeew.exe "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static file information: File size 2853888 > 1048576

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2ab200

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 14.2.Zeew.exe.4523510.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.39b44c0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Zeew.exe.4523510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.5220000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.5220000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40fc411.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.39b44c0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43e8811.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f86201.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3e0ffe1.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2192134157.0000000002A3A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2210039009.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2909435521.00000000044FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000004219000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000004505000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2192134157.0000000002771000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2902624019.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Zeew.exe PID: 7824, type: MEMORYSTR

.NET source code contains method to dynamically call methods (often used by packers)

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, j4F9.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[0]}, (string[])null, (Type[])null, (bool[])null, true)
Source: Zeew.exe.8.dr, j4F9.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[0]}, (string[])null, (Type[])null, (bool[])null, true)

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077BBB70 push ecx; ret	0_2_077BBB82
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077B332E push FFFFFFE9h; retn 0001h	0_2_077B3338
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077BBB06 pushad ; ret	0_2_077BBB43
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077B1E0D push FFFFFF8Bh; iretd	0_2_077B1E0F
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_0792B7A8 push es; ret	0_2_0792B7E2
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_0792E245 push FFFFFF8Bh; iretd	0_2_0792E247
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_0792E056 push edi; ret	0_2_0792E057
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_0792E061 push edi; ret	0_2_0792E062
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0177DA14 pushad ; iretd	14_2_0177DA25
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_05F24E40 push eax; ret	14_2_05F24E41
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_07E7195A push 00000059h; ret	14_2_07E7195E

Drops PE files

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Zeew.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Zeews			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Zeews			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	File opened: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe\:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	File opened: C:\Users\user\AppData\Roaming\Zeew.exe\:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Zeew.exe PID: 7824, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Memory allocated: BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Memory allocated: 2690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Memory allocated: 1770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Memory allocated: 3340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Memory allocated: 5340000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Window / User API: threadDelayed 1426			Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Window / User API: threadDelayed 8431			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe TID: 8032	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 7232	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 7232	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 3584	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 3584	Thread sleep time: -32000s >= -30000s	Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2210039009.0000000005220000.00000004.08000000.00040000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, Zeew.exe, 0000000E.00000002.2909435521.00000000044FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxTray
Source: Zeew.exe, 0000000E.00000002.2909435521.00000000044FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: sandboxierpcssGSOFTWARE\VMware, Inc.\VMware VGAuth
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareVBox

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Process information queried: ProcessInformation

Jump to behavior

Enables debug privileges

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Memory allocated: page read and write | page guard

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 26 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 34 > nul && copy "C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe" "C:\Users\user\AppData\Roaming\Zeew.exe" && ping 127.0.0.1 -n 34 > nul && "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Zeew.exe "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 34 > nul && copy "c:\users\user\desktop\po#36538_orden_indirect_buyer_procurement_americas_mexicos_24.exe" "c:\users\user\appdata\roaming\zeew.exe" && ping 127.0.0.1 -n 34 > nul && "c:\users\user\appdata\roaming\zeew.exe"
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 34 > nul && copy "c:\users\user\desktop\po#36538_orden_indirect_buyer_procurement_americas_mexicos_24.exe" "c:\users\user\appdata\roaming\zeew.exe" && ping 127.0.0.1 -n 34 > nul && "c:\users\user\appdata\roaming\zeew.exe"			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Queries volume information: C:\Users\user\AppData\Roaming\Zeew.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe PID: 7440, type: MEMORYSTR

Yara detected Credential Stealer

Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe PID: 7440, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe PID: 7440, type: MEMORYSTR

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

AV Detection

Found malware configuration

Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Zeew.exe

ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Zeew.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Joe Sandbox ML: detected

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 4x nop then mov eax, dword ptr [ebp-1Ch]		0_2_00BB47C8
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 4x nop then mov eax, dword ptr [ebp-1Ch]		14_2_017747C8

