Windows Analysis Report
SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Analysis ID:	1467262
MD5:	2808310786effc87a4359c778a73a7ee
SHA1:	525f278678ad73a34c368f0afc4558ed0454f076
SHA256:	33d9753ee9b3920352b743d72adfd62c969ab0619eb5673151f478ebdfa197a5
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

ReversingLabs: Detection: 39%

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.pdb0 source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: ABC.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbMZ@ source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: C:\Users\admin\Downloads\Disable WD (1)\ABC\ABC\obj\Release\ABC.pdb source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source:	Binary string: System.Core.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER20ED.tmp.dmp.8.dr

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe, 00000000.00000002.2011623866.0000000003071000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe, 00000004.00000002.2415110679.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 0_2_01363750	0_2_01363750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 0_2_01362E80	0_2_01362E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 0_2_01362B38	0_2_01362B38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 4_2_010E3750	4_2_010E3750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 4_2_010E2E80	4_2_010E2E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 4_2_010E2B38	4_2_010E2B38

One or more processes crash

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 1036

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe, 00000000.00000000.2005958310.0000000000C32000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameABC.exe( vs SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe, 00000000.00000002.2011110867.000000000138E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe, 00000004.00000002.2415110679.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameABC.exe( vs SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Binary or memory string: OriginalFilenameABC.exe( vs SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Source: classification engine

Classification label: mal52.winEXE@5/7@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3692:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2700
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\745b9392-496b-44cd-8c79-53334d19ac0e

Jump to behavior

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_Process Where ProcessID = 6692
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process.Handle="6692"::GetOwner
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_Process Where ProcessID = 2700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process.Handle="2700"::GetOwner

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 1036

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mscorlib.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.pdb0 source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: ABC.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbMZ@ source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: C:\Users\admin\Downloads\Disable WD (1)\ABC\ABC\obj\Release\ABC.pdb source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source:	Binary string: System.Core.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER20ED.tmp.dmp.8.dr

Binary contains a suspicious time stamp

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: 0xFE70109B [Thu Apr 9 21:52:27 2105 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 1360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 3070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 2A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 4A20000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe TID: 1200

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Process information queried: ProcessInformation

Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process queried: DebugPort			Jump to behavior

Enables debug privileges

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

ReversingLabs: Detection: 39%

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Joe Sandbox ML: detected

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.pdb0 source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: ABC.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbMZ@ source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: C:\Users\admin\Downloads\Disable WD (1)\ABC\ABC\obj\Release\ABC.pdb source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source:	Binary string: System.Core.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER20ED.tmp.dmp.8.dr

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe, 00000000.00000002.2011623866.0000000003071000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe, 00000004.00000002.2415110679.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.8.dr	String found in binary or memory: http://upx.sf.net

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 0_2_01363750	0_2_01363750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 0_2_01362E80	0_2_01362E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 0_2_01362B38	0_2_01362B38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 4_2_010E3750	4_2_010E3750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 4_2_010E2E80	4_2_010E2E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Code function: 4_2_010E2B38	4_2_010E2B38

One or more processes crash

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 1036

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe, 00000000.00000000.2005958310.0000000000C32000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameABC.exe( vs SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe, 00000000.00000002.2011110867.000000000138E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe, 00000004.00000002.2415110679.0000000002A21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameABC.exe( vs SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Binary or memory string: OriginalFilenameABC.exe( vs SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Source: classification engine

Classification label: mal52.winEXE@5/7@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3692:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2700
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\745b9392-496b-44cd-8c79-53334d19ac0e

Jump to behavior

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_Process Where ProcessID = 6692
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process.Handle="6692"::GetOwner
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_Process Where ProcessID = 2700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process.Handle="2700"::GetOwner

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 1036

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mscorlib.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Management.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.pdb0 source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: ABC.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.pdbMZ@ source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.ni.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.pdb source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: C:\Users\admin\Downloads\Disable WD (1)\ABC\ABC\obj\Release\ABC.pdb source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Source:	Binary string: System.Core.ni.pdbRSDS source: WER20ED.tmp.dmp.8.dr
Source:	Binary string: System.Core.ni.pdb source: WER20ED.tmp.dmp.8.dr

Binary contains a suspicious time stamp

Source: SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Static PE information: 0xFE70109B [Thu Apr 9 21:52:27 2105 UTC]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 1360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 3070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 2A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Memory allocated: 4A20000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe TID: 1200

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Amcache.hve.8.dr	Binary or memory string: VMware
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.8.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.8.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.8.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.8.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.8.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.8.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.8.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.8.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.8.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.8.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.8.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.8.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.8.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.8.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.8.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.8.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.8.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Process information queried: ProcessInformation

Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process queried: DebugPort			Jump to behavior

Enables debug privileges

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Memory allocated: page read and write | page guard

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.8.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.8.dr	Binary or memory string: MsMpEng.exe

ID:	1467262
Product:	CloudBasic
Start time:	23:29:07
Start date:	03.07.2024
Sample:	SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	2808310786effc87a4359c778a73a7ee
SHA1:	525f278678ad73a34c368f0afc4558ed0454f076
SHA256:	33d9753ee9b3920352b743d72adfd62c969ab0619eb5673151f478ebdfa197a5
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HHILU52QJYGQXVY5_66b95f189632357356324fccc990573e605dff9b_daefafe1_d57dd59e-8b18-45dd-b2d7-380d4be2e871\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	810471E6462F417EFC151D03C6C7CFF2	3938381B0D88CF7490BE485816697A31FE20802D	E8D08A8EBCC62149BE444005F4487F52AC6C870419FDBD57FAE5973A4CADC7C9
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20ED.tmp.dmp	Mini DuMP crash report, 15 streams, Wed Jul 3 21:29:55 2024, 0x1205a4 type	E1AF11E02FF690085615C0FEBA89ED1B	1B7E20890DE5BDFF4ECE7A8672E5FD988459634C	5D5038C6776B1455AA6CC476F8D2796E86A42617DA7A7B35D659E0922E97B76A
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2350.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	5A7DED512758190AEF33B3DD95F1EF9E	F4D52F88E9E2BD90A40C874FA43425A790DA32C9	1CCD0D3EE652F2B1FE1ED87076DD425B9A06D8F465A92F9AE531C879BC6F733F
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2370.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	B6579F8FE09BD1BC0E171776A143E10B	33428729A52FFBB949F62571956BF08691B9DF2D	C861A6F8FFD8A6793B452CA1D7C8E2477137C1C0C30A6CFB149ED299ED449775
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe.log	CSV text	134F0668B8F37D560B4D8C617407BA79	819571730A25D180A1F85F9991E7D00EE1927E1B	3705F978CF66225BC42AFA9C69006C3B81CB92DD77C08400E9C68FC35F140D57
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	E46C8C8BBE28DB32AF043EDC7C80559D	A33771DE9E6EABCC7F56DB23F745F6F4BA5D7573	A27583522E3A6DE57D38C09025343A63FD24B99E08D824BAF9000F64EFBCE3DA
\Device\ConDrv	ASCII text, with CRLF, LF line terminators	78BC86DDC54340834D55D50A02A65B68	5FE10B581F51CA729EAB9EEB808126D64B9F3634	1F3FAF1FE3F1D5EFE7315609B77B3EB075958A153018E13228A4DFF2A2DFC515

Windows Analysis Report
SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
SecuriteInfo.com.Trojan.AVKillNET.1.18071.13447.exe