Windows Analysis Report
mIzAhxUQjY.exe

Overview

General Information

Sample name: mIzAhxUQjY.exe
renamed because original name is a hash value
Original sample name: 501ae6c21ceb803f00f565f4de6a476ee71c7a7cf336edf8a722dc00033e42c8.exe
Analysis ID: 1466962
MD5: fb520aa6e750c9527a1f06587b71d541
SHA1: 8e559f1ef60d530817c65669eafa53fd27a83c82
SHA256: 501ae6c21ceb803f00f565f4de6a476ee71c7a7cf336edf8a722dc00033e42c8
Tags: exe
Infos:

Detection

Score: 54
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Machine Learning detection for sample
Uses Windows timers to delay execution
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Program does not show much activity (idle)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: mIzAhxUQjY.exe Avira: detected
Multi AV Scanner detection for submitted file
Source: mIzAhxUQjY.exe ReversingLabs: Detection: 58%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 97.9% probability
Machine Learning detection for sample
Source: mIzAhxUQjY.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: mIzAhxUQjY.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E04696 GetFileAttributesW,FindFirstFileW,FindClose, 0_2_00E04696
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_00E0C9C7
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0C93C FindFirstFileW,FindClose, 0_2_00E0C93C
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00E0F200
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00E0F35D
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_00E0F65E
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E03A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_00E03A2B
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E03D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_00E03D4E
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_00E0BF27
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E125E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile, 0_2_00E125E2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E1425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_00E1425A
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E14458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_00E14458
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E1425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_00E1425A
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E00219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState, 0_2_00E00219
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E2CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 0_2_00E2CDAC