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2212190192.0000000006F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_00BB6B20	0_2_00BB6B20
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_00BBBEDF	0_2_00BBBEDF
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_00BBE048	0_2_00BBE048
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_05CD4040	0_2_05CD4040
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_05CDC344	0_2_05CDC344
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_05CD4030	0_2_05CD4030
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_05CDDF28	0_2_05CDDF28
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_06F5B488	0_2_06F5B488
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_06F54018	0_2_06F54018
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_06F5EE00	0_2_06F5EE00
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_06F5EDF2	0_2_06F5EDF2
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_06F54008	0_2_06F54008
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077B41D8	0_2_077B41D8
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_07925B80	0_2_07925B80
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_0792D3A0	0_2_0792D3A0
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_07925B4D	0_2_07925B4D
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_07928368	0_2_07928368
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077B41BF	0_2_077B41BF
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_01776B20	14_2_01776B20
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_01777A10	14_2_01777A10
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0177DFC8	14_2_0177DFC8
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0177BEF1	14_2_0177BEF1
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_08114040	14_2_08114040
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0811C344	14_2_0811C344
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0811DF28	14_2_0811DF28
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_08114030	14_2_08114030
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_08284018	14_2_08284018
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0828B488	14_2_0828B488
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0828EDF1	14_2_0828EDF1
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0828EDC8	14_2_0828EDC8
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0828EE00	14_2_0828EE00

Sample file is different than original file name gathered from version info

Uses reg.exe to modify the Windows registry

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"

Yara signature match

Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, b9A.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, b9A.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/6@0/1

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Zeew.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8004:120:WilError_03

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe "C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe"
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 26 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 34 > nul && copy "C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe" "C:\Users\user\AppData\Roaming\Zeew.exe" && ping 127.0.0.1 -n 34 > nul && "C:\Users\user\AppData\Roaming\Zeew.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Zeew.exe "C:\Users\user\AppData\Roaming\Zeew.exe"
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 26 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 34 > nul && copy "C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe" "C:\Users\user\AppData\Roaming\Zeew.exe" && ping 127.0.0.1 -n 34 > nul && "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Zeew.exe "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static file information: File size 2853888 > 1048576

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x2ab200

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected DarkTortilla Crypter

Source: Yara match	File source: 14.2.Zeew.exe.4523510.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.39b44c0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Zeew.exe.4523510.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.5220000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.5220000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40fc411.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.39b44c0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43e8811.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f86201.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3e0ffe1.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2192134157.0000000002A3A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2210039009.0000000005220000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2909435521.00000000044FE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000004219000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000004505000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2192134157.0000000002771000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2902624019.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Zeew.exe PID: 7824, type: MEMORYSTR

.NET source code contains method to dynamically call methods (often used by packers)

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, j4F9.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[0]}, (string[])null, (Type[])null, (bool[])null, true)
Source: Zeew.exe.8.dr, j4F9.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[0]}, (string[])null, (Type[])null, (bool[])null, true)

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077BBB70 push ecx; ret	0_2_077BBB82
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077B332E push FFFFFFE9h; retn 0001h	0_2_077B3338
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077BBB06 pushad ; ret	0_2_077BBB43
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_077B1E0D push FFFFFF8Bh; iretd	0_2_077B1E0F
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_0792B7A8 push es; ret	0_2_0792B7E2
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_0792E245 push FFFFFF8Bh; iretd	0_2_0792E247
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_0792E056 push edi; ret	0_2_0792E057
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Code function: 0_2_0792E061 push edi; ret	0_2_0792E062
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_0177DA14 pushad ; iretd	14_2_0177DA25
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_05F24E40 push eax; ret	14_2_05F24E41
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Code function: 14_2_07E7195A push 00000059h; ret	14_2_07E7195E

Drops PE files

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Zeew.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Zeews			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Zeews			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	File opened: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe\:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	File opened: C:\Users\user\AppData\Roaming\Zeew.exe\:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe PID: 7440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Zeew.exe PID: 7824, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Binary or memory string: SBIEDLL.DLL

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Memory allocated: BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Memory allocated: 2690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Memory allocated: 1770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Memory allocated: 3340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Memory allocated: 5340000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Window / User API: threadDelayed 1426			Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Window / User API: threadDelayed 8431			Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe TID: 8032	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 7232	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 7232	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 3584	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 3584	Thread sleep time: -32000s >= -30000s	Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2210039009.0000000005220000.00000004.08000000.00040000.00000000.sdmp, PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, Zeew.exe, 0000000E.00000002.2909435521.00000000044FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VBoxTray
Source: Zeew.exe, 0000000E.00000002.2909435521.00000000044FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: sandboxierpcssGSOFTWARE\VMware, Inc.\VMware VGAuth
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareVBox