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: This is a third-party compiled AutoIt script. 0_2_00DA3B4C
Source: mIzAhxUQjY.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: mIzAhxUQjY.exe, 00000000.00000002.1855356809.0000000000E55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_f134cc75-a
Source: mIzAhxUQjY.exe, 00000000.00000002.1855356809.0000000000E55000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_4f9c3a53-3
Source: mIzAhxUQjY.exe String found in binary or memory: This is a third-party compiled AutoIt script. memstr_8a9653f3-4
Source: mIzAhxUQjY.exe String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_80d038bb-a
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E040B1: CreateFileW,_memset,DeviceIoControl,CloseHandle, 0_2_00E040B1
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DF8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00DF8858
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 0_2_00E0545F
Detected potential crypto function
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E2804A 0_2_00E2804A
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DAE060 0_2_00DAE060
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DB4140 0_2_00DB4140
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DC2405 0_2_00DC2405
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DD6522 0_2_00DD6522
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E20665 0_2_00E20665
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DD267E 0_2_00DD267E
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DB6843 0_2_00DB6843
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DAE800 0_2_00DAE800
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DC283A 0_2_00DC283A
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DD89DF 0_2_00DD89DF
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E20AE2 0_2_00E20AE2
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DD6A94 0_2_00DD6A94
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DB8A0E 0_2_00DB8A0E
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DFEB07 0_2_00DFEB07
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E08B13 0_2_00E08B13
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DCCD61 0_2_00DCCD61
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DD7006 0_2_00DD7006
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DB3190 0_2_00DB3190
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DB710E 0_2_00DB710E
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DA1287 0_2_00DA1287
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DC33C7 0_2_00DC33C7
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DCF419 0_2_00DCF419
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DC16C4 0_2_00DC16C4
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DB5680 0_2_00DB5680
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DC78D3 0_2_00DC78D3
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DB58C0 0_2_00DB58C0
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DC1BB8 0_2_00DC1BB8
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DCDBB5 0_2_00DCDBB5
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DD9D05 0_2_00DD9D05
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DAFE40 0_2_00DAFE40
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DC1FD0 0_2_00DC1FD0
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DCBFE6 0_2_00DCBFE6
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: String function: 00DC8B40 appears 42 times
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: String function: 00DC0D27 appears 70 times
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: String function: 00DA7F41 appears 35 times
Uses 32bit PE files
Source: mIzAhxUQjY.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal54.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0A2D5 GetLastError,FormatMessageW, 0_2_00E0A2D5
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DF8713 AdjustTokenPrivileges,CloseHandle, 0_2_00DF8713
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DF8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 0_2_00DF8CC3
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 0_2_00E0B59E
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E1F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 0_2_00E1F121
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E186D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear, 0_2_00E186D0
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DA4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 0_2_00DA4FE9
Source: mIzAhxUQjY.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: mIzAhxUQjY.exe ReversingLabs: Detection: 58%
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: ndfapi.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: wdi.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: ndfapi.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: wdi.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Automated click: OK
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: mIzAhxUQjY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: mIzAhxUQjY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: mIzAhxUQjY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: mIzAhxUQjY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: mIzAhxUQjY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: mIzAhxUQjY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: mIzAhxUQjY.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: mIzAhxUQjY.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: mIzAhxUQjY.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: mIzAhxUQjY.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: mIzAhxUQjY.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: mIzAhxUQjY.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E1C304 LoadLibraryA,GetProcAddress, 0_2_00E1C304
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E08719 push FFFFFF8Bh; iretd 0_2_00E0871B
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DCE94F push edi; ret 0_2_00DCE951
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DCEA68 push esi; ret 0_2_00DCEA6A
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DC8B85 push ecx; ret 0_2_00DC8B98
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DCEC43 push esi; ret 0_2_00DCEC45
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DCED2C push edi; ret 0_2_00DCED2E
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DA4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_00DA4A35
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E255FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 0_2_00E255FD
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DC33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_00DC33C7
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Uses Windows timers to delay execution
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe User Timer Set: Timeout: 750ms Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe User Timer Set: Timeout: 750ms Jump to behavior
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe User Timer Set: Timeout: 750ms Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe API coverage: 3.8 %
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E04696 GetFileAttributesW,FindFirstFileW,FindClose, 0_2_00E04696
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_00E0C9C7
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0C93C FindFirstFileW,FindClose, 0_2_00E0C93C
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00E0F200
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_00E0F35D
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_00E0F65E
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E03A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_00E03A2B
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E03D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_00E03D4E
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E0BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_00E0BF27
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DA4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_00DA4AFE
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E141FD BlockInput, 0_2_00E141FD
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DA3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 0_2_00DA3B4C
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DD5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_00DD5CCC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E1C304 LoadLibraryA,GetProcAddress, 0_2_00E1C304
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DF81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 0_2_00DF81F7
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DCA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00DCA395
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DCA364 SetUnhandledExceptionFilter, 0_2_00DCA364
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DF8C93 LogonUserW, 0_2_00DF8C93
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DA3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 0_2_00DA3B4C
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DA4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_00DA4A35
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E04EF5 mouse_event, 0_2_00E04EF5
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DF81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 0_2_00DF81F7
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E04C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 0_2_00E04C03
Source: mIzAhxUQjY.exe Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: mIzAhxUQjY.exe Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DC886B cpuid 0_2_00DC886B
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DD50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00DD50D7
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DE2230 GetUserNameW, 0_2_00DE2230
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DD418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 0_2_00DD418A
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00DA4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_00DA4AFE
OS version to string mapping found (often used in BOTs)
Source: mIzAhxUQjY.exe Binary or memory string: WIN_81
Source: mIzAhxUQjY.exe Binary or memory string: WIN_XP
Source: mIzAhxUQjY.exe Binary or memory string: WIN_XPe
Source: mIzAhxUQjY.exe Binary or memory string: WIN_VISTA
Source: mIzAhxUQjY.exe Binary or memory string: WIN_7
Source: mIzAhxUQjY.exe Binary or memory string: WIN_8
Source: mIzAhxUQjY.exe Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E16596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 0_2_00E16596
Source: C:\Users\user\Desktop\mIzAhxUQjY.exe Code function: 0_2_00E16A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 0_2_00E16A5A
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1466962 Sample: mIzAhxUQjY.exe Startdate: 03/07/2024 Architecture: WINDOWS Score: 54 8 Antivirus / Scanner detection for submitted sample 2->8 10 Multi AV Scanner detection for submitted file 2->10 12 Binary is likely a compiled AutoIt script file 2->12 14 2 other signatures 2->14 5 mIzAhxUQjY.exe 1 1 2->5         started        process3 signatures4 16 Binary is likely a compiled AutoIt script file 5->16 18 Uses Windows timers to delay execution 5->18
⊘No contacted IP infos