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Process information queried: ProcessInformation

Jump to behavior

Enables debug privileges

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Memory allocated: page read and write | page guard

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 26 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 34 > nul && copy "C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe" "C:\Users\user\AppData\Roaming\Zeew.exe" && ping 127.0.0.1 -n 34 > nul && "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 26	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Zeews" /t REG_SZ /d "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 34	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\Zeew.exe "C:\Users\user\AppData\Roaming\Zeew.exe"	Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 34 > nul && copy "c:\users\user\desktop\po#36538_orden_indirect_buyer_procurement_americas_mexicos_24.exe" "c:\users\user\appdata\roaming\zeew.exe" && ping 127.0.0.1 -n 34 > nul && "c:\users\user\appdata\roaming\zeew.exe"
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd" /c ping 127.0.0.1 -n 34 > nul && copy "c:\users\user\desktop\po#36538_orden_indirect_buyer_procurement_americas_mexicos_24.exe" "c:\users\user\appdata\roaming\zeew.exe" && ping 127.0.0.1 -n 34 > nul && "c:\users\user\appdata\roaming\zeew.exe"			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Queries volume information: C:\Users\user\AppData\Roaming\Zeew.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zeew.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe PID: 7440, type: MEMORYSTR

Yara detected Credential Stealer

Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe PID: 7440, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.40befe2.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3dd2bb2.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.3f48dd2.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.43ab3e2.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.38f2560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe PID: 7440, type: MEMORYSTR

ID:	1465559
Product:	CloudBasic
Start time:	20:02:17
Start date:	01.07.2024
Sample:	PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	3fab44c211a6c5519aa034184aca3fdb
SHA1:	4d4618e371726bd5f7cca66659fd67ecb9b1d9cf
SHA256:	afb3c2222365641951a91bb0a55a1cdd2774539475a79c0deb8fa6bbd3d56f53
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe.log	ASCII text, with CRLF line terminators	7B709BC412BEC5C3CFD861C041DAD408	532EA6BB3018AE3B51E7A5788F614A6C49252BCF	733765A1599E02C53826A4AE984426862AA714D8B67F889607153888D40BBD75
C:\Users\user\AppData\Roaming\Zeew.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	3FAB44C211A6C5519AA034184ACA3FDB	4D4618E371726BD5F7CCA66659FD67ECB9B1D9CF	AFB3C2222365641951A91BB0A55A1CDD2774539475A79C0DEB8FA6BBD3D56F53
C:\Users\user\AppData\Roaming\Zeew.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
\Device\Null	ASCII text, with CRLF line terminators	7D8F2FA98B86E080D796590736DB0227	10E199AEB3825D116FA76A359ACE6FBE990D70DE	1475DD46581303AF825077D718EFD1AB0656D4A671248A4286DBE65C56AA0A14

Windows Analysis Report
PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2210039009.0000000005220000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMiPro.dll, vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameturbomailer.exe8 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7bc3a901-84f9-4a81-8277-20a61843655f.exe4 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000004219000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameturbomailer.exe8 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.00000000043AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7bc3a901-84f9-4a81-8277-20a61843655f.exe4 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7bc3a901-84f9-4a81-8277-20a61843655f.exe4 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003891000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMiPro.dll, vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000004505000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameturbomailer.exe8 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.000000000463E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameturbomailer.exe8 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003DB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7bc3a901-84f9-4a81-8277-20a61843655f.exe4 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2191221384.000000000062E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameturbomailer.exe8 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000002.2196335827.0000000003F2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7bc3a901-84f9-4a81-8277-20a61843655f.exe4 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe, 00000000.00000000.1656704777.0000000000A2E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameturbomailer.exe8 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe
Source: PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe	Binary or memory string: OriginalFilenameturbomailer.exe8 vs PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Windows Analysis Report PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Windows Analysis Report
PO#36538_orden_Indirect_Buyer_Procurement_Americas_mexicos_24.exe

Malware Threat Intel
Provided by